How to turn off localhost web server
Hidden web server
The web server running on your server is the one used by cupsd to manage your printers queue.
The command:
nmap localhost -p 80

will show you that it is actually closed, unless you activated the sharing of a printer.
You can stop cupsd either through the GUI of System Preferences… or with launchctl:
/usr/bin/sudo launchctl unload /System/Library/LaunchDaemons/org.cups.cups-lpd.plist
/usr/bin/sudo launchctl unload /System/Library/LaunchDaemons/org.cups.cups.plist

Nmap
If you don't have nmap because your version of MacOS doesn't anymore bring this useful software (which is a total failure for people who need to analyse network problems) you can easily install it with Macports or Brew. I estimate uou will need 15 minutes to install it, read the basic documentation. Within less than half an hour you will be able to discover holes through which your system can be attacked.