If a directory URL displays an “Index of” page instead of your site, turn off the server’s automatic index generator. On Apache, put Options -Indexes in the most specific applicable <Directory>, virtual-host, or permitted .htaccess context. On Nginx, put autoindex off; in the applicable http, server, or location block. Then validate and reload the service, request a directory that has no index file, and confirm that no generated listing appears.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What directory listing is—and why it appears
A directory listing is a server-generated HTML response that enumerates files and subdirectories when a request reaches a directory without a usable index document. It is not the same thing as your application’s navigation page and it is not created by the browser.
As an Amazon Associate I earn from qualifying purchases.
Apache’s decision path
Apache first looks for a file named by the applicable DirectoryIndex setting, commonly index.html or an application entry point. If no matching file is found and the Indexes option is enabled, the mod_autoindex module generates a formatted listing. Apache documentation describes automatic index generation as being enabled with Options +Indexes; the disabling form is Options -Indexes.
Nginx’s decision path
Nginx’s index processing likewise tries to resolve an index file. For a slash-terminated directory request where the index module cannot find one, the ngx_http_autoindex_module can generate a listing when enabled. The directive is autoindex on | off;, and its documented default is off.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
What disabling does not do
Turning off generated listings hides the directory view; it does not automatically make every file private. If a client knows a direct URL and the server’s permissions and routing allow it, that file may still be downloadable. Use authentication, authorization rules, filesystem permissions, application access checks, or a separate private storage location for sensitive material.
Apache and Nginx: the controls at a glance
| Aspect | Apache HTTP Server | Nginx |
|---|---|---|
| Directive used to disable generated listings | Options -Indexes, or remove Indexes from an inherited Options line |
autoindex off; |
| Listing component | mod_autoindex |
ngx_http_autoindex_module |
| Configuration scope to inspect | <Directory>, virtual host, per-directory .htaccess, and inherited Options |
http, server, and location blocks |
| Fallback when no index file exists | DirectoryIndex is tried first; mod_autoindex can list the directory when Indexes is enabled |
Index processing is tried first; autoindex can list a slash-terminated directory when enabled |
| Most common reason a change seems ineffective | A more-specific section still enables or overrides Indexes |
A more-specific location still contains autoindex on; |
Disable directory listing on Apache
1. Find the configuration that actually serves the directory
Do not edit the first Apache configuration file you find. Identify the virtual host handling the request and the filesystem directory mapped to the URL. The relevant setting may be in:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- A virtual-host definition containing a matching
<Directory>section. - A global or included
<Directory>section. - A per-directory
.htaccessfile, if the server permitsOptionsoverrides there. - An inherited
Optionsline in a broader directory context.
Configuration scope matters. Apache’s FAQ warns that directives in more-specific sections can override broader settings, so the change belongs in the most specific context that applies to the exposed directory.
2. Disable the Indexes option
Replace an enabling directive such as Options +Indexes or Options Indexes with a disabling form. If the line contains other options you still need, retain them and remove only the Indexes keyword.
<Directory /var/www/example>
Options -Indexes
</Directory>If the existing configuration is something like Options FollowSymLinks Indexes, remove Indexes while preserving the options required by the application, or explicitly use an appropriate combination that includes -Indexes. Do not remove unrelated options without checking what the site depends on.
3. Put the directive in a virtual-host or directory block when you control the server
A server administrator can place the setting alongside the path mapping for the site:
<VirtualHost *:80>
ServerName example.test
DocumentRoot /var/www/example
<Directory /var/www/example>
Options -Indexes
DirectoryIndex index.html
</Directory>
</VirtualHost>The path in this example is illustrative; use the real document root and the virtual host that receives the request. Keeping the directive with the matching directory makes it easier to see which content is protected and avoids assuming that a global setting covers every virtual host.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
4. Use .htaccess when that is the permitted administration point
For a site where you cannot edit the main Apache configuration but per-directory overrides are enabled, create or edit the .htaccess file in the directory whose contents should not be listed:
Options -IndexesA per-directory rule affects that directory and, subject to the server’s override and inheritance rules, its descendants. If Apache rejects the directive or returns a server configuration error, move the change to the virtual-host or <Directory> configuration; the host may not allow Options in .htaccess.
5. Keep an intentional index document
Disabling listings does not create a home page. Set an appropriate DirectoryIndex, such as index.html or the application’s normal entry point, and make sure that file exists in the requested directory. When an index file is present, Apache serves it instead of needing the autoindex fallback. When no index exists and Indexes is disabled, the response will no longer be a generated file list; the exact status and error page depend on the rest of the site configuration.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →6. Check for a more-specific override
If a listing remains, search the active configuration hierarchy for another Options Indexes or Options +Indexes. A nested <Directory> section, a path-specific rule, or a per-directory .htaccess can take precedence over a broader block. Apply Options -Indexes at the narrowest context that serves the affected path, then inspect child directories if only part of the site changed.
7. Validate, reload, and test
- Run the Apache configuration validation procedure provided by your operating system or deployment.
- Fix every syntax or include-file error before reloading; an invalid configuration can prevent the service from accepting the new state.
- Reload Apache through the normal service-management process rather than relying on a browser refresh alone.
- Request a directory that intentionally has no index file. A generated “Index of” page should not be returned.
- Request a directory that does contain the intended index file and confirm that the application or static page still loads.
Disable directory listing on Nginx
1. Identify the active server and location
Open the configuration for the Nginx virtual server that receives the hostname and port in question. Find the location serving the static directory or document root. A setting in an unrelated server block will not affect the request you are testing.
2. Add autoindex off; at the suitable level
The directive is valid in http, server, and location contexts. Put it at the narrowest level that should have the policy. A path-specific example is:
server {
server_name example.test;
root /srv/www/example;
location /downloads/ {
autoindex off;
index index.html;
}
}If every server handled by the Nginx instance should follow the same rule, an http-level setting may be appropriate. If only one virtual host or one URL path needs the change, keep it in that server or location block so other sites are not changed accidentally.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
3. Check nested locations for autoindex on;
When the listing persists, inspect more-specific location blocks for an explicit autoindex on;. A path such as /downloads/ may be handled by a nested or regex location different from the one you edited. Remove the enabling directive or set autoindex off; in the block that actually wins for the request.
4. Confirm the index setting and request form
Nginx’s autoindex behavior is tied to directory requests, especially slash-terminated URLs, after index processing fails. Confirm that the intended file exists and that the index directive names it. Test the canonical directory URL with its trailing slash as well as any redirect that leads to it; otherwise you may be testing a different location or a different response altogether.
5. Validate, reload, and verify
- Run the Nginx configuration-test procedure used by your deployment.
- Do not reload until the test reports a valid configuration.
- Reload Nginx through the normal service-management process.
- Request a directory without an index file and verify that no generated listing is returned.
- Request a directory with its intended index file and verify that the site still serves that file.
Configuration scope, inheritance, and defaults
The directive itself is simple; selecting the block that wins for a request is the part that usually requires investigation. On Apache, a global setting can be changed by a virtual-host or directory section, and a per-directory .htaccess file can affect a subtree when overrides are allowed. A broad Options -Indexes does not guarantee that a child context has not enabled Indexes again. Inspect the complete effective hierarchy rather than assuming the first matching line is decisive.
On Nginx, autoindex off; is already the documented default. Adding it is still useful because it records the intended policy and overrides a deliberate autoindex on;. The directive is accepted in http, server, and location contexts, but the request is handled by the location selected through Nginx’s location-matching rules. An edit in a server block that does not receive the tested hostname, or in a location that loses to a more-specific match, has no visible effect.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use the narrowest setting that meets the requirement when only one directory should change. Use a broader setting only when every site or path in that scope should have the same behavior. This avoids disabling a listing that another intentionally public area depends on, while still making the exposed directory’s policy explicit.
What response should you expect after disabling listings?
There is no single required status for a directory with no index file. Apache or Nginx may return a configured error page, an access-denied response, or an application-generated response. The important difference is that the server no longer supplies an automatically generated file list. Do not interpret a new error as proof that the change failed; first confirm that the listing is gone, then decide whether the directory needs an index document or an application route.
Keep separate tests for an indexed and an unindexed directory. The indexed test proves that the normal site entry point still works. The unindexed test proves that the fallback listing is disabled. Test through the public hostname and normal proxy or cache path, because a different virtual host or a cached response can make a correct configuration appear ineffective.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Troubleshooting when the listing is still visible
| Symptom | Likely cause | What to check |
|---|---|---|
| Apache still shows an “Index of” page | The request is handled by a different virtual host or a more-specific directory context still enables Indexes. |
Trace the hostname and path to the active virtual host, then search nested <Directory> and .htaccess rules for Indexes. |
| Nginx still lists files | The edited block does not win location matching, or another block contains autoindex on;. |
Inspect the exact location serving the path and any nested or regular-expression locations. |
| A directory returns an error after listings are disabled | No index document exists and the server now has no listing fallback. | Add the intended index file or configure the application’s entry point; do not re-enable listing merely to hide the error. |
| The main website works but a subdirectory still lists files | The subdirectory has its own configuration or inherited setting. | Apply the directive in the subdirectory’s most-specific context and test that URL separately. |
| Only the URL with a trailing slash behaves differently | Directory processing and Nginx location matching can differ between the slash and non-slash forms. | Test the canonical slash-terminated URL and follow redirects before deciding which configuration is active. |
| The configuration test fails | A syntax error, unsupported context, or malformed include prevents the new configuration from loading. | Read the validation error, correct the referenced file, validate again, and reload only after a successful test. |
| A known file remains directly downloadable | Disabling autoindex changes enumeration, not file authorization. | Use authentication, authorization, filesystem permissions, or application controls for confidential files. |
A safe verification checklist
- Test the public URL, not only a local filesystem path.
- Test a directory that contains an index file and one that deliberately does not.
- Check both the hostname and any alternate hostname that may map to another virtual host.
- Inspect upload, backup, temporary, and generated-asset directories; these are common places where no index file exists.
- Confirm that an expected application route still works after the directive is added.
- Review the response from an unauthenticated client if the directory is public; an administrator’s authenticated session may be seeing a different route.
- Remember that cached responses can outlive a configuration reload. Verify a fresh request through the same proxy or cache path used by visitors.
Choosing the right fix
Use Apache’s option when Apache serves the files
Choose Options -Indexes when Apache is the component generating the listing. Put it in the most specific applicable directory context, virtual host, or allowed .htaccess. Remove only the Indexes keyword if other Options values are required.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteUse Nginx’s directive when Nginx serves the files
Choose autoindex off; when Nginx’s autoindex module is producing the response. Place it in the relevant http, server, or winning location block, and check for a more-specific block that enables it.
Do not treat either setting as a complete security boundary
Both directives stop the convenience page that exposes a directory’s contents. They do not remove files, change URL permissions, or replace access control. For confidential data, restrict the resource itself and verify that a guessed direct URL is denied, not merely that the directory page has disappeared.
Managed hosting versus self-managed configuration
If you cannot edit Apache or Nginx configuration, the practical requirement is an administration point that permits the relevant directive. A managed Apache/Nginx hosting provider may apply the change for you, while a configurable VPS gives you access to the virtual-host, directory, or location files. Confirm the provider’s actual control model, supported server, and service terms before choosing it; there is no universal product or commission arrangement associated with this setting.
Expected end state
After a successful change, a directory with a valid index file continues to serve that file. A directory without one no longer produces an automatically generated listing. Depending on the rest of the configuration, that request may instead produce an application response, a deliberate error page, or an access-denied response. The important check is that filenames are not being enumerated by the web server and that the site’s intended entry points still function.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Frequently Asked Questions
Where exactly do I put Options -Indexes in Apache?
Put it in the most specific applicable <Directory> block, the matching virtual-host configuration, or a permitted per-directory .htaccess file. If a more-specific context enables Indexes, the broader setting may not win.
Can I use Options -Indexes in every Apache installation?
Only where the configuration context permits the Options directive. Shared hosts may disallow it in .htaccess; in that case, an administrator must change the virtual-host or <Directory> configuration.
Where does autoindex off; go in Nginx?
It is valid in http, server, and location blocks. Use the narrowest block covering the directory, and check that a more-specific location does not contain autoindex on;.
Why does Nginx still show a listing when its default is off?
The request may be reaching a different server or location block, or a more-specific block may explicitly enable autoindex on;. Verify the hostname, path, trailing slash, and winning location before changing unrelated settings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Will disabling listings make the files private?
No. It removes the generated directory page, but a known direct URL can remain accessible when routing and permissions allow it. Protect confidential files with authentication, authorization, filesystem permissions, application checks, or private storage.
What happens when a directory has no index file after I disable listings?
The generated file list is no longer returned. The server may instead send an error page, an access-denied response, or an application response, depending on the remaining configuration. Add the intended index document if visitors should see a page there.
Do I need to test the URL with a trailing slash?
Yes. Nginx autoindex processing is associated with slash-terminated directory requests, and redirects or location matching can differ between slash and non-slash forms. Test the canonical URL and follow redirects.
How do I know the change loaded successfully?
Run the normal Apache or Nginx configuration validation first, correct every reported syntax or include error, reload the service through its standard process, then test both an indexed and an unindexed directory through the public hostname.
Recommended Free Tools
Is there a universal price for fixing directory listing?
No. The directives themselves do not require a product purchase. If you need help, compare a managed Apache/Nginx service or configurable VPS based on its actual administration access, geography, and terms.
The Bottom Line
Disable Apache listings with Options -Indexes in the most specific applicable context. Disable Nginx listings with autoindex off; in the winning http, server, or location block. Validate, reload, and test a directory without an index file—and remember that hiding enumeration is not the same as restricting direct file access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
