Disable Apache Directory Listing on Ubuntu 24.04
You disable Apache directory listing on Ubuntu 24.04 by editing Apache’s configuration files to prevent it from automatically generating file indexes.
Apache directory listing, often called ‘autoindexing,’ is a feature that displays the contents of a directory on your web server if no default index file (like index.html) exists. Disabling this enhances security by hiding your file structure from potential unauthorized access.
For example, if you are running Apache version 2.4.58 on Ubuntu 24.04, modifying the `Options` directive to `-Indexes` is the core step.
This change ensures that visitors see a “403 Forbidden” error instead of a file listing, effectively preventing them from browsing your server’s directories for sensitive information.
Edit your Apache configuration file, like `apache2.conf` or a virtual host file, and change `Options Indexes` to `Options -Indexes`. Save the file and restart Apache for the changes to take effect. This prevents Apache from automatically generating directory listings.
Disable directory listing
You’ll find Apache’s global configuration file at this path: /etc/apache2/apache2.conf.
Inside this file, there’s a section that handles directory listing, which is enabled by default.
Run the command below to open the global configuration file.
sudo nano /etc/apache2/apache2.conf
This block, featuring the ‘Indexes‘ option, activates directory listing for Apache’s default root directory (/var/www).
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>
To disable directory listing, remove ‘Indexes‘ from the Options line.
If you want to disable directory listing for all content within the /var/www/ default directory, modify the block as shown below.
<Directory /var/www/>
Options FollowSymLinks
AllowOverride None
Require all granted
</Directory>
Save and exit the file.
Restart Apache to apply your changes.
You can re-enable directory listing anytime by adding ‘Indexes‘ back.
Disable directory listing selectively
If you’d prefer not to alter Apache’s global configuration file, you can disable directory listing selectively for individual websites.
Here’s a basic example of a website configuration that disables directory listing.
<VirtualHost *:80>
ServerName banking.example.com
ServerAdmin admin@example.com
DocumentRoot /var/www/banking
<Directory /var/www/banking/>
Options FollowSymlinks
AllowOverride All
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
This configuration will only affect the /var/www/banking/ website within Apache’s directory structure.
That should do it!
Conclusion:
- Enabling or disabling Apache directory listing is crucial for maintaining server security.
- Disabling directory listing prevents unauthorized access to files and sensitive information within directories.
- Users without an index file will encounter a 403 Forbidden error, enhancing security.
- Configurations can be made globally or selectively for individual websites, providing flexibility.
- Always restart Apache after making changes to ensure they take effect.
- Regularly review and update your server configurations to keep security measures current.
Was this guide helpful?
50% of readers found this helpful (2 votes)
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!