Directory Listing Enabled on Web Server
The web server lists directory contents to anyone, exposing unlinked files such as backups, archives and internal documents.
What is Directory Listing Enabled on Web Server?
Directory listing (autoindex in Nginx, mod_autoindex in Apache) makes the server render a clickable index of every file in a directory when no index.html or index.php exists. It is usually enabled by accident — a default configuration, an empty uploads folder, a static asset directory where nobody added an index page. The danger is that it exposes files that were never linked from anywhere: old backups, export CSVs, staging copies, log files, and internal documents that the owner assumed were invisible because "nobody knows the URL". Automated scanners crawl common directory names constantly, so obscurity provides no protection.
Why It Matters to Your Business
Open directories are a leading source of accidental data leaks. A single exposed export or backup file can disclose customer PII, credentials, or proprietary source code — with GDPR and other regulations applying full breach-notification obligations to the leak. Directory listings also hand attackers a complete map of your file structure, making targeted requests for known-sensitive filenames trivial. The finding appears in every vulnerability assessment, and remediation is a one-line server configuration.
How to Fix It
Disable directory listing at the server level:
Nginx (listing is OFF by default — remove any 'autoindex on;' you find):
location /uploads/ { autoindex off; }
Apache (virtual host or .htaccess):
<Directory /var/www/html>
Options -Indexes
</Directory>
Lighttpd:
server.dir-listing = "disable"
IIS (web.config):
<directoryBrowse enabled="false" />
Then also: place an empty index.html inside any directory that must stay public (uploads, static), and ideally move user uploads OUT of the web root entirely, serving them through the application instead.
Verify: open https://yoursite.com/uploads/ — you should see your index page or a 403, never a file list.
Frequently Asked Questions
What does an open directory listing reveal?
Every file in the directory, including files that were never linked from your site — backups, exports, logs, internal documents. Bots crawl common paths (uploads, backup, static, files) automatically, so anything listed will be found.
Is directory listing a vulnerability if the folder only has images?
It is still an information disclosure — the file names themselves often leak internal structure, upload patterns, and sometimes names or emails of users. Best practice is to keep listings off everywhere and let the application control access.
How do I check whether my server has directory listing on?
Open any directory URL on your site without a filename (e.g. /uploads/) and see if a file index renders. Or run a free scan on this page — our open directory and sensitive path scanners test this and dozens of related exposures.
Technical Classification
| OWASP Category | A05:2021 — Security Misconfiguration |
| CWE ID | CWE-548: Exposure of Information Through Directory Listing |
| Detected By | open_directory, sensitive_paths scanner(s) |
| Severity Level | medium |
How 2MNY Security Can Help
Check if your website has this vulnerability
Our open_directory, sensitive_paths scanner checks for this issue automatically.
Scan My Website FreeRelated Vulnerabilities
Exposed .git Directory
The .git directory is publicly accessible, allowing attackers to download your entire source code repository.
Server Version Disclosure
The Server and X-Powered-By headers disclose the server software and version, helping attackers target known vulnerabilities.
Exposed .env File (Config Disclosure)
The .env file is downloadable from the web, leaking database passwords, API keys and application secrets to anyone who asks.
Exposed Backup Files (.bak, .sql, .zip)
Backup archives and .sql dumps left inside the web root can be downloaded by anyone — including your entire database.