Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPut autoindex off; in the NGINX configuration that serves your WordPress site, then test and reload NGINX. The directive is valid in the http, server, and location contexts, and NGINX documents off as its default. A server-level setting is usually the simplest choice for a single WordPress virtual host:
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
server {
server_name example.com;
root /var/www/example.com/public;
index index.php index.html;
autoindex off;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php-fpm.sock;
}
}Replace the domain, document root, PHP-FPM socket, include files, and service details with the values used by your server. After reloading, a directory that has no configured index file should no longer display a generated file list. Depending on the rest of the configuration, it may return a 404, a 403, or an application response instead.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What directory browsing means on a WordPress LEMP server
A directory listing appears when a browser requests a directory URL, NGINX cannot find an index file there, and directory indexes have been enabled. Instead of returning an error, NGINX builds an HTML page containing the names of files and subdirectories. Typical examples are a request for /wp-content/uploads/ or another folder beneath the site’s document root.
That listing is not a WordPress feature. It is generated by NGINX’s static-content index module before WordPress needs to handle the request. Turning it off therefore belongs in the NGINX virtual-host configuration, not in a WordPress setting, plugin, theme, or Apache-style .htaccess file.
#1 Best Overall
Exposed names can reveal backup archives, uploaded documents, image variants, log files, deployment leftovers, or other material that was never intended to be browsed. Disabling the listing does not remove any file and does not make a file private when its exact URL is already known. It only stops NGINX from publishing an automatically generated index for a directory.
How NGINX decides whether to show a directory index
For a slash-terminated directory request, NGINX uses its index directive to look for configured index files. The documented default is index.html; a WordPress site commonly adds index.php as well. If one of those files exists and the request can be served or passed to PHP-FPM, that index handles the request.
Recommended Free Tools
When no configured index file exists, the normal behavior is an error response. The autoindex directive changes that behavior when it is set to on: NGINX generates a directory listing. Setting autoindex off; explicitly keeps the error behavior and makes the policy clear in the site’s configuration.
| Condition | Likely result |
|---|---|
| Directory has a configured index file | The index file or WordPress routing handles the request. |
No index file and autoindex off; |
No generated listing; a 404, 403, or application response can result from the remaining rules. |
No index file and autoindex on; |
NGINX generates a browsable file list. |
The status code is not the security control. The important result is that the generated list is absent. A 403 or 404 can both be an appropriate outcome, provided legitimate WordPress pages and intended files continue to work.
Where the directive belongs
NGINX accepts autoindex in the http, server, and location contexts. Choose the narrowest scope that matches your policy.
| Placement | Scope | Use it when | Operational caution |
|---|---|---|---|
http |
All virtual hosts in that NGINX configuration | You operate a server-wide policy and control every site. | Affects unrelated sites, so confirm that no application intentionally relies on directory listings. |
server |
The entire WordPress virtual host | You want every directory in one site’s server block protected. | A nested, more-specific location can change the effective behavior. |
location |
Only the matched URL path | You need a targeted rule, such as for uploads. | Requests may be matched by another location than the one you edited. |
For a normal single-site deployment, put the directive in the relevant server block. If only one path is at issue, scope it to that path:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchlocation /wp-content/uploads/ {
autoindex off;
}The path must match the URL location that actually serves the files. A rule placed in an unused or overridden block will have no visible effect. When several files are included, inspect the final effective configuration rather than assuming that the first file you opened is authoritative.
Before changing the active NGINX configuration
- Confirm that you have administrator or equivalent access to the Linux host, the NGINX configuration, and the service manager.
- Identify the server block whose
server_nameandrootmatch the affected WordPress site. - Back up the active site configuration before editing it. Keep the backup outside the file you are changing so an include or deployment process cannot overwrite it.
- Note the current PHP-FPM socket, include files, and any control-panel-generated snippets. Do not replace a working WordPress block with a generic example without carrying those values across.
- Check whether the host is managed. On managed WordPress or managed VPS services, the provider may require a support request or a control-panel setting instead of direct file edits.
WordPress cannot automatically write this setting on a standalone NGINX installation. Unlike Apache, NGINX has no directory-level .htaccess equivalent. The server administrator owns the configuration and its reload process.
Step-by-step: disable listings for the whole WordPress site
- Find the active virtual host. Open the enabled NGINX site/server configuration that serves the domain. Look for the matching
server_nameand the document-root path containingwp-admin,wp-content, andwp-includes. - Place the directive at server scope. Add
autoindex off;inside thatserver { ... }block. Keep it alongside other site-wide directives such asrootandindex; it must not be placed inside a PHP directive value or outside the enclosing block. - Preserve WordPress routing. Leave the site’s existing
try_files, PHP-FPM, SSL, caching, and security rules intact. The directive controls generated directory output; it is not a replacement for the normal WordPress front-controller rule. - Validate the complete configuration. Run the NGINX configuration-test command provided by your Linux distribution, hosting panel, or service documentation. On systems that expose the standard binary, this is commonly
nginx -t, but paths, permissions, containers, and wrappers differ. Treat any syntax or include error as a failed change and do not reload until the test passes. - Reload through the normal service manager. Use the reload action supplied by the platform. A conventional systemd installation often uses
systemctl reload nginx; a container, hosting panel, or alternate init system may require a different action. A reload applies the new configuration without unnecessarily stopping workers. - Record what changed. Keep the backup and the validated version together with your deployment records. This makes rollback possible if a later include change alters the effective policy.
If the configuration test fails, read the reported file and line number, correct the syntax or unmatched brace, and test again. Do not try to fix a failed test by repeatedly reloading; NGINX will continue using the last accepted configuration, while a service restart can create avoidable downtime.
Step-by-step: protect only the uploads directory
Some administrators prefer a narrow rule when they are changing an existing multi-site server or when only wp-content/uploads has been observed to list files.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Locate the
locationthat serves the site’s uploads URL. It may be an explicit prefix location, a generic static-file location, or an inherited server rule. - Add the following directive to the location that actually handles the request:
location /wp-content/uploads/ { autoindex off; } - Check for another, more-specific location that matches the same URL, including regular-expression locations. The effective block, not merely the text you edited, determines the result.
- Test and reload NGINX using the platform’s normal procedure, then request a folder that contains files but no index file.
A location-level rule leaves other directories governed by their existing settings. If your policy is that no directory on the virtual host should ever be listed, use the server-level placement instead and audit nested locations for overrides.
How to verify that directory browsing is disabled
Test a directory that genuinely lacks every index file named by the site’s index directive. Testing a folder that contains index.php can only prove that WordPress routing works; it cannot prove that NGINX would refuse to list an empty-index directory.
- Choose a non-sensitive test directory under the document root, or an existing directory whose contents are safe to expose during the test.
- Request the slash-terminated URL in a browser or with the HTTP client used by your operations team. Use the site’s real hostname so the correct virtual host, TLS configuration, and location rules are selected.
- Confirm that the response does not contain NGINX’s generated file-list layout or links for every file in the directory.
- Accept a 403, 404, or application-generated response as a successful anti-listing result when it matches the rest of your policy.
- Request a normal WordPress permalink, the home page, an administrative login URL, and a known upload URL. These checks ensure that the change did not interfere with front-controller routing or legitimate static files.
- Repeat the directory test through any reverse proxy, CDN, or load-balancer path used by visitors. A cached directory page can remain visible even after the origin is corrected until the cache expires or is purged according to that system’s procedure.
If you use command-line checks, preserve the response status and a short body sample in your change record. Avoid posting directory contents or sensitive headers in a public ticket.
Why a WordPress URL can still work after listings are disabled
WordPress commonly relies on a front-controller rule such as:
location / {
try_files $uri $uri/ /index.php?$args;
}This rule checks whether a requested path maps to a real file or directory and otherwise sends the request to index.php. Disabling autoindex does not remove that fallback. A page such as /about/ can therefore continue to work even though a directory with no index file no longer produces a file list.
The PHP location should also keep its normal file-existence check and PHP-FPM parameters. The directory-listing directive does not validate PHP code, change file ownership, or decide whether a file is executable. Those are separate controls and should not be folded into an autoindex change.
Troubleshooting common outcomes
The file list is still visible
- Verify that the request reaches the server block you edited. A different hostname, port, IPv6 listener, or default server may be serving the response.
- Check whether an included file sets
autoindex on;in a more-specific location. Inspect the effective configuration generated by your platform rather than relying on one source file. - Confirm that the requested path is really a directory and that a proxy or cache is not serving an older listing.
- Make sure the edited file is enabled. Some distributions separate available site files from enabled ones, while managed panels generate configuration from a database or template.
The site returns an unexpected 403 or 404
An error is normally preferable to a generated listing when no index file exists. If a legitimate WordPress page, stylesheet, image, or upload now fails, compare the request with the location rules and file permissions that were active before the change. The autoindex directive itself does not deny a known file, so a new failure usually indicates a scope, location-selection, permission, or unrelated configuration problem.
NGINX refuses to reload
Run the configuration test again and follow the first reported error. Typical causes include a directive outside an allowed context, a missing semicolon, an unmatched brace, an invalid include path, or an edit to a generated file that the platform immediately rewrites. Restore the backup if the correct configuration cannot be reconstructed, then test before attempting another reload.
The change works for one URL but not another
Compare the slash form and non-slash form of the URL, the hostname used, and the selected location. NGINX processes directory requests and regular files differently, and a redirect can move the request to another host or path. Test the final URL shown by the browser, not only the original address.
A hosting panel overwrites the setting
Some managed environments regenerate NGINX files during provisioning, certificate changes, or application updates. Put the directive in the provider’s supported custom-configuration field or ask the administrator to apply it at the correct scope. Editing a generated file directly may work temporarily but is not a durable configuration method.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Directory browsing is only one part of WordPress hardening
Stopping generated listings reduces information exposure, but it does not secure every file beneath the document root. WordPress hardening guidance also addresses ownership, permissions, sensitive configuration files, and writable paths. Review those controls according to the deployment’s users, update process, and backup strategy.
Protect hidden and sensitive files
Audit locations containing environment files, version-control metadata, deployment archives, logs, database exports, and other material that should never be served. A no-listing policy does not block a visitor who requests a known filename. Use the NGINX restrictions appropriate to your layout, and test both direct requests and rewritten URLs.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Prevent unintended PHP execution in uploads
Uploaded media normally needs to be downloadable, not executed as server-side code. The WordPress NGINX handbook provides location examples for preventing PHP execution in upload paths. Adapt those examples to your PHP location, distribution, and existing security rules; a typo in a location block can create a loophole or stop legitimate media from working.
Keep permissions and ownership deliberate
Web-server readability, WordPress’s ability to write updates, and administrator access should be separate decisions. Excessively writable directories increase the impact of a compromised process, while insufficient permissions cause failed updates and confusing 403 responses. Directory-listing control cannot compensate for unsafe ownership or permissions.
Choosing between server-wide and path-specific policy
Use the following decision framework when several sites or application paths share one NGINX instance:
- One WordPress virtual host, no intentional listings: set
autoindex off;in thatserverblock. - Several sites with different requirements: set the rule separately in each server block, or set it globally only after confirming that every site accepts the same behavior.
- Only uploads or another known path is exposed: use a matching
location, then verify that no regex or nested location supersedes it. - A public download directory intentionally needs an index: keep that exception narrow and documented; do not enable listings globally just to support it.
- You do not control NGINX: ask the hosting administrator to disable autoindex at the server or location that serves the URL. WordPress code cannot reliably override the web server’s directory-index module.
The right scope is the one you can audit and preserve during deployments. A broad rule is easier to reason about for a single site; a narrow rule limits change impact on a shared server.
Rollback and change management
If a legitimate application path breaks after the change, first confirm that the failure is not an expected no-index response. If the directive was placed in the wrong block or an include was modified accidentally, restore the backed-up configuration, run the platform’s configuration test, and reload only after it passes. Then reapply the directive at the correct scope and repeat the verification checklist.
Document the hostname, configuration file or managed setting, chosen scope, validation result, reload time, and URLs tested. This small record prevents a later administrator from enabling autoindex in a nested location while trying to diagnose an unrelated issue.
Quick Recap
Key points to retain
autoindex off;is NGINX’s control for generated directory listings, andoffis its documented default.- Put the directive in NGINX’s
http,server, orlocationconfiguration, not in WordPress.htaccess. - NGINX checks the filenames named by
indexfor a slash-terminated directory request. Without an index and with autoindex disabled, it returns an error or another configured response instead of a file list. - A server-level rule covers the virtual host; a location-level rule covers only the matched path. Included files and more-specific locations can change the effective result.
- Back up, validate, reload, and test both a no-index directory and ordinary WordPress URLs.
- Continue with permissions, sensitive-file protection, and prevention of PHP execution in uploads; directory-listing control is not a substitute for those safeguards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
