How to Disable Directory Listing in Apache

disable directory listing apache

When you run a website, it’s essential that you disable its directory listing. Otherwise, website visitors an easily get the directory structure of your website and use it to exploit vulnerabilities. Here’s how to disable Directory Listing in Apache.


How to Disable Directory Listing in Apache

There are 2 ways to disable directory listing in Apache – via apache config, and .htaccess file. We will look at both the methods


Using Apache Config File


1. Open Apache Config File

Open Apache’s config file using a text editor

Ubuntu / Linux Mint

$ sudo vim /etc/apache2/apache2.conf



$ sudo vim /etc/apache2/httpd.conf


2.  Disable Directory Listing

Look for the following line

Options Includes Indexes FollowSymLinks MultiViews

Remove the keyword “Indexes” from it.

Now it should look like

Options Includes FollowSymLinks MultiViews

Save and close the file.


3. Restart Apache Web Server


/etc/init.d/httpd restart 



sudo /etc/init.d/apache2 restart 



Using .htaccess File

Before you proceed, please ensure you have enabled .htaccess file in Apache

1. Open .htaccess File

Open .htaccess file (usually at /var/html/www) with a text editor

$ sudo vim /var/html/www/.htaccess


2. Disable Directory Listing

Add the following line to .htaccess file.

Options -Indexes


Save and close the file


3. Restart Apache Server

Restart Apache web server to apply changes

$ /etc/init.d/apache restart


That’s it! Now visitors will get a “403 : Forbidden” error if they try to access a page whose URL they do not know. They will have to specifically request the file or directory they’d like to see.

About Sreeram Sreenivasan

Sreeram Sreenivasan is the Founder of Ubiq, a business dashboard & reporting platform for small & medium businesses. Ubiq makes it easy to build business dashboards & reports for your business. Try it for free today!