Disable Directory Listing on Apache & Nginx

Directory listing is a web server feature that displays the contents of a folder when no index file (like index.html) exists. While sometimes useful for public file sharing, it can expose sensitive files and data to anyone who knows the URL. This guide shows you how to turn it off on both Apache and Nginx, step by step, with configuration examples and troubleshooting tips.

What You’ll Need

• Access to your server’s terminal (SSH) or a control panel that allows editing server configuration files.
• For Apache: the ability to edit .htaccess files or the main Apache configuration (e.g., httpd.conf or apache2.conf).
• For Nginx: the ability to edit the server block configuration (usually inside /etc/nginx/sites-available/ or /etc/nginx/conf.d/).
• Root or sudo privileges to restart the web server after changes.
• Basic familiarity with the command line and text editors (like nano or vim).

Step-by-Step

Disabling Directory Listing on Apache

1. Locate the configuration file. For most shared hosting, you can use an .htaccess file in the directory you want to protect. For full control (e.g., a VPS), edit the Apache virtual host file or the global httpd.conf/apache2.conf.
2. Add the directive. In the chosen file, add the line Options -Indexes. If you want to disable listing for a specific directory, place it inside a <Directory /path/to/folder> block or in the .htaccess file inside that folder.
3. If you already have an Options line (e.g., Options Indexes FollowSymLinks), simply remove Indexes from that line, or change it to Options -Indexes to explicitly turn it off.
4. Save the file.
5. Restart or reload Apache using a command like sudo systemctl reload apache2 (for Debian/Ubuntu) or sudo systemctl reload httpd (for RHEL/CentOS). If you only edited .htaccess, no restart is needed—changes take effect immediately.

Disabling Directory Listing on Nginx

1. Open the server block configuration for your site. This is usually in /etc/nginx/sites-available/your-site or /etc/nginx/conf.d/your-site.conf.
2. Find the location block that handles the directory you want to protect. Often it’s the location / block, but you may have specific ones like location /uploads.
3. Add the directive autoindex off; inside that location block. If the line autoindex on; exists, change it to off.
4. Save the file.
5. Test the configuration with sudo nginx -t to ensure there are no syntax errors.
6. Reload Nginx with sudo systemctl reload nginx (or sudo service nginx reload).

Common Mistakes

• Editing the wrong file. On Apache, if you use .htaccess, make sure the file is named exactly that (including the leading dot) and that AllowOverride permits Options in the server config. On Nginx, editing a file that isn’t included in the active site config will have no effect.
• Forgetting to restart/reload. Changes to main config files won’t apply until the server reloads. .htaccess changes are immediate, but Nginx and Apache main config changes require a reload.
• Placing the directive in the wrong scope. On Nginx, putting autoindex off; outside a location block (e.g., in the http block) applies globally, which may be fine, but if you want per-directory control, it must be inside the appropriate location.
• Using Options -Indexes in Apache but having AllowOverride set to None. This prevents .htaccess from working. You’ll need to add the directive to the virtual host or main config instead.

Tips

• After disabling directory listing, test by visiting a URL that points to a folder without an index file. You should see a 403 Forbidden error instead of a file list.
• If you have many directories, consider disabling listing globally and then re-enabling it only for specific public file-sharing folders (using Options +Indexes or autoindex on; in those locations).
• For Apache, you can also add a custom error document for 403 errors to make the page more user-friendly.
• On Nginx, you can return a custom 403 page using the error_page directive.
• Regularly audit your server configuration to ensure no accidental re-enabling of directory listing after updates or migrations.

Troubleshooting

• Directory listing still appears. Check that you edited the correct file and that the server reloaded. For Apache, verify that AllowOverride is set to All if using .htaccess. For Nginx, confirm the location block you edited is the one being used—use nginx -T to dump the full effective configuration.
• You get a 500 Internal Server Error after editing Apache config. This often means a syntax error. Run apachectl configtest to check. For Nginx, run nginx -t.
• Changes not applied to a subdirectory. On Apache, if a subdirectory has its own .htaccess with Options +Indexes, it overrides the parent setting. Remove or edit that file. On Nginx, a more specific location block (e.g., location /subdir) may have autoindex on;—check all relevant blocks.
• After disabling, you get a 403 but you wanted a custom error page. Add an ErrorDocument 403 /custom-403.html in Apache or error_page 403 /custom-403.html; in Nginx, and ensure the file exists.

Frequently Asked Questions

Does disabling directory listing affect existing files?

No, it only prevents the server from generating a list of files. Files remain accessible if you know their exact URLs.

Can I disable directory listing for just one folder?

Yes. In Apache, place Options -Indexes in that folder’s .htaccess or a <Directory> block. In Nginx, add autoindex off; inside the specific location block for that folder.

What is the difference between autoindex off; and removing autoindex entirely?

In Nginx, the default value of autoindex is off, so removing the line has the same effect. However, explicitly writing autoindex off; makes your intention clear and guards against future changes.

Does this work on all hosting providers?

Most shared hosts allow .htaccess for Apache, but some may restrict certain directives. Nginx is rarely used on shared hosting without root access, so you may need to contact your provider to change the config.

Will disabling directory listing improve security?

It reduces information disclosure, but it doesn’t protect files from being accessed if someone guesses the URL. For sensitive files, use proper authentication and access controls.

Can I still use directory listing for a public download area?

Yes, you can enable it for specific directories by adding Options +Indexes (Apache) or autoindex on; (Nginx) in those locations, while keeping it disabled globally.

Related

• Windows 11 File Explorer Keeps Restarting? Fix
• Google Pay vs Apple Pay: Which Works with Your Phone and Bank?
• Recover Overwritten Files Windows 10: Full Guide