Folder contents are publicly listed

SeverityMedium

ScopeWhole site

EffortSmall

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_directory_listing

Short answer

At least one folder your pages load files from returns an automatic Index of / page instead of an error. Turn directory listing off on the server (Apache: Options -Indexes; Nginx: remove autoindex on) or put an empty index.html in the folder.

Why it matters

A listing shows every file in the folder, not just the ones your pages link to: old exports, private PDFs in an uploads folder, backup copies, or the exact version files of plugins and themes. Bots that look for leaked documents or vulnerable components crawl these pages routinely, and one listing usually leads to the next folder down.

Search engines can index listing pages too. They are thin, auto-generated pages, and they can surface files you never meant to publish in search results.

How Glimana detects it

Glimana collects the folders of files (scripts, styles, images) that your home page and two sample pages load from your own host, keeping folders at least two levels deep such as /wp-content/uploads/. It requests up to three of these folders; a folder counts as listed when it returns 200 and its title or heading starts with Index of /, the format used by Apache, Nginx and LiteSpeed. One listed folder is enough for a medium problem, and the evidence names the folders. If your pages load no such files from your own host, the check is Not applicable.

How to fix it

Watch out

On Apache, Options -Indexes in .htaccess only works if the server allows it (AllowOverride Options or All); otherwise the whole site answers with a 500 error. Test the home page right after saving. An empty index.html protects only that one folder, not its subfolders.

Find the finding in Glimana. Open Security; this check is in the Exposed files group, with the evidence from the last scan under its title. The same problem is listed under Issues › Folder contents are publicly listed.
Apply the fix on your platform.

Apache / LiteSpeedNginxcPanel / managed hosting

Add Options -Indexes to the .htaccess file in the site root (WordPress sites already have one), or put it inside the site's <Directory> block in the server configuration and reload Apache. Listed folders then return 403.

Directory listing is off by default in Nginx. Search the configuration for autoindex on; (grep -rn autoindex /etc/nginx/), remove it or change it to autoindex off;, then run nginx -t && systemctl reload nginx.

In cPanel open Advanced › Indexes, select the site folder and choose No Indexing. Other panels have a similar "directory browsing" switch; if yours does not, ask the host to disable directory listing for your account.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

After the fix, press Re-scan on the Security page (or wait for the weekly Sunday 04:00 scan); the problem closes when the check passes.