How to Disable Directory Browsing Using .htaccess

Directory browsing, also called directory listing or directory indexing, is the behaviour where a web server, finding no index file (such as index.html or index.php) in a folder, shows visitors an automatically generated list of every file and sub-folder it contains instead. That listing can expose backups, configuration files, scripts, and other material you never intended the public to see, which makes it a common target during reconnaissance. This guide shows you how to switch directory browsing off across your whole site with a single line in your .htaccess file, how to confirm it worked, and where the rule can catch you out.

Last reviewed: 27 July 2026, against Apache HTTP Server 2.4 (current stable series). This guide is written for Noiz hosting and is kept current against Apache. It complements, and does not replace, the official Apache documentation linked below.

Official Documentation Reference

• Apache HTTP Server: the Options directive
• Apache HTTP Server: mod_autoindex (directory indexing)
• Apache HTTP Server: the DirectoryIndex directive
• Apache HTTP Server: .htaccess files how-to

Prerequisites

• A Noiz hosting account you can sign in to, with access to your site's files through the File Manager or FTP.
• A site served by Apache. The .htaccess file is read only by Apache, so this method has no effect on a site served purely by Nginx. If you are unsure which applies to your account, open a support ticket and the Noiz team will confirm.
• A copy of your current .htaccess file, saved before you make any change. A single typo in this file can take the whole site offline with a 500 Internal Server Error, so always have something to roll back to.

Check Whether Directory Browsing Is Currently On

Test before you change anything, so you know whether there is a problem and can tell afterwards that the fix worked. In a browser, request a folder on your site that contains no index file, remembering the trailing slash, for example https://yourdomain.com/uploads/. Replace yourdomain.com with your own domain.

• A page headed Index of /uploads listing the folder's contents means directory browsing is enabled and worth switching off.
• A 403 Forbidden response means listings are already blocked.
• A 404 Not Found response means there is no folder at that path, so pick a different one to test.

Choose a folder that genuinely has no index.html or index.php in it. A folder that has one will always serve that file, which tells you nothing about the autoindex setting.

Add the Rule to .htaccess

The .htaccess file is a plain text configuration file that Apache reads from the folder it sits in. Its name begins with a dot, which marks it as a hidden file, so you may need to enable Show Hidden Files (dotfiles) in your File Manager to see it. Place the rule in the .htaccess file at the root of your website (for example httpdocs or public_html, depending on your hosting plan) to protect every folder on the site.

1. Open your site's document root in the File Manager or over FTP.
2. Open the existing .htaccess file for editing. If there is no .htaccess file yet, create one with exactly that name, including the leading dot and with no file extension.
3. Add the following line:

Options -Indexes

4. Save the file. The change takes effect immediately, because Apache re-reads .htaccess on every request. There is nothing to restart.

The minus sign in -Indexes is what does the work: it removes the Indexes option, which is the option that tells Apache to generate a listing when no index file is present. A line reading Options +Indexes would switch the behaviour back on, so check for that if a folder is still showing its contents.

Use the - prefix rather than writing a bare option list. Options -Indexes subtracts one option and leaves everything else the folder inherits untouched. Writing something like Options FollowSymLinks with no prefix replaces the entire inherited set, which can silently disable behaviour other parts of your site depend on and is awkward to diagnose weeks later.

Confirm It Is Working

Re-request the same folder you tested earlier, for example https://yourdomain.com/uploads/. Where you previously saw a list of files, Apache now returns a 403 Forbidden page, which is exactly what you want: the folder's contents are hidden while the files inside it remain reachable by their direct URLs.

If you still see the old listing, load the page in a private browsing window. Browsers and any content delivery network sitting in front of your site will happily keep serving a cached copy of the listing after the rule is in place.

Allow Listings in One Folder Only

The rule inherits downwards, so if you deliberately want a listing in a single folder, such as a public download archive, place a separate .htaccess in that folder containing the opposite rule.

Options +Indexes

Be deliberate about this. Every file that lands in that folder becomes discoverable by anyone who visits it, including files an upload script, plugin or backup job puts there without your knowledge.

Make Sure Your Index File Is Recognised

Apache only falls back to a listing when it cannot find a file named in the DirectoryIndex list. On a typical hosting account that list covers index.html and index.php. If a folder's landing page is named something else, name it explicitly so the server serves it instead of returning 403.

DirectoryIndex index.php index.html home.php

You can also give visitors a friendlier response than the default 403 page by pointing Apache at a custom error page. The path is relative to your document root, and the target page must itself be reachable.

Options -Indexes
ErrorDocument 403 /403.html

Good to Know

• The rule applies to the folder it sits in and every folder beneath it, so a single .htaccess at your document root covers the whole site. You can override it for one folder by placing a separate .htaccess there.
• Disabling directory browsing hides the listing, it does not protect the files themselves. Anyone who already knows or guesses a file's exact URL can still request it. Treat this as one layer of hardening, not a substitute for proper permissions on anything sensitive. If a file must never be public, move it above the document root, put it behind authentication, or delete it.
• Adding an empty index.html to a folder achieves a similar result for that one folder, but it is a per-folder patch you have to repeat forever and it is easy to miss a folder created later by a script. Options -Indexes is cleaner because it protects every existing and future folder at once and needs no upkeep.
• Listings are exactly what automated scanners look for, and what they routinely turn up is material nobody meant to publish: backup.zip, db.sql, config.php.bak, an old staging copy, or documents dropped into an uploads folder. None of that is protected by simply being unlinked, only by nobody knowing the file name.
• Some Noiz hosting plans already disable directory browsing at the server level. If a test folder returns 403 Forbidden before you change anything, the protection is already active and the rule simply makes it explicit and portable, so it travels with the site if it is ever moved.

Troubleshooting

Symptom: the site returns a 500 Internal Server Error as soon as you save. The most likely cause is that Options is not permitted in .htaccess for that folder, which writes an Options not allowed here line into the error log. Restore your backup to bring the site straight back, then open a support ticket so the override can be enabled for your account.

Symptom: one folder still lists its contents while the rest of the site is fine. A .htaccess inside that folder overrides the one above it, so check that folder for a stray Options +Indexes or Options All line.

Symptom: the whole site now returns 403 Forbidden. That is not caused by Options -Indexes on its own. Confirm your document root still contains a valid index file, and check whether another rule in .htaccess is denying access.

Symptom: nothing changes and nothing is logged. The site is most likely not served by Apache. Nginx and similar servers ignore .htaccess entirely and control listings in their own configuration.

Related Guides

• How to Protect the htaccess File
• How to Password Protect a Directory in cPanel
• How to Edit the .htaccess File in the cPanel File Manager

Need a Hand?

If a folder is still listing its contents after you add the rule, or you would like Noiz to review your site's .htaccess hardening for you, open a support ticket from your Noiz client area and the team will assist.