How to Disable Directory Indexing and Prevent File Browsing
When a website folder lacks an index file (such as index.php or index.html), web servers often display a full list of all files in that directory. Known as directory indexing or directory browsing, this allows visitors to browse raw uploads, plugin files, or site assets, posing privacy and security risks.
Disabling directory indexing ensures visitors see a 403 Forbidden page instead of a list of your files. You can configure this using cPanel, Plesk, or your .htaccess file.
Method 1: Using .htaccess (Recommended)
Editing your .htaccess file applies rules directly to the web server and works on both cPanel and Linux-based web hosting environments.
- Log into your hosting control panel and open File Manager.
- Navigate to your website’s root directory (typically
public_html). - Ensure hidden files are visible (in cPanel File Manager, click Settings at the top right and check Show Hidden Files (dotfiles)).
- Edit the
.htaccessfile (or create one if it does not exist). - Add the following line at the top of the file:
Options -Indexes - Click Save Changes.
Method 2: Using the “Indexes” Feature in cPanel
If you prefer a graphical menu without editing code directly, cPanel offers a built-in Index Manager tool:
| Step | Action |
| 1. Open Indexes | Log into cPanel, scroll to the Advanced section, and click Indexes. |
| 2. Select Directory | Click through the file tree to locate the directory you want to secure. |
| 3. Edit Settings | Click Edit next to the target folder. |
| 4. Disable Indexing | Select No Indexing (or Inherit if the parent folder is already set to No Indexing). |
| 5. Save | Click Save. |
Method 3: Disabling Directory Browsing in Plesk
You can disable file listings in Plesk either through domain server settings or directly via the File Manager.
Option A: Via Apache & nginx Settings
- Log into Plesk and select your domain.
- Go to the Hosting & DNS tab and click Apache & nginx Settings.
- Scroll down to Additional Apache directives.
- In the text boxes for both Additional directives for HTTP and Additional directives for HTTPS, add:
Options -Indexes - Click OK to save changes.
Option B: Via Plesk File Manager
- Go to Files & Databases > Files and open your
httpdocsorpublic_htmlfolder. - Edit your
.htaccessfile (create one if it does not exist). - Add
Options -Indexesto the top of the file and click Save.
Testing Your Changes
To confirm directory indexing is successfully disabled, open a browser window and visit a subfolder on your website that does not contain an index file (for example, https://yourdomain.co.uk/wp-content/uploads/).
If configured correctly, the browser should display a 403 Forbidden error page rather than a list of files.
If you’re still experiencing issues after following the steps above, please contact our support team and we’ll be happy to help.