Disable Apache Directory Listing on Ubuntu 24.04
You disable Apache directory listing on Ubuntu 24.04 by modifying the Apache configuration files, specifically by setting `Options -Indexes` within your virtual host or directory configuration.
Apache directory listing, often referred to as ‘autoindexing’, automatically generates a browsable HTML page displaying the contents of a web server directory when no index file (like index.html) is present. Disabling this feature enhances your server’s security by preventing unauthorized users from easily discovering and accessing files within your directories.
When enabled, visitors see a file list; when disabled, they receive a 403 Forbidden error. This prevents attackers from freely exploring your server’s structure for potentially vulnerable files or sensitive information.
Disable directory listing
Apache global configuration file is located at this path: /etc/apache2/apache2.conf.
You will find a section in this file dealing with directory listing. Directory listing is enabled by default.
Run the command below to open the global configuration file.
sudo nano /etc/apache2/apache2.conf
This block with the ‘Indexes‘ option enables directory listing in Apache’s default root directory (/var/www).
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>
Remove the ‘Indexe‘ from the Options line to disable the directory listing.
If you want to disable directory listing for all content in the /var/www/ default directory, change the block above to the one below.
<Directory /var/www/>
Options FollowSymLinks
AllowOverride None
Require all granted
</Directory>
Save the exit the file.
Restart Apache to apply your changes.
Add the ‘Indexes‘ to re-enable the directory listing if you wish.
Disable directory listing selectively
If you do not want to change Apache’s global configuration file, you can selectively disable directory listing in individual website configuration files.
For example, here’s a basic configuration for a website that disables directory listing.
<VirtualHost *:80>
ServerName banking.example.com
ServerAdmin admin@example.com
DocumentRoot /var/www/banking
<Directory /var/www/banking/>
Options FollowSymlinks
AllowOverride All
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
This configuration only impacts the /var/www/banking/ website in Apache’s directory.
That should do it!
Conclusion:
- Enabling or disabling Apache directory listing is crucial for maintaining server security.
- Disabling directory listing prevents unauthorized access to files and sensitive information within directories.
- Users without an index file will encounter a 403 Forbidden error, enhancing security.
- Configurations can be made globally or selectively for individual websites, providing flexibility.
- Always restart Apache after making changes to ensure they take effect.
- Regularly review and update your server configurations to keep security measures current.
Frequently Asked Questions
How do I disable Apache directory listing on Ubuntu 24.04?
What happens when I disable directory listing in Apache?
Can I disable directory listing for specific websites in Apache?
Why is it important to disable directory listing on my server?
How do I re-enable directory listing in Apache if needed?
Was this guide helpful?
50% of readers found this helpful (2 votes)
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!