How do I disable directory listing on my server?

Directory listing, also called autoindex, makes a web server generate an HTML index of everything in a folder when no index file is present. It is a convenience that doubles as an information-disclosure bug: with directory listing enabled, anyone who guesses a path can read the file names inside it and then fetch the ones that were never meant to be public. The fix is a single directive away on most servers.

Why this matters

OWASP treats this as a textbook Security Misconfiguration. In the A05:2021 example scenarios, one reads: directory listing is not disabled on the server, an attacker discovers they can list directories, downloads compiled files, decompiles them to view the code, and finds a severe access control flaw. The pattern generalizes. A listing hands an attacker three things at once: the exact names of files, their sizes and timestamps, and a confirmation that a path exists, which is all the reconnaissance needed to target a follow-up request.

The files that turn up in a listing are rarely the ones you intended to be reachable. Backup archives, database dumps, editor swap files, exported spreadsheets, unpublished media, and internal configuration are the usual suspects, and a browsable folder makes every one of them a one-click download. Even where nothing secret is present, the listing leaks structure, versioning, and naming conventions that make other attacks easier.

How to fix it

On Apache, automatic index generation is turned on with Options +Indexes, as the mod_autoindex documentation states. Remove the Indexes option and, for clarity, set Options -Indexes on the served directory. Because the Options directive is not permitted inside Files or FilesMatch sections, place it in a Directory block, or in .htaccess with the Indexes override enabled. On Nginx, the autoindex directive defaults to off, so the task is to confirm no location turns it on and to set it off explicitly.

# Apache — httpd.conf, vhost, or .htaccess
<Directory "/var/www/html">
    Options -Indexes
</Directory>

# Nginx
location / {
    autoindex off;
}

Static hosts behave differently, and it is worth being precise about which rule applies. Cloudflare Pages serves your build output as static assets and does not generate a directory index, so there is no server toggle to flip and nothing to disable for files it serves. The exposure can only come back if you add your own Function that builds a file list; that logic is entirely yours and should never enumerate a directory to the public.

How to verify the fix

Request a folder that has no index file and inspect both the status code and the body. A generated listing usually answers with a 200 and a page named like Index of /, while a hardened server returns 403 or 404 with no file names. Testing by status code alone is not enough, because some deployments return 200 for an error page, so grep the body as well.

curl -s -o /dev/null -w '%{http_code}\n' https://example.com/uploads/
curl -s https://example.com/uploads/ | grep -i 'Index of'

Related issues