I want to to ensure that every file on my webserver is secured. The problems I am having right now:

  • If you go to my website, and enter a url like mywebsite.com/img/ if there is no index page in there, then you will have a list of all the files and folders. I have seen other sites redirect you to their main index page but I have done this for like a couple of pages but as my folders are growing, is there another way to do this. Simply is there a way my website won't display everything to the user?

  • My JavaScript and PHP validation are pretty good, do I run any risk leaving my website folders being seen by people? If yes, what are those risks?

  • 2
    Directory listing can be switched off, but it depends on the used software. What webserver are you using? Apache? Nginx? Microsoft IIS? But I am quite sure you will find an answer for either server on serverfault.com.
    – Philipp
    Jul 29 '15 at 14:38
  • its a Lamp hosted setup @Philipp Jul 29 '15 at 15:34

Having directory listing enabled is not a security vulnerability just by itself. When you don't want the users to look at the content of a file, the webserver should simply not allow them to access it. When your security depends on the attacker not knowing the exact URL of a file, your security concept is flawed ("security through obscurity"). As long as the filename itself doesn't contain any sensitive information, simply knowing that a file exists does not yet allow to compromise a server.

However, having directory listing enabled can still help an attacker to exploit other vulnerabilities more easily:

  • When you expose the source folders of your server-sided scripts (PHP, etc.), the attacker can learn what 3rd party software you use and try known exploits for these.
  • When the attacker finds a vulnerability in your website which allows them to view and/or overwrite arbitrary files, they can use the directory listing to find files for which this might be useful.
  • You make it much easier for someone who wants to plagiarize your content to copy the whole website at once.

When you want to know how to switch off directory listing for your webserver software, consult the documentation or look on https://serverfault.com for instructions.


First, there is a problem with your assumption: "My Javascript and PHP validation are pretty good". You can't make such a statement, because you don't know of all the places you missed. Also, client-side valiation (i.e., Javascript) is useless, security-wise. An attacker can simply bypass it by sending you the corresponding HTTP request directly.

Now for the problem with directory listings. You already got good answers.

Here is another one:

Let's say you add, for testing purposes, a PHP script that does add a vulnerability, say one that calls phpinfo() (which would give an attacker enough information to know which vulnerabilities your server has). And, as we are all human, we occasionally forget to clean up such things when we are done.

By exposing the directory listing, an attacker can easily see scripts with "interesting" names.

Another consideration: you should always assume that an attacker knows more than you do, and/or has more powerful tools than you do. Giving an attacker more information than absolutely necessary is usually something you'd want to avoid.


Defense in depth principles ask to disallow directory listing: why ? Because at least it will lead the nefarious person to waste his time and efforts in getting some valuable information that would probably push him to go away. For the sake of one of our clients, we actually succeeded to have full control on his website after getting a precious information through the directory listing feature enabled on their website.

You may read more here: PHP files browsable: is this a vulnerability?

Not the answer you're looking for? Browse other questions tagged or ask your own question.