Disable Apache Directory Listing on Ubuntu 24.04

Disable directory listing

To disable Apache directory listing across your entire Ubuntu 24.04 server, open the main configuration file at /etc/apache2/apache2.conf in a text editor. Find the main directory block and remove the word Indexes from the options line. This stops visitors from seeing a list of your files when a webpage is missing.

Modifying the relevant block removes the `Indexes` keyword from the `Options` directive. Securing content within `/var/www/` requires changing the configuration block, saving the file, and restarting the service. Reverting this change involves adding `Indexes` back to the `Options` line.

Run the command below to open the global configuration file.

sudo nano /etc/apache2/apache2.conf

This block, featuring the ‘Indexes‘ option, activates directory listing for Apache’s default root directory (/var/www).

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

Restricting directory listing for all content within the /var/www/ default directory requires modifying the block as shown below.

<Directory /var/www/>
        Options FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

Save and exit the file.

Restart Apache to apply the new configuration.

Re-enabling directory listing happens at any time by adding 'Indexes' back into the configuration.

Disable directory listing selectively

To disable Apache directory listing for just one specific website instead of the whole server, add a custom block inside that site's individual configuration file. This lets you turn off file browsing for a single domain while keeping default settings for everything else on your Ubuntu 24.04 machine.

Review this example of a website configuration implementing the restriction.

<VirtualHost *:80>
  ServerName banking.example.com
  ServerAdmin admin@example.com
  DocumentRoot /var/www/banking
    
  <Directory /var/www/banking/>
       Options FollowSymlinks
       AllowOverride All
       Require all granted
  </Directory>

       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

This configuration restricts behavior specifically for the /var/www/banking/ website within the broader Apache directory structure.

The server is now fully secured.

Keeping your server secure requires managing directory listing correctly.

• Enabling or disabling Apache directory listing is crucial for maintaining server security.
• Disabling directory listing prevents unauthorized access to files and sensitive information within directories.
• Users without an index file will encounter a 403 Forbidden error, enhancing security.
• Configurations can be made globally or selectively for individual websites, providing flexibility.
• Always restart Apache after making changes to ensure they take effect.
• Regularly review and update your server configurations to keep security measures current.