Disable Nginx Directory Listing on Ubuntu 24.04

Disable directory listing

To disable directory listing across your entire Ubuntu 24.04 server, edit the main configuration file at /etc/nginx/nginx.conf. Add the line autoindex off; inside the http block. Nginx then stops showing your folders to the public whenever an index page is missing.

This is the quickest fix if you host several sites and none of them should ever show a file list. Any site that sets its own autoindex value will override it. You will see how to do that in the per-site section further down.

First, check whether a line in the Nginx configuration file already controls directory listing. Nginx’s own default for autoindex is off, so a folder only shows a file list when someone has set autoindex on; somewhere in the configuration, either globally or for one site. If you see a listing in your browser, look for that line.

1. Open a terminal on your Ubuntu server.
2. Run the command below to open the global configuration file in a text editor. You need an account with administrator (sudo) rights to save changes to this file.

sudo nano /etc/nginx/nginx.conf

Scroll down to the http {} block. The ‘autoindex‘ option inside it enables or disables directory listing in Nginx globally. Settings in this block apply to every website on the server unless a site overrides them.

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        autoindex on;

....
}

Having the 'autoindex on;' line in the configuration enables directory listing globally. If you want listings on, add the line. If you want them off, remove it or change it to off, as shown next.

If you want to disable directory listing for all content in Nginx, change the block above to the one below. Keep the new line inside the http block, and don't leave a second autoindex line in the same block that contradicts it.

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        autoindex off;

....
}

Nothing changes on the live server yet, because Nginx only reads its configuration when it starts or reloads.

If Nginx fails to start, you most likely made a typo in the file, such as a missing semicolon at the end of the line. Reopen the file and check it. After the restart, open a folder on your site that has no index file. You should now see a 403 Forbidden page instead of a file list.

To undo the change, add the 'autoindex on;' line back, or change off to on, and restart Nginx again to re-enable directory listing. Only do this for folders that are meant to be public, such as a download area.

Disable directory listing selectively

You can disable directory listing for a single website without affecting your other projects. Edit that site's configuration file in /etc/nginx/sites-available/. Open the file, add autoindex off; inside the server block, then reload the web server so the change takes effect. Your files stay hidden for that domain only.

This also works as an override. If the global setting allows listings, a site-level autoindex off; still blocks them for that site. The reverse is true too. A more specific block, such as a server block, wins over the http block.

For example, here is a basic configuration for a website that disables directory listing. Compare it with your own site file and add the autoindex line in the same place.

server {
        listen 80 default_server;
        listen [::]:80 default_server;
        root /var/www/html;
        index index.html index.htm index.nginx-debian.html;
        server_name _;
        
location / {
        autoindex off;
        try_files $uri $uri/ =404;
        }
}

This configuration only affects the /var/www/html/ website in Nginx's directory. Other sites on the server keep whatever setting they already had. As with the global change, the site must be enabled and Nginx must be reloaded or restarted before you see any difference.

That should do it! Your folders without an index page no longer show their contents.

Conclusion:

• Enabling directory listing allows users to see directory contents, which may be useful for public access.
• Disabling directory listing enhances security by preventing unauthorized exploration of files.
• The global setting in Nginx can easily be adjusted in the nginx.conf file.
• Selective configuration in individual website files provides flexibility in managing directory listing.
• Always remember to restart Nginx after making changes to apply the new settings.