How to disable directory listings

Why should you disable directory listing?

An open directory listing lets anyone read and download the files under that path and map the site's plugins and themes. Disable it. The method depends on the web server.

#1 Apache

Consider the case, directory listing is enabled for your website http://mydomain.com/MyData/, here you need to create the .htaccess file inside the MyData directory inside your website document root. Connect with FTP or a Linux shell and create the .htaccess file with the below content to disable directory listing in that specific location.

Options -Indexes

Tips: 

a.) If you still see the directory listing or any errors for the URL, verify in Apache errors logs if it throws any permission errors, Ideally the .htaccess should be created with the owner and group permissions of the webuser with 644 access rights. 

b.) Apache will not process .htaccess file if it is not configured to read .htaccess from that specific location. You can create a location tag as shown below in Apache configuration file (httpd.conf) and reload Apache. 

<Directory "/home/complete/path/to/the/directory/ ">
AllowOverride All
</Directory>

#2 Nginx

In nginx the listing comes from ngx_http_autoindex_module. Set autoindex off; in the location block: You can edit the nginx.conf with the below entries in your website configuration.

server {
            listen 80;
            server_name yourdomain.com www.yourdomain.com;             root /path/to/document/root;
            location / {
                     index index.php index.html;
            }
            location /path/disable/dir_listing {
                       autoindex off;
            }
}

#3 IIS

Open IIS with escalated privileges or as administratorNavigate to the website and click on it to get home options for that website.Locate the “Directory Browsing” option and access it.

Click on “Disable” from right side options panel.