How to Disable Directory Browsing With .htaccess (Apache, LiteSpeed and Nginx)

Updated: 8 October 2026 · Applies to: Apache 2.4 (tested on 2.4.69; defaults checked on AlmaLinux 10 and Debian 13), nginx 1.30, LiteSpeed (from LiteSpeed documentation)

To stop Apache from listing the files in a folder that has no index page, put this line in the .htaccess file of your web root (for example public_html):

Options -Indexes

It applies to that folder and every subfolder. A visitor who opens a folder without an index.html or index.php then gets 403 Forbidden instead of a file list, while every file inside still loads normally. It only works if the server allows .htaccess to change Options (see below).

Why turn it off

A directory listing shows everything in the folder: backups, .sql dumps, old copies of scripts, uploads. In our test, an Apache folder with no index file returned the full list to anyone:

$ curl -s http://127.0.0.1/files/ | grep -oE '<title>.*</title>|<li>.*</li>'
<title>Index of /files</title>
<li><a href="/"> Parent Directory</a></li>
<li><a href="backup.sql"> backup.sql</a></li>
<li><a href="readme.txt"> readme.txt</a></li>
<li><a href="sub/"> sub/</a></li>

Disable directory browsing with .htaccess

1. Open the .htaccess file in your web root. In cPanel you can use the File Manager (see edit .htaccess in the cPanel File Manager); turn on hidden files, because the name starts with a dot. If there is no .htaccess yet, create one.
2. Add Options -Indexes on its own line. Keep any existing rules (WordPress, redirects) as they are.
3. Save the file. Apache reads .htaccess on every request, so no restart is needed.
4. Test a folder that has no index file:

   curl -sI https://example.com/wp-content/uploads/ | head -1

   In our test the answer was:

   HTTP/1.1 403 Forbidden

   Subfolders also returned 403, and a file such as /files/readme.txt still returned 200.

Apache logs each blocked listing in its error log, which is a handy way to confirm the rule is working:

AH01276: Cannot serve directory /usr/local/apache2/htdocs/files/sub/: No matching DirectoryIndex (index.html) found, and server-generated directory index forbidden by Options directive

If the listing still appears, or you get a 500 error

• The listing still shows: Apache is ignoring .htaccess. Both AlmaLinux 10 (httpd 2.4.63) and Debian 13 (apache2 2.4.68) ship AllowOverride None for the web root, and with that setting our test still returned 200 with the list. On your own server, change it for the site's directory and reload Apache:

  <Directory "/var/www/html">
      AllowOverride All
  </Directory>

  AllowOverride Options=Indexes is the narrowest setting that still allows this line; we tested it and it returned 403. If you control the server, you can also simply put Options -Indexes inside that <Directory> block instead of using .htaccess. On shared hosting, ask your provider.
• 500 Internal Server Error with "Options not allowed here": AllowOverride allows some groups, such as FileInfo for rewrites, but not Options. Our error log showed /usr/local/apache2/htdocs/.htaccess: Options not allowed here. Add Options or Options=Indexes to AllowOverride.
• 500 error with "Either all Options must start with + or -": you mixed styles, for example Options -Indexes FollowSymLinks. Give every option a sign: Options -Indexes +FollowSymLinks worked in our test (403 for the folder, 200 for its files).

Allow listing for one folder only

If you want a public download folder, add this to the .htaccess inside that folder:

Options +Indexes

In our test that folder returned 200 with its list again, while its parent kept returning 403.

The index file trick

An empty index.html also hides a listing: our test returned 200 with an empty page. It only protects the folder it is in, though (the subfolder next to it still listed its files), so use it only where you cannot change .htaccess or the server configuration.

Nginx: autoindex

Nginx does not read .htaccess at all. Its listing is controlled by autoindex, which is off by default; in our nginx 1.30.5 test a folder without an index file returned 403 and the error log said directory index of "/usr/share/nginx/html/files/" is forbidden. If a site still lists files, search the configuration for autoindex on;:

grep -rn autoindex /etc/nginx/

Change it to autoindex off; (or remove it), then run nginx -t and nginx -s reload. One more point: in our test nginx served the .htaccess file itself to anyone (HTTP 200). Block such files with:

location ~ /\.ht {
    deny all;
}

After that, the same request returned 403.

LiteSpeed

According to LiteSpeed, LiteSpeed Web Server (Enterprise) accepts the Options directive in .htaccess when Options is ticked under its Allow Override setting, so the same line works there. If it has no effect on a LiteSpeed server, ask your host to check that setting. OpenLiteSpeed is different: listings are controlled by its own Auto Index setting in the WebAdmin console, which is off by default.

cPanel without editing files

In cPanel, Advanced › Indexes lets you pick a folder and choose No Indexing; according to cPanel, the server then no longer lists the folder and visitors see a forbidden message. Step by step: disable directory listing in cPanel. More about the directives: Options, IndexOptions and DirectoryIndex with .htaccess, protect your .htaccess file and fix 403 error messages.

Official documentation: Apache Options directive · nginx autoindex module