Ensure HTTP Server Is Disabled

MediumLevel 1Automatedmacos

Description

macOS used to have a graphical front-end to the embedded Apache web server in the operating system. Personal web sharing could be enabled to allow someone on another computer to download files or information from the user's computer. Personal web sharing from a user endpoint has long been considered questionable, and Apple has removed that capability from the GUI.

How it is checked

Audit method: Shell command

shell

out=$(/bin/launchctl list 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -c 'org.apache.httpd' || true

Expected output: 0

How it is fixed

Fix method: Guidance or infrastructure patch

Terminal: sudo /usr/sbin/apachectl stop ; sudo /bin/launchctl unload -w /System/Library/LaunchDaemons/org.apache.httpd.plist.

Properties

Operating systems: macos-26
Tags: macosnetwork
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 4.2 Ensure HTTP Server Is Disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos