To disable directory listing in WordPress, change the web server setting that generates folder indexes, then test the exact directory URL while logged out. Apache commonly uses Options -Indexes; Nginx uses autoindex off;. Confirm your hosting stack first because adding an Apache directive to an Nginx site will not configure Nginx.
Last updated: September 6, 2026. Skill level: intermediate; hosting access required.
This tutorial covers directory browsing on self-hosted WordPress. It does not make uploaded files private or replace malware cleanup. Server settings sit outside the block and Classic Editors; do not paste these directives into a post, theme stylesheet, or PHP snippet.
What is directory listing, and why check it?
Directory listing is a server-generated page showing files inside a folder when no applicable index page handles the request. It can make filenames and downloads easier to discover. Disabling the list removes that browsing view, but someone who already knows a public file’s URL may still be able to request the file directly.
Think of an uploads folder containing public photographs and an accidentally uploaded database archive. Removing the folder index does not make the archive safe to leave there. Sensitive files belong in storage with appropriate access controls, not merely behind an unlisted filename.
For Apache’s behavior, consult its Options directive reference. For Nginx, use the autoindex module documentation. Both references were checked September 5, 2026; the hosting provider controls which settings you can change.
How do you check whether a directory is browsable?
Open a known directory URL on your own website in a logged-out browser and inspect the response. Use a directory that exists and is relevant to the setting you plan to change. A homepage, redirected URL, or folder containing its own index file may not reveal whether directory browsing is enabled elsewhere.
- Select a known, non-sensitive directory on a staging copy first.
- Open its URL with a trailing slash in a private window.
- Record the final URL and whether the server displays filenames.
- Open a known public file from that directory separately and record whether it loads.
- Repeat those same requests after the configuration change.
A plain 403 response can be an expected outcome when indexing is disabled and no index resource exists. A normal page, redirect, or 404 may have another explanation. Inspect the response in context instead of judging the setting from a status code alone.
Avoid creating a test folder containing real backups, configuration files, or logs. If you need a fixture on staging, use a clearly labeled harmless text file and remove the fixture through your usual cleanup process afterward.
How do you disable listing on Apache?
On Apache, disable the Indexes option in the configuration scope that serves the directory. On shared hosting, the provider may permit this in .htaccess; on a managed server, the administrator may prefer the virtual-host configuration. Keep a backup and a separate way to restore access before changing a live configuration file.
For an Apache host that allows the directive, add the following line to the WordPress root .htaccess, outside the WordPress-generated marker section:
Options -IndexesDo not replace the entire file. Existing rewrite rules, redirects, and host controls may be necessary for the site. Download a private backup through the hosting file manager or SFTP, add only the intended line, save, and immediately test both the site and directory URL.
Apache’s .htaccess tutorial explains that the server’s override configuration determines which directives are accepted. A provider may ignore .htaccess or reject a setting in that context. If the change causes a 500 error, restore the previous file and ask the host to identify the rejected directive.
Do not enable broad override permissions yourself merely to make this example work. On a server you administer, make the narrow configuration change in the established site configuration and follow its validation and reload procedure.
How do you disable listing on Nginx or managed hosting?
On Nginx, the administrator should ensure that autoindex off; applies in the configuration serving the affected path. Nginx does not use Apache’s .htaccess settings. Managed hosting may expose a control-panel switch or require a support request, especially when another proxy or storage service serves the files.
The relevant Nginx directive is:
autoindex off;Add it within the appropriate existing HTTP, server, or location context after reviewing the configuration. Do not paste in a new generic location / block that could replace the site’s routing. An administrator should validate syntax with nginx -t and reload using the host’s supported procedure only after validation succeeds.
Nginx documents off as the default, but another configuration scope may enable listing. Check the effective configuration for the affected path rather than assuming the default remains in force.
For LiteSpeed, a reverse proxy, or object storage, ask the provider which layer generates the directory view. Apache compatibility in one layer does not establish that every request reaches that layer. Include the exact example URL in your support request.
How do you verify the change without breaking public media?
Retest the same directory and a known public file after the setting takes effect. The directory should stop revealing a generated file list, while intended public assets should still load. Also check an article, navigation links, and images. Restricting the whole uploads tree can break the site without being necessary to disable indexing.
| Before and after check | Desired result |
|---|---|
| Known directory URL | No generated list of filenames |
| Public image URL | Image still loads normally |
| Article containing that image | Page and media display correctly |
| Homepage and internal link | Normal navigation still works |
| Private-window request | Same intended protection without an admin session |
If a CDN cached the earlier list, follow your provider’s process to purge that response and retest. Keep both the original URL and any redirects in your notes. A successful test on one directory does not prove that separate storage buckets or other virtual hosts use the same policy.
For wider protection decisions, see our WordPress firewall guide. A firewall and a folder-index setting serve different purposes and should be evaluated separately.
What should you do if sensitive files were listed?
Treat an exposed backup, log, or configuration file as a separate investigation. Disabling listing stops the directory view; it does not establish who downloaded a file or erase cached copies. Preserve useful evidence, restrict the file appropriately, and involve the host or security lead before deciding which credentials or systems may be affected.
Do not copy sensitive file contents into a public support ticket. Describe the type of file and share evidence through an appropriate private channel. If compromise is confirmed, use the relevant WordPress recovery guide rather than stopping after the directory setting changes.
Frequently asked questions
Does disabling listing protect every uploaded file?
No. Direct URLs to public files may remain accessible. Private downloads need access controls at the layer serving them, not just a hidden folder index.
Do I need a WordPress plugin for this?
Not necessarily. Directory indexing is a server behavior. Your hosting panel or administrator may be the appropriate place to change it.
Why did the Apache example cause an error?
The server may reject that directive in .htaccess, or another syntax issue may exist. Restore the previous configuration and ask the host to inspect the error rather than adding more settings blindly.
Does a 403 directory response mean images are broken?
Not necessarily. A folder URL and a specific image URL are different requests. Test a known image separately before changing permissions or relaxing the server rule.
