How to Turn Off Directory Browsing

What this means

Directory browsing (also called directory listing) means that visiting a folder on your site, such as yoursite.com/wp-content/uploads/, shows a plain list of every file in it, instead of a page or an error.

A site audit tests this by visiting a folder address and checking what comes back.

Why it matters

A file list shows anyone what's on your server: uploaded documents, old backups, plugin files and their versions. That can expose files you never meant to publish, such as a price list for trade customers or a PDF someone uploaded and forgot.

It also gives people looking for weaknesses a map of your site. Plugin and theme versions, for example, tell them which known problems to try.

It's one of the easiest security settings to fix.

How to fix it

On most Apache hosts (including many cPanel hosts)

Add this line to the .htaccess file in your site's main folder:

Options -Indexes

You can edit .htaccess with your host's file manager, or ask your host to do it. Make a copy of the file first, and test that your site still loads afterwards.

On Nginx hosts

Directory listing is controlled by the autoindex setting, which is off unless someone turned it on. Ask your host to check it's set to off for your site.

On WordPress

The steps above apply, because the setting belongs to your server, not WordPress. Many security plugins have a "disable directory browsing" option that adds the line for you. It's also good practice for every folder to contain an empty index.php file, which WordPress does for its own folders.

On Shopify, Wix and Squarespace

These platforms don't allow directory browsing, so this issue shouldn't appear. If it does, check whether part of your site (a blog or a shop on a subdomain, for instance) runs on a separate host.

If you can't edit server settings

Contact your host's support and ask them to "disable directory listing" for your site. It's a routine request.

While you're there

Look through the files the listing showed. If there are old backups, exports or documents that shouldn't be public, delete them or move them somewhere private. Turning off the listing hides the list, but a file is still reachable by anyone who has its exact address.

Checking your fix

Visit a folder address such as yoursite.com/wp-content/uploads/ again. You should now see an error page or a blank page, not a list of files.

If you use Duality, this check looks at your server rather than a single page, so the next monthly audit confirms it.