How to Disable Directory Listing in Apache


disable directory listing apache

When you run a website, it’s essential that you disable its directory listing. Otherwise, website visitors an easily get the directory structure of your website and use it to exploit vulnerabilities. Here’s how to disable Directory Listing in Apache.

 

How to Disable Directory Listing in Apache

There are 2 ways to disable directory listing in Apache – via apache config, and .htaccess file. We will look at both the methods

 

Using Apache Config File

 

1. Open Apache Config File

Open Apache’s config file using a text editor

Ubuntu / Linux Mint


$ sudo vim /etc/apache2/apache2.conf

 

CentOS/Fedora/RHEL


$ sudo vim /etc/apache2/httpd.conf

 

2.  Disable Directory Listing

Look for the following line


Options Includes Indexes FollowSymLinks MultiViews

Remove the keyword “Indexes” from it.

Now it should look like


Options Includes FollowSymLinks MultiViews

Save and close the file.

 

3. Restart Apache Web Server

CentOS/Fedora/RHEL


/etc/init.d/httpd restart 

 

Ubuntu/Debian/LinuxMint


sudo /etc/init.d/apache2 restart 

 

 

Using .htaccess File

Before you proceed, please ensure you have enabled .htaccess file in Apache

1. Open .htaccess File

Open .htaccess file (usually at /var/html/www) with a text editor


$ sudo vim /var/html/www/.htaccess

 

2. Disable Directory Listing

Add the following line to .htaccess file.


Options -Indexes

 

Save and close the file

 

3. Restart Apache Server

Restart Apache web server to apply changes


$ /etc/init.d/apache restart

 

That’s it! Now visitors will get a “403 : Forbidden” error if they try to access a page whose URL they do not know. They will have to specifically request the file or directory they’d like to see.

About Sreeram Sreenivasan

Sreeram Sreenivasan is the Founder of Ubiq, a business dashboard & reporting platform for small & medium businesses. Ubiq makes it easy to build business dashboards & reports for your business. Try it for free today!