How to disable directory listings
A directory without an index file may show every file in it, including backups and uploads. One server setting turns it off.
Step by step, with screenshots: Directory listings and exposed files: .env, .git and backups →
Check your own site
Runs these 2 checks and the other 191, free, in about 45 seconds.
Or run only this check with the free WordPress health check or the free Hacked site & SEO spam checker.
What it is
Directory listing, also called directory browsing or auto-indexing, is a web server feature that shows an automatically generated "Index of /" page listing every file in a folder when the folder has no index.html or index.php. Anyone who opens that folder's URL sees the list and can download the files.
Listings expose files nobody meant to publish: backups, database dumps, old versions of scripts, private uploads and configuration files, and attackers and search engines find them easily. getReport requests a few common folders and fails the check if any of them returns a listing. Your site is OK when every folder without an index page returns 403 Forbidden or 404 Not Found instead.
What a passing site looks like
- No directory shows a file listingfail · −6 ptseffort S
- The uploads folder does not list its fileswarning · −1.5 ptseffort S
1. Directory listings
Why it matters. An auto-generated "Index of /" page shows every file in the folder, including backups, uploads and configuration files nobody ever linked to.
- Apache: Options -Indexes in .htaccess; nginx: autoindex off; or put an empty index.html in the folder.
2. The uploads folder lists all its files
Why it matters. A browsable uploads folder shows every file ever uploaded, including drafts, private PDFs and exports that were never linked from a page.
- Turn off directory listing for the site (Options -Indexes on Apache, autoindex off on nginx), or ask your host to.
- Check the list for files that should not be public and delete them.
In a report the technical detail reads: A folder under /wp-content/uploads/ answers with an "Index of" listing.
Questions people ask
What is directory browsing?
It is the same thing as directory listing: when a URL points to a folder instead of a file and there is no index file, the web server builds a page listing the folder's contents. Apache does this when Options Indexes is on, IIS has a Directory Browsing setting, and nginx does it only when autoindex is switched on.
How do I disable directory browsing in Apache?
Add Options -Indexes to the .htaccess file in your site's root folder, or to the Directory block in the server configuration, and reload Apache. Folders without an index file then return 403 Forbidden. Many hosts also let you turn listings off in the control panel, for example under Indexes in cPanel. Check a folder such as /wp-content/uploads/ afterwards.
Should I ever allow directory browsing?
Only for folders you intend as public downloads, such as a software mirror or an open archive, and only when every file in them is meant to be seen. For a normal website there is no reason to allow it. If visitors need a list of files, publish a simple index page you control instead.