Directory listing shows the full contents of a folder when there's no index file present — instead of a 404 or your homepage, visitors (and attackers) see a raw file browser of everything in that directory, including files you never intended to be individually discoverable.
Directory listing lets anyone browse your file system like a file manager — seeing every file name, backup, and configuration file in your directories.
Directory listing, when enabled, allows visitors to browse your server's actual file structure directly through their browser rather than only accessing files through your intended application logic and navigation — this exposes your genuine file organization and can reveal files never intended for direct public access or discovery.
This represents a real reconnaissance gift to anyone probing your site for vulnerabilities — directory listings can reveal backup files, configuration files, development artifacts, or other content that was never meant to be directly accessible or even known to exist, providing attackers with a map of potential additional targets beyond what your intended site navigation would ever reveal.
Many web server configurations enable this behavior by default unless explicitly disabled, meaning this vulnerability often exists simply through configuration inattention rather than any deliberate decision — verifying and correcting this default behavior across your actual server configuration closes off this unintentional information disclosure.
This check works in genuine combination with several other checks throughout this broader security work — even with directory listing properly disabled, individually exposed sensitive files discussed elsewhere, like .env files or .git directories, remain directly accessible if their specific location is known or guessed, making directory listing prevention one layer of a broader, genuinely comprehensive approach to preventing unintended file exposure.
Visiting a folder URL directly returns a 403/404 or your site's normal content, never a raw file listing.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →