Português
English
You open an address on your site and instead of a page you get a plain list of files, with names, sizes and dates. That is the server telling you this folder has no home page, and showing what is inside rather than showing nothing.
If you have landed on that listing because a domain has just been pointed here, read seeing the site before the domain points here first, which covers the same screen for a different reason. This article is about the setting itself, and about why it is a security problem more often than people think.
The rule, in two lines
When somebody asks for a folder of your site, the server looks inside it for a home page file. If it finds one, it shows the page. If it does not, it has to choose between two things: show the file listing, or refuse. The tool that makes that choice is called Indexes and it is under Advanced in cPanel.
The choice is made folder by folder, and what you set on a folder also applies to the folders inside it, until one of them says otherwise.
| A folder with listing on is a public menu. Old invoices, backups, unpublished photographs, a client’s files: if they sit in a website folder with no home page, anybody who guesses the folder name sees the whole list and downloads what they like. And search engines index those listings, which means nobody even has to guess. Go and check the folders where you keep files, today. |
What to do in each case
| Situation | What to do |
| An ordinary site folder holding content that ought to have a page | Put the home page there. That is the real cure: there is no listing because there is no longer a reason for one. |
| An application’s internal folders, holding images, stylesheets and code | Turn the listing off. A visitor never needs to read those names, and somebody hunting for weaknesses very much does. |
| A folder holding private files | Turning the listing off is not enough. See the warning below. |
| A downloads folder you genuinely want people to browse | Leave it on, and treat it as public, because it is. |
| Turning the listing off is not privacy. The file is still there and still opens for anybody who knows its full name. All you removed is the index that made it easy. For real privacy there are two options, and both are better: put a password in front of the folder with the Directory Privacy tool in the files section, or move the files out of the public website folder and serve them from code, only to people who have signed in. |
What the visitor sees once it is off
The listing goes away and a refusal takes its place, in the style of the server’s error pages. That is normal and it is what you asked for, but it is ugly, and there are two ways to make it less so.
|
|
If the refusal turns up where it should not, that is a different matter, written up in Error 403 Forbidden and in website errors explained.
| Do the round once. Walk through the folders of your site that have no home page and look at each one the way a stranger would. It takes twenty minutes, you do it once, and it is one of the few security checks anybody can run without knowing anything technical. |
This setting is written into a configuration file inside the folder. If you would rather edit that directly you can, but the tool does the same job with fewer chances of a mistake, which is why it is the one we point people at.
|
Found a folder showing what it should not? We will help you close it and work out who has been there. Open a support ticket |
|
SEE ALSO |
RECOMMENDED PRODUCT Web hosting with cPanel Domain and SSL included, daily backups and the panel you already know. from $10.00/mo See plans |
- 0 Users Found This Useful
