Have you ever visited a URL that leads to a directory of files? For example, when you own a WordPress websites, the default uploads folder will be http://yourdomain.com/wp-content/uploads/, if you access this URL and all your website images and uploads are listed, it means that the directory listing is enabled. If directory listing is enabled and no index file is found in a directory, the server will generate a listing of the files and directories within that directory.
Directory listing, also known as directory browsing or indexing, is a feature provided by web servers that allows users to view the contents of a directory or folder on a website. Apache’s web server default behavior allows directory browsing to all visitors. That’s to say each user can visit your website to see the contents of a directory if you haven’t defined a default index file (e.g. index.html or index.php) within the directory. This can potentially expose sensitive information to visitors, such as the directory structure, filenames, and possibly even the contents of files that were not meant to be publicly accessible.
In most cases, though, we don’t want to the contents of all directories to be presented to any site visitors. It’s always good to turn off the directory browsing to make your website more secure.
There are a couple of different ways to turn off website directory indexing. In this, guide, we will show you two easy methods to disable directory browsing in cPanel.
Method 1. Disable Directory Listing in cPanel
Once logged into the cPanel, you will find a search box where you can quickly search and locate all tools and features in cPanel. cPanel comes with the Index Manager tool which allows you to customize the way a directory appears when no index files reside in a directory. Type the word ‘index’ or ‘indexes’ in the search box to quickly find and access this built-in tool in cPanel. Alternatively, scroll down to the Advanced section where you can find and click the Indexes (or Index Manager, the name may differ across different cPanel versions) link or icon to access the Index Manager in cPanel.
On the Indexes page, you can see the full list of all your website folders. Public_html is the default directory on Apache web servers that stores all HTML files and other web content. You can choose to turn off directory listing for this folder to quickly disable directory browsing for all your websites. Click a directory’s icon or name to navigate the file system. Once you find the directory to turn on or off the directory indexing, click Edit icon to set indexing for the selected directory.
- Inherit: Select this mode to use the parent directory’s setting. If the index settings are not defined in the parent directory, the system will use its default settings.
- No Indexing: No files will appear for this directory if a default file is missing.
- Show Filename Only: This mode shows a simple list of the files present if the default file is missing.
- Show Filename and Description: This mode shows a list of files and their attributes: file size and file type.
Choose the indexing mode and click Save button. To disable directory listing, select the No Indexing option and click the Save button.
Verify the directory indexing setup
Visit the home directory or a sub-directory which doesn’t have a default page or index page beneath on the web browser using your URL, such as www.yourdomain.com/test. Remember to replace ‘yourdomain.com’ with your real domain name. If it was a WordPress site, you can test its uploads directory where a index page or default page is missing, http://yourdomain.com/wp-content/uploads/. If directory listing was disabled successfully and no index file is present, the server will typically return a 403 Forbidden or 403 Permission Denied error instead of a file list when you go to the URL from a web browser.
Server Error
403 – Forbidden: Access is denied.
You do not have permission to view this directory or page using the credentials that you supplied.
Method 2. Disable Directory Browsing in cPanel File Manager
Other than the Index Manager, cPanel also provides another tool we can use to change the directory browsing settings, the File Manager. You can find it from the Files section of cPanel. Once you opened the online file manager in cPanel, browse through the directory to find the folder you like to change its indexing settings for, then right click on it and select Manage Indices from the drop-down menu.
Now we will be taken back to the same “Indexes” page that we saw in the first method above. To turn off the listing of files of the selected folder, click to select the No Indexing option and click the Save button to take effect.
Finally go to your website URL to check the directory indexing from a web browser, the same as we do in the first method above.
Method 3. Manually create index files
To prevent directory browsing or listing for a particular directory, you can create a blank homepage and save it as either index.html or index.php to the directory. This method is straightforward and can be used to avoid website files being listed for individual folders.
Once you are logged in, navigate to the “Files” section, then find and click the “File Manager” tool. Locate the directory where you want to create the index file, create a new file inside the desired directory and rename it to either index.html or index.php.
Method 4. Turn off directory listing in .htaccess
Apache .htaccess files allow users to configure the details of websites without modifying the main server configuration file. This file provides us an easy way to override standard website or server configurations for specific websites.
In cPanel, navigate to Files > File Manager, open the root directory of your website, create or edit the .htaccess file. Add the following line on the top or end of the file:
Options -Indexes