When a folder has no index file, the server may display a browsable list of everything inside it. Visitors can then download files you never linked to.
WHY IT MATTERS
Automated scanners specifically look for open directories. An exposed uploads or backup folder gives an attacker a map of your site and sometimes the credentials to enter it.
FIXING IT IN CPANEL
- Open Indexes under Advanced.
- Browse to the folder, or select
public_htmlto cover everything. - Click Edit, choose "No Indexing", and Save.
FIXING IT IN .HTACCESS
Add this line to public_html/.htaccess:
Options -IndexesVisitors then receive a 403 Forbidden instead of a file listing.
CHECKING
Visit a folder with no index file, such as https://yourdomain.com/wp-content/uploads/ and confirm you see a Forbidden message, not a list.
A SECOND LAYER
Disabling listings hides the file names but does not protect the files themselves. Anyone who knows or guesses an exact filename can still download it. Sensitive files should be moved out of public_html, not merely hidden.
