Disable Directory Listing in Apache & Nginx: Fix Options +Indexes Exposure

The Problem

How to Fix

1. 1

   Disable directory listing in Nginx

   In your Nginx server block, ensure autoindex is off (this is the default, but it may have been enabled):

   server {
       # ...
       autoindex off;

   location / {
           try_files $uri $uri/ /index.php?$query_string;
       }
   }

   If autoindex on; appears anywhere in your configuration, remove it or change it to off:

   sudo grep -r 'autoindex on' /etc/nginx/
   sudo nginx -t && sudo systemctl reload nginx

2. 2

   Disable directory listing in Apache

   Remove the Indexes option from your Apache configuration. In .htaccess:

   Options -Indexes

   Or in your Apache virtual host configuration:

   <Directory /var/www/yourapp/public>
       Options -Indexes +FollowSymLinks
       AllowOverride All
   </Directory>

   Restart Apache:

   sudo apachectl configtest && sudo systemctl restart apache2

3. 3

   Add index files to directories that need them

   For any directory that should be web-accessible but does not have an index file, add an empty index.html:

   touch public/uploads/index.html
   touch public/assets/index.html

   Or use a PHP redirect:

   <?php
   // public/uploads/index.php
   header('Location: /');
   exit;

   This prevents directory listing even if the server configuration is accidentally changed.

How to Verify

curl https://yourdomain.com/css/
curl https://yourdomain.com/js/
curl https://yourdomain.com/storage/

Prevention

Frequently Asked Questions