Disable Apache Directory Listing on Ubuntu 24.04

Disable directory listing

To disable Apache directory listing across your entire Ubuntu 24.04 server, open the main configuration file at /etc/apache2/apache2.conf in a text editor. Find the main directory block and remove the word Indexes from the options line. Visitors will no longer see a list of your files when a folder has no index page.

Changes here apply to every site on the server that doesn’t set its own options.

In short, the fix removes the Indexes keyword from the Options directive. To secure content under /var/www/, you change the configuration block, save the file and restart the 🔄 service. To undo it later, add Indexes back to the Options line.

1. Run the command below in a terminal to open the global configuration file.

The file opens in a text editor. On Ubuntu this is usually nano. The file is long, so you will need to scroll down to find the directory blocks.

2. Scroll down until you find the block shown below. It sits among several similar blocks, so check that the path matches.

sudo nano /etc/apache2/apache2.conf

This block, featuring the 'Indexes' option, activates directory listing for Apache's default root directory (/var/www). Any folder under that path without an index file will show its contents in a browser.

3. Find the Options line inside that block, as in the example below.

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

4. Delete the word 'Indexes' from the Options line. Leave the other options on the line as they are.

Restricting directory listing for all content within the /var/www/ default directory requires modifying the block as shown below. Compare your file with the example before you save.

<Directory /var/www/>
        Options FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

5. Save the file and exit the editor. In nano, press Ctrl+O, then Enter to confirm the file name, then Ctrl+X to exit.

6. Restart Apache with the command below so it reads the new configuration. Apache keeps using the old settings until you restart it.

You should now see 403 Forbidden instead of a file list. If you still see the list, clear your browser cache and check whether a site-specific configuration or an .htaccess file turns Indexes back on for that folder. Those settings override the global one.

You can re-enable directory listing at any time. Add 'Indexes' back to the Options line, save the file and restart Apache again.

Disable directory listing selectively

To disable Apache directory listing for just one website instead of the whole server, add a custom block inside that site's own configuration file (its virtual host file). This lets you turn off file browsing for a single domain while keeping default settings for everything else on your Ubuntu 24.04 machine. It is useful when other sites on the same server need listings, or when you cannot or don't want to edit the global file.

Review this example of a website configuration implementing the restriction. Open your own site's configuration file with sudo, add a block like this inside the virtual host, then save the file and restart Apache as you did above.

<VirtualHost *:80>
  ServerName banking.example.com
  ServerAdmin admin@example.com
  DocumentRoot /var/www/banking
    
  <Directory /var/www/banking/>
       Options FollowSymlinks
       AllowOverride All
       Require all granted
  </Directory>

       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

This configuration restricts behavior specifically for the /var/www/banking/ website within the broader Apache directory structure. Change the path to match your own site's document root. Other sites are left alone.

The server is now secured against directory browsing. A folder without an index file returns a 403 Forbidden error. Check each site you host, because one site that sets its own options can still show listings.

Keeping your server secure means managing directory listing deliberately. The main points are below.

• Enabling or disabling Apache directory listing is crucial for maintaining server security.
• Disabling directory listing prevents unauthorized access to files and sensitive information within directories.
• Users without an index file will encounter a 403 Forbidden error, enhancing security.
• Configurations can be made globally or selectively for individual websites, providing flexibility.
• Always restart Apache after making changes to ensure they take effect.
• Regularly review and update your server configurations to keep security measures current.