Skip to content

How to disable directory listings

Security1 min readFixes check directory-listing

A directory without an index file may show every file in it, including backups and uploads. One server setting turns it off.

Step by step, with screenshots: Backups that actually restore: a small-site backup plan you can test →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • No directory shows a file listingfail · −6 ptseffort S

Directory listings

Why it matters. An auto-generated "Index of /" page shows every file in the folder, including backups, uploads and configuration files nobody ever linked to.

How to fix it.
  1. Apache: Options -Indexes in .htaccess; nginx: autoindex off; or put an empty index.html in the folder.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.