Directory listing can reveal filenames when a directory has no default index page. Disabling listing prevents that automatic index from being shown, but it does not stop someone downloading a file whose address they already know. Keep backups, secrets and private documents outside the public document root.
These instructions apply where the web server supports Apache-compatible .htaccess rules. Native NGINX does not read this file. A CDN or reverse proxy can also affect the request seen by the origin server. Keep File Manager or SFTP available so you can restore the previous file if a rule prevents browser access.
IN THIS ARTICLE
01 Disable automatic directory indexes
- Back up the existing
.htaccess. Decide whether the change belongs in the website root or only in one public directory. - Add the following directive without removing existing application rules.
Options -IndexesThe minus sign disables only the Indexes option instead of replacing every option setting. The server must permit this directive in the current directory. If it is already enforced at server level, the additional line may be unnecessary.
02 Test both a directory and a file
- Use a harmless test directory without an index file and open its URL. You should see an access-denied response or an application-specific response, rather than a generated file listing.
- Open a public file inside the directory by its exact URL. If it still downloads, that is expected: indexing and file access are different controls.
- Check ordinary site pages, image paths and downloads. Restore the previous file if the new directive produces a 500 error, and give support the matching log entry.
Does disabling directory listing make private files inaccessible?
No. A known file URL can still be downloaded unless a separate access control protects it. Move database dumps, configuration backups and account exports outside the public website. Use authenticated application downloads or directory access protection for private resources that genuinely need browser access. A robots.txt entry or noindex setting is not access control and does not make a downloadable backup private.
If the application itself renders a list of files, this server setting will not change that application feature. Review its permissions and download routes separately. Remove the temporary test directory after verification and keep a record of the configuration change.