By default, if a folder on your website doesn't contain an index file (like index.html or index.php), anyone who visits that folder's URL directly can see a plain list of every file and subfolder inside it. This is called directory listing, or directory indexing, and it can expose file names, backup copies, or scripts you never meant visitors to browse. Turning it off is quick and doesn't affect how your website normally works.
What Directory Listing Looks Like
If you type a folder path into your browser, for example yourdomain.com/images/, and there's no index file inside it, you'll see a bare list of filenames instead of a proper page. Anyone can click through and open those files directly. It's a small thing, but it's an easy win for tidying up your site's security.
How to Disable Directory Listing
In cPanel
- Log in to cPanel and, under the Advanced section, click Index Manager.
- Browse to the folder you want to protect and click on it to select it.
- Choose No Indexing from the list of options.
- Click Save.
Repeat this for any other folder that shouldn't be browsable. To cover your whole website at once, run it on your account's root folder, usually public_html.
In DirectAdmin
DirectAdmin doesn't have a dedicated indexing tool, but you can get the same result with a short line in a .htaccess file.
- Log in to DirectAdmin and open File Manager.
- Browse to the folder you want to protect. If there's no .htaccess file there, create one.
- Open the file for editing and add this line: Options -Indexes
- Save the file.
To cover your entire website, add the same line to the .htaccess file inside your public_html folder.
Disabling directory listing doesn't hide or delete the files inside a folder, it only stops the browser from showing a clickable list of them. Anyone who already knows or guesses the exact file name can still open it directly. If a folder holds something genuinely sensitive, password-protect it instead of just hiding the listing.
Checking It Worked
Visit the folder's URL in your browser, for example yourdomain.com/images/. Instead of a file list, you should now see a 403 Forbidden error, or your normal page if the folder does have an index file. If you still see a list of files, check that you saved the change in the right folder and, for DirectAdmin, that the .htaccess line was typed exactly as shown.
If you'd rather block a folder from being accessed at all instead of just hiding the listing, see how to password-protect a directory on your website.