Python HTTP Server: http.server, Ports, Directories, and Safety

Quick answer: Python’s http.server is a convenient local file server and teaching tool. Run it with a deliberate directory, port, and bind address, but do not expose it to untrusted clients or use it as a production web server because it provides only basic security checks.

Python’s http.server module lets you start a simple HTTP server from the command line or from a small Python script. It is useful for local testing, sharing a temporary folder on a trusted network, or previewing static HTML files.

It is not a production web server. The official Python http.server documentation warns that the module only implements basic security checks and is not recommended for production.

Start a local HTTP server from the command line

Open a terminal in the folder you want to serve and run:

python -m http.server

By default, Python serves the current directory on port 8000. Open this URL in your browser:

http://localhost:8000/

Stop the server with Ctrl+C.

If Windows cannot find Python, fix that first with our guide to Python not recognized as an internal or external command.

Choose a different port

Pass the port number at the end of the command:

python -m http.server 9000

Then open:

http://localhost:9000/

If the port is already in use, choose another port such as 8080, 9000, or 5000.

Serve a specific directory

You do not have to change into the folder first. Use --directory:

python -m http.server 8000 --directory ./public

This is safer than accidentally serving files from the wrong current directory. The SimpleHTTPRequestHandler documentation notes that it serves files from the given directory, or from the current directory if no directory is provided.

Bind to localhost or a network address

For local-only testing, bind to localhost:

python -m http.server 8000 --bind 127.0.0.1

Only your own machine should be able to access that server. To make the server reachable from another device on the same trusted network, bind to your local network IP address or all interfaces:

python -m http.server 8000 --bind 0.0.0.0

Then open the computer’s local IP address from the other device, for example:

http://192.168.1.25:8000/

Use this only on trusted networks. Anyone who can reach the server may be able to browse files in the served directory. To find host and network details in Python, see get hostname in Python.

What http.server is good for

• Previewing static HTML, CSS, JavaScript, image, or text files.
• Testing links and relative paths locally.
• Temporarily sharing a folder on a trusted local network.
• Quick experiments with Python request handlers.

What http.server is not good for

• Public production websites.
• Authentication or private file sharing.
• Running untrusted scripts or user uploads.
• Replacing Flask, Django, FastAPI, nginx, Apache, or a real static host.

Create a simple HTTP server in Python code

For many cases, the command-line form is enough. If you want a small script, use HTTPServer and BaseHTTPRequestHandler:

from http.server import BaseHTTPRequestHandler, HTTPServer

HOST = "127.0.0.1"
PORT = 8000


class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        body = b"Hello from Python http.server"
        self.send_response(200)
        self.send_header("Content-Type", "text/plain; charset=utf-8")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)


if __name__ == "__main__":
    with HTTPServer((HOST, PORT), Handler) as server:
        print("Serving on " + "http" + "://" + f"{HOST}:{PORT}")
        server.serve_forever()

This is a learning example. For real web applications, use a web framework and a production-ready server stack.

Use ThreadingHTTPServer for browser behavior

Some browsers open multiple connections. Python provides ThreadingHTTPServer for simple threaded handling:

from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer

with ThreadingHTTPServer(("127.0.0.1", 8000), SimpleHTTPRequestHandler) as server:
    print("Serving on " + "http" + "://127.0.0.1:8000")
    server.serve_forever()

The official docs note that ThreadingHTTPServer is useful for handling browsers that pre-open sockets.

Can http.server use HTTPS?

Current Python includes HTTPS server classes in http.server, but that does not make the module a production server. HTTPS also requires certificate files and correct TLS configuration. For most local static testing, plain localhost HTTP is enough. For production HTTPS, use a proper web server or platform.

Security checklist

• Serve only the folder you intend to expose.
• Bind to 127.0.0.1 unless another device truly needs access.
• Do not expose http.server directly to the internet.
• Do not rely on quick Basic Auth snippets to protect sensitive files.
• Stop the server when the test is finished.

Common errors

Related Python networking topics

If you are working with network basics, see Python IRCD. For project isolation before testing Python apps, use a virtual environment; the official venv documentation explains the standard tool.

Conclusion

python -m http.server is a convenient local static file server. Use it for quick previews and trusted local sharing, choose the served directory and bind address deliberately, and remember that it is not a secure production server.

Start With A Known Directory

python -m http.server serves the current directory by default. Prefer –directory when a script or shell may be running somewhere unexpected, and inspect the path before starting so private files are not published accidentally.

Choose The Port And Bind Address

A port identifies the listening service, while the bind address controls which interfaces can reach it. Local development usually needs localhost or 127.0.0.1. Binding to all interfaces is a deliberate network exposure and should be limited to a trusted environment with a clear firewall policy.

Use A Handler For Small Experiments

HTTPServer and a request handler can demonstrate headers, routes, and simple responses. Validate paths and headers, send an accurate content type, close resources, and keep the example small. A custom handler is not automatically safer than the built-in one.

Understand What It Does Not Provide

http.server is not a production framework, reverse proxy, authentication layer, TLS deployment, upload service, or application server. It lacks the operational hardening, observability, access control, and performance characteristics expected for public traffic.

Protect Files And Clients

SimpleHTTPRequestHandler can follow symbolic links, and serving a directory exposes its readable files. Do not place secrets in the served tree, do not enable unsafe CGI behavior for untrusted clients, and stop the process when the local task is complete.

Test The Local Workflow

Test the exact directory, port, bind address, response status, content type, missing-file behavior, and shutdown path. Use a local HTTP client with a timeout and ensure the test cannot reach or modify files outside the intended fixture.

The official http.server documentation describes the command, handlers, and security limitations. Python’s security considerations explicitly warn that it is not suitable for production. Related guidance includes process boundaries and local tests.

For related local network work, compare HTTP JSON clients, process boundaries, and server tests when keeping a development server scoped.

Frequently Asked Questions

How do I start a Python HTTP server?

Run python -m http.server from the directory to serve, optionally passing a port or –directory path.

How do I choose a different port?

Pass the port after the module command, such as python -m http.server 8000, and confirm that the port is available.

Is Python http.server safe for production?

No. It implements only basic security checks and is intended for simple local or trusted-network development, not production hosting.

How do I bind the server to localhost?

Create the server with host 127.0.0.1 or use the command-line behavior appropriate to your Python version so it is not exposed unnecessarily on a network interface.