Your Website Folders Are Open to Anyone Who Looks. Here Is How to Check in 2 Minutes.

AI-generated image

A directory listing is like an unlocked file cabinet on your website. When directory indexing is enabled, visitors may be able to open a folder URL and see a list of the files inside.

That can expose backup files, test pages, exports, or uploaded documents. In some cases, sensitive information such as credentials or API keys may be sitting in a publicly reachable file.

Here’s how to check your site, what to do if you find a listing, and how to reduce the risk without writing code.

What directory listing exposure looks like

Try visiting a folder path on your own website, such as:

• https://example.com/wp-content/uploads/
• https://example.com/assets/

Replace example.com with your domain. You might see a normal page, an access-denied message, or a simple list of filenames. That plain list is a directory listing.

A folder URL returning an error does not prove every file is private. Someone may still be able to open a file directly if they know its URL. Disabling listings prevents the server from displaying the file cabinet contents. It does not secure sensitive files that remain publicly accessible.

AI-generated image

Check your site in about two minutes

1. Visit a folder URL directly. Test a few relevant paths, such as /assets/ or /wp-content/uploads/. Only check sites you own or have permission to assess.

2. Search Google for indexed folder pages. Try site:example.com and, if relevant, a query such as site:example.com inurl:uploads. Search results can help you spot publicly indexed URLs, but they are not a complete security test. A file can be publicly accessible even when Google has not indexed it.

3. Look at what the browser shows. A page listing filenames, file sizes, and modification dates is a sign that directory indexing may be enabled. A normal page, 403, or 404 is not a listing. Still, check that sensitive files themselves cannot be opened directly.

Google’s Search Central documentation on robots.txt explains that robots.txt controls crawling, not access permissions. Do not use it to protect private files.

Fix it without a developer

1. Turn off directory indexing. Look in your hosting control panel for a directory browsing, directory indexing, or auto-index setting. The setting’s name and location vary by host.

If you use Apache and can edit .htaccess, add:

Options -Indexes

The MDN Apache configuration guide explains how .htaccess can configure Apache behavior. If you are unsure whether your host supports this setting, ask its support team before changing server configuration.

Many modern hosts and static-site platforms, including Netlify and Vercel, do not serve directory listings by default. Verify your deployed site rather than assuming a default applies to every configuration.

2. Remove sensitive files from public folders. Move backups, exports, private documents, configuration files, and credentials off the web server or into storage that requires authentication. If you find a password, token, or API key, remove the exposed copy and rotate the credential. Turning off listings alone does not make a directly accessible file safe.

AI-generated image

3. Clean up indexed URLs. After fixing the server and removing the files, use the Search Console Removals tool if you need Google to hide an indexed listing quickly. Removals are temporary, so they do not replace fixing or deleting the underlying content. Google’s Search Console documentation explains how to monitor your site and inspect URLs.

4. Recheck. Visit the same folder paths again and try opening any sensitive file URLs you identified. Confirm that listings are gone and private files are no longer publicly reachable. Search Google again later to see whether outdated results remain.

Wrong approach vs. better approach

❌ Wrong approach	✅ Better approach
Assume a folder is private because it is hard to guess	Test folder URLs and check direct file access
Add sensitive files to robots.txt	Remove them from public access or require authentication
Disable listings but leave credentials in the folder	Remove the files and rotate exposed credentials
Submit a removal request and stop there	Fix the server first, then request removal and verify

Why this matters for SEO and security

SEO: A directory listing can become a crawlable URL. It may expose thin, automatically generated pages or files that should not appear in search results. Google indexing is not guaranteed, but public availability can make unwanted URLs discoverable. Review what is accessible instead of relying on search results as your only test.

Security: Exposed filenames can give scanners and attackers clues about your site’s structure. A discoverable backup, export, or configuration file may reveal much more. Treat directory listing exposure as an information disclosure issue, and check for sensitive files even after the listing is disabled.

FAQ

Does a directory listing mean my website has been hacked?

No. It means the server may be showing a folder’s contents to visitors. However, exposed files can reveal useful information, so investigate and remove anything sensitive.

Will robots.txt hide files from everyone?

No. It is a crawl instruction for cooperating search engines, not an access-control system. A URL can still be visited directly.

Is Options -Indexes enough?

It can stop Apache from generating directory listings in the relevant configuration context. It does not prevent direct access to files. Remove or protect sensitive files separately.

What should I do if Google already indexed a listing?

Fix the exposure, remove or protect any sensitive files, then request temporary hiding through Search Console if needed. Recheck the URL and search results afterward.

Check your site before the next launch

A quick website SEO audit can help identify crawl and page issues, but security checks matter too. Run the free Smart Analytics SEO and AEO analysis. There is no login or email requirement, and the full report is free and yours to keep.

Then run the separate free Vulnerability Check. Findings stay private in the downloadable PDF.

For practical setup tasks, visit the Free Tools page, including the Meta Tag Generator, Schema Markup Generator, Robots.txt Generator, llms.txt Generator, and Search Console Regex Library.