Directory listing disabledWhat it checks and how to fix it

What it checks

Requests twelve common directory paths (/images/, /uploads/, /assets/, /files/, /static/, /backup/, /tmp/ and similar) and looks at the response body for an auto-generated index ("Index of /", "Parent Directory", "Directory listing for"). Any listing found fails; none found passes.

Why it matters

An auto-generated directory index shows every file in the folder, including ones never linked from the site: backups, exports, old uploads, private documents. Attackers and scrapers look for these listings specifically because they map out exactly what is there to download.

How to fix it

Turn off automatic indexes on the web server. Folders that should not be browsable then return 403 or 404.

nginx (off is the default; make sure nothing turns it on)

location / {
    autoindex off;
}

Apache (.htaccess or the vhost)

Options -Indexes

Cloudflare: listings come from your origin, so fix them there. Until then, a WAF custom rule can block requests whose path ends in / under the affected folders.

Rails: Rails does not generate listings. If one appears, it comes from the server in front of the app (nginx/Apache serving public/) or from a storage bucket; disable it there. For S3, turn off public ListBucket access.

Also remove anything from those folders that should never have been public.