This question already has an answer here:
When you put a blank index.html into a given directory on a web server, web browsers will not display a file listing for that directory. But is it secure enough for other purposes other than preventing file listing? Are there other easy ways for unwanted people to display the file list, or access the files, in that directory?
Let's keep the scope within "casual would-be crackers" and personal websites.
Edit: This question is similar, but I believe it's about accessing subfolders: Is it possible to list folder from my web server if i have an empty index.html in the root folder?