---
title: "How to Disable Directory Browsing Using .htaccess"
description: "Stop Apache listing the contents of folders that have no index file by adding Options -Indexes to .htaccess, then confirm it returns 403 Forbidden."
url: "https://docs.noiz.ie/security/how-to-disable-directory-browsing-using-htaccess/"
section: "Security"
categories:
  - "Security > Best Practices"
last_reviewed: "27 July 2026, against the current Apache HTTP Server release"
---

# How to Disable Directory Browsing Using .htaccess

Directory browsing, also called directory listing or directory indexing, is the behaviour where a web server, finding no index file (such as `index.html` or `index.php`) in a folder, shows visitors an automatically generated list of every file and sub-folder it contains instead. That listing can expose backups, configuration files, scripts, and other material you never intended the public to see, which makes it a common target during reconnaissance. This guide shows you how to switch directory browsing off across your whole site with a single line in your `.htaccess` file, how to confirm it worked, and where the rule can catch you out.

**Last reviewed:** 27 July 2026, against the current Apache HTTP Server release. This guide is written for Noiz hosting and is kept current against Apache. It complements, and does not replace, the official Apache documentation linked below.

### Official Documentation Reference

- [Apache HTTP Server: the `Options` directive](https://httpd.apache.org/docs/2.4/mod/core.html#options)
- [Apache HTTP Server: `mod_autoindex` (directory indexing)](https://httpd.apache.org/docs/2.4/mod/mod_autoindex.html)
- [Apache HTTP Server: the `DirectoryIndex` directive](https://httpd.apache.org/docs/2.4/mod/mod_dir.html#directoryindex)
- [Apache HTTP Server: `.htaccess` files how-to](https://httpd.apache.org/docs/2.4/howto/htaccess.html)

## Prerequisites

- A Noiz hosting account you can sign in to, with access to your site's files through the File Manager or FTP.
- A site served by Apache. The `.htaccess` file is read only by Apache, so this method has no effect on a site served purely by Nginx. If you are unsure which applies to your account, open a support ticket and the Noiz team will confirm.
- A copy of your current `.htaccess` file, saved before you make any change. A single typo in this file can take the whole site offline with a **500 Internal Server Error**, so always have something to roll back to.

## Check Whether Directory Browsing Is Currently On

Test before you change anything, so you know whether there is a problem and can tell afterwards that the fix worked. In a browser, request a folder on your site that contains no index file, remembering the trailing slash, for example `https://yourdomain.com/uploads/`. Replace `yourdomain.com` with your own domain.

- A page headed **Index of /uploads** listing the folder's contents means directory browsing is enabled and worth switching off.
- A **403 Forbidden** response means listings are already blocked.
- A **404 Not Found** response means there is no folder at that path, so pick a different one to test.

Choose a folder that genuinely has no `index.html` or `index.php` in it. A folder that has one will always serve that file, which tells you nothing about the autoindex setting.

## Add the Rule to .htaccess

The `.htaccess` file is a plain text configuration file that Apache reads from the folder it sits in. Its name begins with a dot, which marks it as a hidden file, so you may need to enable **Show Hidden Files (dotfiles)** in your File Manager to see it. Place the rule in the `.htaccess` file at the root of your website (for example `httpdocs` or `public_html`, depending on your hosting plan) to protect every folder on the site.

1. Open your site's document root in the File Manager or over FTP.
2. Open the existing `.htaccess` file for editing. If there is no `.htaccess` file yet, create one with exactly that name, including the leading dot and with no file extension.
3. Add the following line:

```apacheconf
Options -Indexes
```

4. Save the file. The change takes effect immediately, because Apache re-reads `.htaccess` on every request. There is nothing to restart.

The minus sign in `-Indexes` is what does the work: it removes the `Indexes` option, which is the option that tells Apache to generate a listing when no index file is present. A line reading `Options +Indexes` would switch the behaviour back on, so check for that if a folder is still showing its contents.

Use the `-` prefix rather than writing a bare option list. `Options -Indexes` subtracts one option and leaves everything else the folder inherits untouched. Writing something like `Options FollowSymLinks` with no prefix replaces the entire inherited set, which can silently disable behaviour other parts of your site depend on and is awkward to diagnose weeks later.

## Confirm It Is Working

Re-request the same folder you tested earlier, for example `https://yourdomain.com/uploads/`. Where you previously saw a list of files, Apache now returns a **403 Forbidden** page, which is exactly what you want: the folder's contents are hidden while the files inside it remain reachable by their direct URLs.

If you still see the old listing, load the page in a private browsing window. Browsers and any content delivery network sitting in front of your site will happily keep serving a cached copy of the listing after the rule is in place.

## Allow Listings in One Folder Only

The rule inherits downwards, so if you deliberately want a listing in a single folder, such as a public download archive, place a separate `.htaccess` in that folder containing the opposite rule.

```apacheconf
Options +Indexes
```

Be deliberate about this. Every file that lands in that folder becomes discoverable by anyone who visits it, including files an upload script, plugin or backup job puts there without your knowledge.

## Make Sure Your Index File Is Recognised

Apache only falls back to a listing when it cannot find a file named in the `DirectoryIndex` list. On a typical hosting account that list covers `index.html` and `index.php`. If a folder's landing page is named something else, name it explicitly so the server serves it instead of returning 403.

```apacheconf
DirectoryIndex index.php index.html home.php
```

You can also give visitors a friendlier response than the default 403 page by pointing Apache at a custom error page. The path is relative to your document root, and the target page must itself be reachable.

```apacheconf
Options -Indexes
ErrorDocument 403 /403.html
```

## Good to Know

- The rule applies to the folder it sits in and every folder beneath it, so a single `.htaccess` at your document root covers the whole site. You can override it for one folder by placing a separate `.htaccess` there.
- Disabling directory browsing hides the listing, it does not protect the files themselves. Anyone who already knows or guesses a file's exact URL can still request it. Treat this as one layer of hardening, not a substitute for proper permissions on anything sensitive. If a file must never be public, move it above the document root, put it behind authentication, or delete it.
- Adding an empty `index.html` to a folder achieves a similar result for that one folder, but it is a per-folder patch you have to repeat forever and it is easy to miss a folder created later by a script. `Options -Indexes` is cleaner because it protects every existing and future folder at once and needs no upkeep.
- Listings are exactly what automated scanners look for, and what they routinely turn up is material nobody meant to publish: `backup.zip`, `db.sql`, `config.php.bak`, an old staging copy, or documents dropped into an uploads folder. None of that is protected by simply being unlinked, only by nobody knowing the file name.
- Some Noiz hosting plans already disable directory browsing at the server level. If a test folder returns **403 Forbidden** before you change anything, the protection is already active and the rule simply makes it explicit and portable, so it travels with the site if it is ever moved.

## Troubleshooting

**Symptom:** the site returns a 500 Internal Server Error as soon as you save. The most likely cause is that `Options` is not permitted in `.htaccess` for that folder, which writes an `Options not allowed here` line into the error log. Restore your backup to bring the site straight back, then open a support ticket so the override can be enabled for your account.

**Symptom:** one folder still lists its contents while the rest of the site is fine. A `.htaccess` inside that folder overrides the one above it, so check that folder for a stray `Options +Indexes` or `Options All` line.

**Symptom:** the whole site now returns 403 Forbidden. That is not caused by `Options -Indexes` on its own. Confirm your document root still contains a valid index file, and check whether another rule in `.htaccess` is denying access.

**Symptom:** nothing changes and nothing is logged. The site is most likely not served by Apache. Nginx and similar servers ignore `.htaccess` entirely and control listings in their own configuration.

## Related Guides

- [How to Protect the htaccess File](/security/how-to-protect-the-htaccess-file/)
- [How to Password Protect a Directory in cPanel](/cpanel/how-to-password-protect-a-directory-in-cpanel/)
- [How to Edit the .htaccess File in the cPanel File Manager](/cpanel/how-to-edit-the-htaccess-file-in-the-cpanel-file-manager/)

## Need a Hand?

If a folder is still listing its contents after you add the rule, or you would like Noiz to review your site's `.htaccess` hardening for you, open a support ticket from your Noiz client area and the team will assist.

---
Source: https://docs.noiz.ie/security/how-to-disable-directory-browsing-using-htaccess/