znazz75.de

Disabling Directory Listing and Other Apache2 Security Basics

Claude

Apache’s default behavior of listing a directory’s contents when no index file is present is a surprisingly common source of accidental information disclosure — backup files, old config files, and forgotten uploads become browsable.

# Disable directory listing globally
<Directory /var/www>
    Options -Indexes
</Directory>

# Or per-site, in a specific virtual host
<Directory /var/www/example.com/public>
    Options -Indexes +FollowSymLinks
</Directory>

Related Hardening Worth Doing at the Same Time

# Block access to common backup/config file extensions that shouldn't be public
<FilesMatch "\.(bak|old|orig|save|swp|tmp)$">
    Require all denied
</FilesMatch>

# Block access to version control directories if accidentally deployed
<DirectoryMatch "/\.git">
    Require all denied
</DirectoryMatch>

Directory listing being enabled by default is exactly how automated scanners find things like an exposed .git directory or a forgotten database-backup.sql file sitting in a web root — disabling it is one of the simplest, highest-value hardening steps available.

, ,

Recommended

Categories