Open directory listing

What it is

A directory without index.html or index.php shows visitors a list of files instead of a 404 or a redirect — the classic “Index of /uploads” listing. This is the default behavior of Apache (the autoindex module) unless you explicitly turn it off.

Why it’s a problem

This is exactly what attackers look for at the start of reconnaissance. What they might find:

Backups — db_backup.sql, site.tar.gz, old.zip.
Previous versions of files — config.php.bak, wp-config.old.
Private documents — contracts, invoices, shipping labels, a screenshot from a test environment.
Internal scripts — debug, deploy, migration scripts that were meant to stay hidden.

Even if “there’s nothing sensitive” in the directory, you’re handing the attacker a map of your application that they otherwise wouldn’t have. Every internal naming convention (old_v2/, customer_export/) is a hint.

How to fix it

Apache

In the main configuration or .htaccess:

# vypnout autoindex globálně
Options -Indexes

If you have your own VirtualHost:

<Directory /var/www/example.cz>
    Options -Indexes +FollowSymLinks
</Directory>

nginx

nginx has autoindex disabled by default — the problem arises when someone has explicitly enabled it. Look in the config:

# odstraňte tyto řádky:
autoindex on;

Shared hosting

Create an empty index.html in the directory:

echo "" > /var/www/example.cz/uploads/index.html

This is a quick fix — it’s better to disable autoindex globally.

Verification

Try a few directories: curl -s https://example.cz/uploads/ | head -30. The response must not contain HTML with links to files.

Bonus: clear out backups

While you’re at it — go through all directories and delete old backups and .bak files. Even with autoindex disabled, db.sql.bak is still reachable if an attacker guesses the name.