Disable Apache Directory Listing on Ubuntu 24.04

Disable directory listing

You can disable Apache directory listing for your entire server by editing the main Apache configuration file, typically located at `/etc/apache2/apache2.conf`. This global setting influences how Apache handles all websites hosted on your server. By altering the directory listing setting, you prevent Apache from showing file lists. On Ubuntu 24.04, Apache web servers have this directory listing feature enabled by default. This means visitors can see a list of files within a directory if no index file is found.

To disable it, locate the `Options` directive and remove the `Indexes` keyword. For instance, to affect all content within `/var/www/`, you’d modify the relevant block. Save the file and then restart Apache for the changes to take effect. You can always re-enable directory listing by adding `Indexes` back to the `Options` line.

Run the command below to open the global configuration file.

sudo nano /etc/apache2/apache2.conf

This block, featuring the ‘Indexes‘ option, activates directory listing for Apache’s default root directory (/var/www).

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

To disable directory listing, remove ‘Indexes‘ from the Options line.

If you want to disable directory listing for all content within the /var/www/ default directory, modify the block as shown below.

<Directory /var/www/>
        Options FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

Save and exit the file.

Restart Apache to apply your changes.

You can re-enable directory listing anytime by adding ‘Indexes‘ back.

Disable directory listing selectively

To disable Apache directory listing for just one or a few websites, you need to add specific code to each site’s individual configuration file. This method is different from changing the main server settings and gives you control over directory listings on a site-by-site basis.

Here’s a basic example of a website configuration that disables directory listing.

<VirtualHost *:80>
  ServerName banking.example.com
  ServerAdmin admin@example.com
  DocumentRoot /var/www/banking
    
  <Directory /var/www/banking/>
       Options FollowSymlinks
       AllowOverride All
       Require all granted
  </Directory>

       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

This configuration will only affect the /var/www/banking/ website within Apache’s directory structure.

That should do it!

Conclusion:

• Enabling or disabling Apache directory listing is crucial for maintaining server security.
• Disabling directory listing prevents unauthorized access to files and sensitive information within directories.
• Users without an index file will encounter a 403 Forbidden error, enhancing security.
• Configurations can be made globally or selectively for individual websites, providing flexibility.
• Always restart Apache after making changes to ensure they take effect.
• Regularly review and update your server configurations to keep security measures current.