Directory listing happens when a visitor opens a folder on your website that has no index.html or index.php file inside it. Instead of a normal web page, the server shows a plain list of every file sitting in that folder. That can expose file names, old backups, configuration files, or scripts you never meant visitors to browse through, so most folders on your site should have this turned off.
Why This Matters
A directory listing doesn't hand over passwords by itself, but it does show attackers exactly what's there to try. A visible list of filenames makes it much easier for someone to guess at a leftover backup archive, an old script, or a config file they can then try to open directly. Turning off directory listing closes that door without affecting how your actual web pages load.
How to Turn Off Directory Listing
In cPanel
- Log in to cPanel and, under the Files section, click Index Manager.
- Browse to the folder you want to protect and click on it.
- Choose No Indexing from the options shown.
- Click Save.
Index Manager only changes the one folder you select, so repeat these steps for any other folder that shouldn't show a file list, including subfolders.
In DirectAdmin
DirectAdmin doesn't have a dedicated indexing tool, so the setting is added directly to an .htaccess file instead.
- Log in to DirectAdmin and open File Manager.
- Navigate to the folder you want to protect.
- Open the .htaccess file in that folder (create a new file named .htaccess if one doesn't already exist).
- Add this line on its own:
Options -Indexes - Click Save.
The Options -Indexes line also works in cPanel, so if you're comfortable editing files directly it's a quick way to apply the same protection to several folders at once by placing it in each folder's .htaccess file.
The simplest fix for any single folder, in either panel, is to upload a blank index.html file into it. With an index file present, the server shows that page instead of a file list, and you never need to touch .htaccess at all.
If you also want to restrict a folder to specific visitors rather than just hiding the file list, see how to password-protect a directory on your website.