If visitors can browse a list of files in your directories by going to a URL like yourdomain.com/images/, directory indexing is enabled. This is a security risk because it exposes your file structure. Here is how to disable it.
Add one line to .htaccess
Add this line to your .htaccess file in public_html:
Options -Indexes
This tells Apache to return a 403 Forbidden error instead of showing a file listing when no index file exists in a directory.
01. Disable via .htaccess
Open or create the .htaccess file in your public_html directory and add:
Options -IndexesThis applies to all subdirectories as well. If a directory does not contain an index.html or index.php file, visitors will see a 403 error instead of a file listing.
02. Disable via cPanel
- Log into cPanel at my.ultrawebhosting.com
- Go to Advanced > Indexes
- Navigate to the directory you want to protect
- Select "No Indexing"
- Click Save
03. Why This Matters
When directory indexing is enabled, anyone can see the names and sizes of all files in that directory. This can expose backup files, configuration files, uploaded documents, or other content that should not be publicly visible. It also gives attackers a map of your file structure.
As an extra precaution, place an empty index.html file in any directory that should not be browsable (like /uploads/ or /includes/). Even if someone removes the Options -Indexes directive, the empty index file will show a blank page instead of a file listing.
For more on securing your .htaccess configuration, see the Complete Guide to .htaccess.
Need Help Securing Your Site?
Our support team can review your site's security configuration and help lock down exposed directories.
Open a Support TicketFrequently Asked Questions
What is directory indexing and why turn it off?
Directory indexing is when visiting a folder with no index file (like yourdomain.com/images/) shows a browsable list of its files. It exposes your file structure, which is a security and privacy risk, so it is best disabled.
How do I disable directory indexing?
Add Options -Indexes to the .htaccess file in your document root, which turns off the file listing for the whole site. Visitors then get a 403 instead of a browsable list when there is no index file in a folder.
How do I turn off directory browsing in cPanel?
cPanel's Indexes tool lets you set the indexing behavior per directory without editing .htaccess: choose No Indexing for the folders you want to protect. This writes the equivalent configuration for you.
What happens to a folder with no index file after I disable indexing?
Visiting it returns a 403 Forbidden instead of listing the files, which is the secure behavior. If you want a folder to show something, add an index.html or index.php to it rather than leaving indexing on.
Quick Recap
- Add
Options -Indexesto .htaccess - Disables file listings - Or use cPanel > Advanced > Indexes
- Applies to all subdirectories below the .htaccess file
- Visitors see 403 Forbidden instead of a file list
- Place empty index.html files in sensitive directories as an extra layer
Securing your website directories · Last updated November 2026 · Browse all General articles
