Wang Kai

By default, Apache Web (HTTPD) Server is configured with the “directory listing” option enabled, which allows user to see all the files and sub-folders under a particular directory when index files like index.html, index.php etc. are not present in that directory.

This is not advisable on production website as it may expose sensitive information to prying eyes, and would probably be indexed by search engines if you do not define entries in robot.txt properly. Therefore, in order to protect your data from being compromised, making all contents under the directory invisible to unintended visitors becomes necessary.

How can we disable the Directory Listing in Apache Server?

There are two simple ways to achieve this:

1. If you are able to access the Apache configuration file httpd.conf, you can do this with an Options directive inside a Directory tag. Either remove the “Indexs” from line begins with Options if it’s there, or change “Indexes” to “-Indexes“.
   

   <Directory “/www”>
   Options Indexes FollowSymLinks
   </Directory>

2. If you have no access right to the Apache configuration file httpd.conf, you can obtain the same effect with method 1 by using the .htaccess file: open the .htacces file (create a new one if it’s not there) under the target directory, look for Options Indexes. If Options Indexes exists, modify it to Options -Indexes, or else add Options -Indexes as a new line.

Remember to restart your Apache Web Server, and the Directory Browsing feature should be disabled by now.