• What are the risks and downsides associated with allowing Options -Indexes to work in arbitrary .htaccess files on a shared Apache web host?


  • Apache web server configuration
  • Linux RHEL host


Trevor is using a shared hosting environment where he does not have access to change the apache httpd.conf settings. As a workaround for this limitation, he attempted to use Options -Indexes in a local .htacess file in order to prevent directory browsing, as specified in this semi-related post: folder and file permission shared host advice (I refer to the accepted answer)

disable directory browsing


For this particular host, this setting returns an Apache configuration error.

It turns out the sysadmin for this particular host disabled the Options directive, so that it does not work inside .htaccess files, and that is the source of Trevor's woes.


  • Trevor would like to know what specific risks were intended to be minimized by not allowing Options -Indexes to work in arbitrary .htaccess files on the shared webhost? Was the sysadmin being over-paranoid, or was there really a specific attack vector closed off by this approach?

  • What alternative risk mitigation tasks are available, other than adding an index.html to every sub directory?

See also

2 Answers 2


Allowing Indexes doesn't only allow disabling them, it also allows quite a bit of other options which could increase the attack surface.

Also, just setting AllowOverride to anything but None has a performance penalty as Apache now looks for .htaccess files in each directory of the requested file's path.


Another common solution is to drop an index.php in each folder, with just a comment eg: silence is golden... Every WordPress installs like this.

As @Pinoniq pointed out, this solution would assume index.php is specified as your index file preference.


  • the index.php will only work if the web-server is configured to look for index.php as the default document
    – Pinoniq
    Commented Sep 21, 2015 at 19:10
  • absolutely correct, I'll be more clear Commented Sep 21, 2015 at 19:11
  • Index.php would unnecessarily invoke the PHP interpreter. You could make that index.html instead to avoid that. Of course the best option is to not create unnecessary files at all and instead use the options the web server provides you to disable directory indexes. Commented Jun 28, 2016 at 7:37
  • He's running apache and therefore must have unlimited resources Commented Jun 28, 2016 at 10:52
  • While Apache itself is quite resource intensive, why should we suggest making the problem even worse when we can avoid it? Commented Jun 29, 2016 at 1:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .