iFastHostingHow to turn directory listings on or off
What causes a folder to show a bare file listing, and how to turn that behaviour on or off deliberately.
Directory browsing controls what a visitor sees when they reach a folder on your site that has no page of its own. With it off — the normal, safer setting — they get a 403 Forbidden or a 404, depending on configuration. With it on, they instead see a plain, unstyled listing of every file in that folder, each one a clickable link.
Why this happens at all
A web server, asked for a folder rather than a specific file, first checks for a default page such as index.html or index.php. If it finds one, that loads and directory browsing never comes into it. If it finds none, what happens next depends on whether directory browsing is switched on for that folder: on, and it lists the files; off, and it refuses the request instead.
A folder with directory browsing on will show every file inside it to anyone who requests the URL directly — including files you may have uploaded and forgotten about, backup copies, configuration files, or anything else that happened to be sitting there. This is a genuine way sensitive files get found by people who were never supposed to see them, not just an untidy-looking page.
Turning it off
Directory browsing is switched off by default on most hosting setups, and stays off unless something has explicitly changed it — an inherited configuration, a setting changed by mistake, or leftover from a previous site on the same account. If you are seeing a raw file listing where you did not expect one:
- Check the security or directory settings in your control panel for an option covering directory browsing or directory indexes, and confirm it is switched off for the folder in question.
- Alternatively, add a line such as
Options -Indexesto the.htaccessfile in that folder, which explicitly disables listing for it regardless of the server's general setting. - Simplest of all: add a basic
index.htmlorindex.phpfile to the folder. With a default page present, the server never needs to fall back to a listing at all.
Turning it on, deliberately
There are a few legitimate uses — a folder of downloadable files meant to be browsed openly, for instance, where building a proper index page is not worth the effort. If you genuinely want this for one specific folder, the same tools apply in reverse: a control panel option to enable browsing for that folder, or Options +Indexes in an .htaccess file scoped to just that location. Keep it limited to the one folder that needs it rather than switching it on account-wide.
If a listing has already appeared somewhere you did not expect and you are not sure why, why your site shows a list of files covers the troubleshooting side of tracking down the cause.
Frequently asked questions
What is directory browsing?
It is what happens when a folder has no default page for the server to load and directory browsing is switched on: instead of a 403 or a 404, the visitor sees a plain, unstyled list of every file in that folder, each one clickable.
Should I turn it on or off?
Off, for almost every folder on a normal website. It is switched off by default for good reason — an open listing can expose files you never intended visitors to browse. Turn it on only for a specific folder that is genuinely meant to work as a simple public file index, such as a folder of downloadable resources with no page of its own.
Related reading
A plain list of filenames where your homepage should be means the server has nothing to show instead — here is the fix.
How to change which page loads firstHow a folder decides which file to show first, and how to change that order if you need to.
How to use .htaccess on your hosting accountOne file that controls redirects, rewrites and access rules for a whole folder — and one typo in it that can take the site offline.
A tour of your hosting control panelThe main sections you will find in your control panel and roughly what lives in each one.