Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →If your website displays a list of files from a build or project folder, check two separate settings: the server’s URL-to-filesystem mapping and whether directory listings are enabled. The mapping determines which files public URLs can reach; the listing setting determines whether a directory without a usable index file is displayed as a list. Turning listings off does not fix an overly broad web root.
Why a website shows a folder listing
A web server translates a requested URL into a filesystem location using its active site configuration. If that mapping points to a build or project directory, the server may be able to serve files from there. When someone requests a directory and the server cannot find an applicable index file, it may show a listing if directory indexing is permitted.
As an Amazon Associate I earn from qualifying purchases.
These are related but distinct issues. The web root or location mapping controls which files a URL can reach. The directory-index setting controls whether a directory request can reveal its contents as a list. A listing can reveal filenames and folder structure, but seeing a listing alone does not establish that sensitive files were exposed.
Diagnose the effective configuration
- Identify the server and active site. Determine whether the request is handled by NGINX, Apache, or another server, and which virtual host or site configuration applies.
- Trace the URL to disk. Work out which filesystem directory the requested URL resolves to under the active mapping. In NGINX, inspect the applicable
rootoralias; in Apache, check the document root and URL mapping. - Check for an index file. Confirm whether the requested directory contains an intended index file and whether its name is among the index filenames configured for that server and scope.
- Check listing permissions. Look for NGINX
autoindexin the matching location, or Apache’smod_autoindexand applicableOptionssettings. - Review configuration scope. A more specific location, directory, or virtual-host rule may change the behavior. Check the effective rule for the exact URL rather than relying on a setting elsewhere in the configuration.
What to check in NGINX
NGINX uses root or alias to determine the filesystem path for a request, and index to specify which index files to try for a directory request. Its documentation explains that a URI ending in a slash prompts an index-file lookup; if the applicable location has autoindex on, NGINX can instead return an automatically generated listing. See the NGINX guide to serving static content.
#1 Best Overall
Check the mapping and listing rule independently. If the configured root points to a project directory that should not be public, correct the mapping so requests resolve only to the intended public files. If listings are not an intentional site feature, disable them in the applicable location. Do not assume that turning off autoindex makes every file under the configured root unreachable.
What to check in Apache
Apache also maps requested URLs to filesystem locations and may try a directory index. If mod_autoindex is loaded and the applicable directory options permit it, Apache can generate a listing when there is no usable index. Apache’s documentation describes Options -Indexes as a way to turn off listings for a directory; the exact effect depends on the configuration scope. See the Apache mod_autoindex documentation and its Options directive reference.
As with NGINX, disabling listings and correcting the document root are different changes. Make sure the document root and URL mappings expose only the intended public content, then turn off directory listings wherever they are not needed.
Fix the exposure and verify the result
- Set the public root or mapping to the directory intended for web serving, not a broader project or build directory containing files that should not be public.
- Disable automatic directory listings unless the site deliberately needs them: use the applicable NGINX
autoindexsetting or ApacheOptions -Indexes. - Check the deployed directory itself. Keep its contents limited to public assets; a safer listing setting cannot protect a sensitive file that remains directly reachable through a URL.
- After applying the change using the method appropriate to your server and host, request the same public URL again and confirm that it serves the intended page or content rather than a directory list.
GitLab’s DAST guidance on directory listing and a U.S. government-hosted guide to securing public web servers also recommend checking configuration for unintended listings. If you find a sensitive file that may have been accessible, assess that exposure separately; the existence of a listing does not show by itself what was accessed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
