If visitors can browse a list of files in your directories by going to a URL like yourdomain.com/images/, directory indexing is enabled. This is a security risk because it exposes your file structure. Here is how to disable it.
Add one line to .htaccess
Add this line to your .htaccess file in public_html:
Options -Indexes
This tells Apache to return a 403 Forbidden error instead of showing a file listing when no index file exists in a directory.
01. Disable via .htaccess
Open or create the .htaccess file in your public_html directory and add:
Options -IndexesThis applies to all subdirectories as well. If a directory does not contain an index.html or index.php file, visitors will see a 403 error instead of a file listing.
02. Disable via cPanel
- Log into cPanel at my.ultrawebhosting.com
- Go to Advanced > Indexes
- Navigate to the directory you want to protect
- Select "No Indexing"
- Click Save
03. Why This Matters
When directory indexing is enabled, anyone can see the names and sizes of all files in that directory. This can expose backup files, configuration files, uploaded documents, or other content that should not be publicly visible. It also gives attackers a map of your file structure.
As an extra precaution, place an empty index.html file in any directory that should not be browsable (like /uploads/ or /includes/). Even if someone removes the Options -Indexes directive, the empty index file will show a blank page instead of a file listing.
For more on securing your .htaccess configuration, see the Complete Guide to .htaccess.
Need Help Securing Your Site?
Our support team can review your site's security configuration and help lock down exposed directories.
Open a Support TicketQuick Recap
- Add
Options -Indexesto .htaccess - Disables file listings - Or use cPanel > Advanced > Indexes
- Applies to all subdirectories below the .htaccess file
- Visitors see 403 Forbidden instead of a file list
- Place empty index.html files in sensitive directories as an extra layer
Securing your website directories · Last updated March 2026 · Browse all General articles
