Introduction

In Spring Boot, actuator endpoints share the management web server configuration. That means you can move /actuator/health onto a different port by setting management.server.port, but that setting moves the management HTTP endpoints together. It does not give only the health endpoint its own completely separate port while leaving the rest of actuator on the main application port.

The Main Property

By default, actuator endpoints are served on the main application port. If the app runs on 8080, then health is typically available at:

http://localhost:8080/actuator/health

To move management endpoints to another port, use:

1server.port=8080
2management.server.port=8081
3management.endpoints.web.base-path=/actuator
4management.endpoints.web.exposure.include=health,info

With that configuration:

• normal application traffic stays on 8080
• actuator web endpoints move to 8081
• health becomes http://localhost:8081/actuator/health

That is the standard Spring Boot way to separate management traffic from application traffic.

YAML Version

The same configuration in YAML:

1server:
2  port: 8080
3
4management:
5  server:
6    port: 8081
7  endpoints:
8    web:
9      base-path: /actuator
10      exposure:
11        include: health,info

This is often easier to maintain in projects that already keep most Spring Boot configuration in application.yml.

Important Limitation

The title question sounds like only the health endpoint should move. Spring Boot does not provide a separate port setting for one individual actuator web endpoint.

The management port applies to the management web server as a whole. So if you configure:

management.server.port=8081

then web-exposed actuator endpoints use that management port together.

If the real requirement is:

• health on one port
• other actuator endpoints on another port

then you usually need a different architecture, such as:

• a reverse proxy that routes selectively
• separate deployment boundaries
• a custom endpoint exposure strategy in front of the app

Spring Boot’s built-in setting is for management-port separation, not per-endpoint port separation.

Minimal Example

1import org.springframework.boot.SpringApplication;
2import org.springframework.boot.autoconfigure.SpringBootApplication;
3import org.springframework.web.bind.annotation.GetMapping;
4import org.springframework.web.bind.annotation.RestController;
5
6@SpringBootApplication
7public class DemoApplication {
8    public static void main(String[] args) {
9        SpringApplication.run(DemoApplication.class, args);
10    }
11}
12
13@RestController
14class HelloController {
15    @GetMapping("/")
16    public String hello() {
17        return "hello";
18    }
19}

With the earlier configuration and Spring Boot Actuator on the classpath:

• 'http://localhost:8080/ serves the normal application route'
• 'http://localhost:8081/actuator/health serves health'

That is usually enough for load balancers, container probes, and internal monitoring.

Why Teams Use a Separate Management Port

A different management port is useful when:

• internal health checks should bypass public app routing
• firewalls or security groups differ for app traffic and operations traffic
• Kubernetes or load balancer probes should hit a dedicated listener
• operators want monitoring traffic isolated from business traffic

This is mainly an operational separation feature. It is helpful, but it is not complete security by itself. If the management port is publicly reachable, you still need access control and sane endpoint exposure.

Related Settings That Matter

A custom management port often goes with a narrow exposure list:

management.endpoints.web.exposure.include=health,info

If you are in a containerized environment, probe support may also matter:

1management:
2  endpoint:
3    health:
4      probes:
5        enabled: true

In some deployments you may also want to bind the management listener to a specific network address with management.server.address.

Common Pitfalls

The most common mistake is assuming Spring Boot can move only /actuator/health to a separate port while leaving other actuator endpoints on the original one. The built-in port setting applies to the management web server as a whole.

Another issue is changing management.server.port but forgetting to align infrastructure with it. Container port declarations, service definitions, and health probes must match the new port.

People also often assume a different port automatically makes management traffic secure. It only separates traffic; security rules still need to be enforced deliberately.

Finally, watch profile-specific configuration. An environment variable or production profile can override the port you think you set locally.

Summary

• Use management.server.port to move actuator web endpoints to a dedicated management port.
• This setting moves management web endpoints together, not only the health endpoint.
• Keep server.port for normal application traffic and expose only the actuator endpoints you need.
• Update probes, container ports, and service configuration to match the new management port.
• Treat the separate management port as traffic separation, not as complete security by itself.