Directory listing disabled
When directory listing is enabled on the web server, accessing a folder like /uploads/ shows a list of all files it contains (like a file ex…
Analyse my site for freeUnderstanding "Directory listing disabled"
Directory listing is a web server feature that, in the absence of an index file (index.html, index.php…) in a folder, automatically displays the list of every file it contains — like a file explorer reachable from the browser. This feature is enabled by default on some Apache configurations and convenient in local development, but it turns any production folder into a public catalogue of everything it holds.
The issue is usually unintentional: an /uploads/ or /backup/ folder created without a blocking index.html becomes reachable out of simple curiosity — or by an attacker systematically testing common folder names.
📄 client_contract_january.pdf
📄 backup_db_2026.sql
📄 internal_note.docx
How TheSiteFuse checks "Directory listing disabled"
TheSiteFuse tests 6 folder paths commonly used to store uploaded or static files: /images/, /uploads/, /static/, /files/, /assets/, /media/. For each path responding with 200, the page content is inspected for the strings "index of /" or "directory listing", typical signatures of pages auto-generated by Apache (mod_autoindex) or Nginx (autoindex on) to list a directory.
Why "Directory listing disabled" matters
- Exposure of user files — documents, photos, contracts uploaded by users or clients, potentially confidential, become freely downloadable by anyone who knows the folder's URL.
- Backup leaks — backup folders forgotten in production (
/backup/,/old/) often expose full database dumps, complete with passwords and personal data. - Easier reconnaissance for an attacker — a listed directory reveals the site's full folder structure, naming conventions, and sometimes stray configuration or log files.
- GDPR non-compliance — if personal data belonging to third parties (customers, users) is exposed publicly, this constitutes a reportable data breach.
Fix "Directory listing disabled" step by step
Apache — disable listing in the relevant folder's configuration (httpd.conf, vhost, or local .htaccess file):
<Directory /var/www/mysite/uploads>
Options -Indexes
</Directory>
Nginx — auto-indexing is disabled by default, but verify no configuration explicitly enabled it:
location /uploads/ {
autoindex off;
}
Universal solution — place an empty index.html file (or one with a redirect) in every public folder without a dedicated landing page. This is effective protection even if the server configuration changes later.
Best practice: folders containing genuinely sensitive files (backups, exports, logs) should never be publicly reachable at all — store them outside the web root (public_html/www) rather than relying solely on disabling listing.
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — Directory listing disabledDoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.