Directory Listing Check

When a web server has automatic directory indexing enabled and a folder has no index file, it serves a browsable "Index of /" listing of everything inside. That hands attackers a free map of your file structure — uploads, backups, configuration files, and assets they were never meant to see. VitalSite checks common directory paths for this behavior.

What VitalSite checks

We request a set of frequently-exposed directories — such as /uploads/, /backup/, /files/, /images/, /assets/, /static/ — and scan the response for the tell-tale "Index of /" or auto-index markup that servers emit when listing is enabled.

Why it matters

Directory listing is an information-disclosure problem that often leads to something worse. An open /backup/ folder might reveal a downloadable database dump; an open /uploads/ folder can expose private documents; even an asset listing helps an attacker fingerprint your stack and find unlinked files. None of this should be discoverable by simply visiting a folder URL.

How to fix it

Disable auto-indexing at the server level.

Apache — turn off the Indexes option:

Options -Indexes

(place it in the relevant directory block or .htaccess)

Nginx — autoindex is off by default; if it was enabled, set:

autoindex off;

Then make sure sensitive folders contain an index file (or are blocked entirely) and that backups and private files live outside the web root. This pairs directly with the sensitive file exposure check — a folder that lists its contents makes those files trivially discoverable.

Verify the fix

Re-scan the domain. The Directory Listing check should report no open indexes. As a spot-check, visit a folder URL directly in your browser — you should get a 403 or 404, not a list of files.

Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.