Medium risk Website · Directory listing / directory browsing

Directory listing is enabled: what it means and how to fix it

By Stephane Meus, CEH, PenTest+ · Updated 12 October 2026 · 5 minute read

What directory listing is

When someone opens a folder address like https://your-site.com/uploads/ and the folder has no index.html or index.php page, the server has two choices: refuse, or show a list of everything in the folder. With directory listing on, it shows something like this:

Index of /backups

Name                     Last modified      Size
site-backup-2026-09.zip  2026-09-30 23:10   412M
customers-export.csv     2026-08-14 09:02   2.1M
wp-config.php.bak        2026-06-02 15:44   3.0K

Nobody has to guess file names. The server hands over the full list.

Why it matters

• Backups and exports leak. Site backups, database dumps (.sql), spreadsheets and CSV exports often end up in web folders "just for a minute" and stay there.
• Configuration and passwords. Copies like config.php.bak or .env files can contain database passwords and API keys in plain text.
• Private uploads. Invoices, IDs or documents customers uploaded become browsable.
• It's easy to find. Attackers search for "Index of /" pages with search engines and scanners, so you don't have to be a target to be found.

If the folder only holds public images, the risk is low, but the setting usually applies to the whole site, so fix it everywhere.

How to check

• Open the folders the report lists in your browser. A page titled "Index of /…" confirms it.
• Try common folders too, such as /uploads/, /images/, /backup/, /files/ and /wp-content/uploads/ on WordPress.
• Search Google for site:your-site.com intitle:"index of" to see whether any listings were already indexed.

How to turn it off

Apache, in the site's configuration (<Directory> block) or in the .htaccess file in the website's root folder:

Options -Indexes

If you edited the main configuration, reload with sudo systemctl reload apache2. A .htaccess change works straight away. Listed folders now return 403 Forbidden.

nginx. Listing is off by default, so look for a line turning it on and remove it, or set it explicitly:

autoindex off;

Then sudo systemctl reload nginx.

IIS. In IIS Manager, select the site, open Directory Browsing and click Disable. Or in web.config:

<system.webServer>
  <directoryBrowse enabled="false" />
</system.webServer>

WordPress on Apache: add Options -Indexes to the .htaccess file in the WordPress folder. Many security plugins have a "disable directory browsing" switch that does the same. On nginx-based hosts, ask your host.

Shared hosting: many control panels (cPanel's Directory Privacy or Indexes page, Plesk's hosting settings) have a setting for this. Otherwise, the .htaccess line above usually works.

Quick stopgap: an empty index.html in a folder hides its listing. That only covers that one folder, though, so turn the setting off as well.

Then clean up

• Remove files that shouldn't be public: backups, database dumps, exports, .bak copies, old site versions. Store backups outside the web folder or off the server.
• If a password or key file was exposed (.env, wp-config.php.bak, config.php.old), change those passwords and keys. Assume they were copied.
• If customer data was exposed, check your web server logs for downloads of those files and get advice on whether you need to notify anyone.
• Check that /.git/ and /.env on your site return "not found" or "forbidden". Exposed version-control folders can reveal the site's entire source code.

Re-check

Open the folders again. They should show "403 Forbidden" or "Not Found" instead of a file list. Then re-scan.

Common questions

The folder only has images. Does it matter?

Not much for that folder. But the same setting usually lets other folders list their contents too, and files get added over time. Turning it off site-wide costs nothing.

Will turning it off break my site?

No. Normal pages and files still load. Only the automatic folder lists stop. The rare exception is a folder deliberately used as a public download list, which you can give its own index page.

Why does the Basic Scan show this as "Info" but ZAP as "Medium"?

The Basic Scan lists it among "interesting paths" it found, without judging what the folder holds. ZAP rates any directory listing Medium because of what it can expose. Look at what's in the folder to decide how urgent it is.

Sources: Apache: Options · nginx: autoindex · IIS: directoryBrowse · ZAP: Directory Browsing · CWE-548 · Nmap http-enum