How to find the process listening to the localhost on OSX? In my Mac(10.11.5), I find a strange php server is listening to my localhost:

$ curl -i localhost

HTTP/1.1 200 OK
Date: Mon, 11 Jul 2016 10:05:11 GMT
Server: Apache/2.4.18 (Unix) PHP/5.6.23
Content-Location: index.html.en
Vary: negotiate
TCN: choice
Last-Modified: Mon, 11 Jun 2007 18:53:14 GMT
ETag: "2d-432a5e4a73a80"
Accept-Ranges: bytes
Content-Length: 45
Content-Type: text/html

&lt;html&gt;&lt;body&gt;&lt;h1&gt;It works!&lt;/h1&gt;&lt;/body&gt;&lt;/html&gt;


But I can't find any php process:

$ ps -ef | grep php

  501   724   500   0  6:06PM ttys000    0:00.00 grep php


And any suspicious process listening port 80:

$ lsof -i:80

COMMAND   PID USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
Google    526 Sona  202u  IPv4 0x9de3b88faf523ff9      0t0  TCP sayakiss-mbp.lan:49823-&gt;72-165-119-59.dia.static.qwest.net:http (CLOSED)
Google    526 Sona  219u  IPv4 0x9de3b88faf521c19      0t0  TCP sayakiss-mbp.lan:49827-&gt;72-165-119-17.dia.static.qwest.net:http (CLOSED)
Google    526 Sona  226u  IPv4 0x9de3b88faf510e09      0t0  TCP sayakiss-mbp.lan:49808-&gt;pixel.quantserve.com:http (CLOSED)
Google    526 Sona  236u  IPv4 0x9de3b88faf523701      0t0  TCP sayakiss-mbp.lan:49824-&gt;72-165-119-59.dia.static.qwest.net:http (CLOSED)
Google    526 Sona  237u  IPv4 0x9de3b88faf522e09      0t0  TCP sayakiss-mbp.lan:49825-&gt;72-165-119-59.dia.static.qwest.net:http (CLOSED)
Google    526 Sona  238u  IPv4 0x9de3b88faf522511      0t0  TCP sayakiss-mbp.lan:49826-&gt;72-165-119-59.dia.static.qwest.net:http (CLOSED)
Google    526 Sona  239u  IPv4 0x9de3b88faf53ee09      0t0  TCP sayakiss-mbp.lan:49828-&gt;72-165-119-17.dia.static.qwest.net:http (CLOSED)
Google    526 Sona  240u  IPv4 0x9de3b88faf53f701      0t0  TCP sayakiss-mbp.lan:49829-&gt;72-165-119-17.dia.static.qwest.net:http (CLOSED)
QQ        640 Sona   11u  IPv4 0x9de3b88f96e3fff9      0t0  TCP sayakiss-mbp.lan:49717-&gt;123.151.10.189:http (ESTABLISHED)
QQ        640 Sona   13u  IPv4 0x9de3b88f96e3fff9      0t0  TCP sayakiss-mbp.lan:49717-&gt;123.151.10.189:http (ESTABLISHED)


My question:


How to find the process listening to localhost?
How to find the file which returns by php?(As you see, php returns something contains It works!, so there must be a file contains that text...)
Your Mac's built in webserver is turned on.


  To Turn On: sudo apachectl start
  
  To Turn Off: sudo apachectl stop


The process you are actually looking for is httpd, the Apache server.

$ ps -ef | grep httpd  
  0 76078     1   0  3:56am ??         0:00.32 /usr/sbin/httpd -D FOREGROUND  
 70 76084 76078   0  3:56am ??         0:00.00 /usr/sbin/httpd -D FOREGROUND  
501 76139 76048   0  3:58am ttys000    0:00.00 grep httpd  


The file that is being loaded is /Library/WebServer/Documents/index.html.en, because /Library/WebServer/Documents is configured as the DocumentRoot in the default /etc/apache2/httpd.conf file that is included with OS X.