Problem: Unwanted Directory Listing
Directory listing can show sensitive information and create security risks. When a web server shows the contents of a directory, it may reveal files and folder structures that should be hidden from public view.
Solution: Using .htaccess to Deny Directory Listing
Creating a .htaccess File
To stop directory listing, you can make a .htaccess file in the /public_html/Davood/ folder. The .htaccess file is a setup file for Apache web servers. It lets you change the server setup for each directory.
To make the file:
- Access your server using FTP or file manager
- Go to the /public_html/Davood/ directory
- Make a new file named ".htaccess" (with the dot)
Name the file exactly as ".htaccess" without any file ending.
Tip: Hidden File Visibility
Some systems hide files starting with a dot by default. If you can't see the .htaccess file after creating it, you may need to enable 'Show Hidden Files' in your file manager or FTP client settings.
Adding the Directive to Deny Directory Listing
After you've made the .htaccess file, add this line to it:
Options -IndexesThis command tells Apache to turn off directory listing for the current directory and its subdirectories. The "-Indexes" option removes Apache's ability to make a directory listing when there's no index file (like index.html or index.php) in a directory.
Applying the Rule to Subfolders
The rules in a .htaccess file apply to its directory and all subdirectories. This means putting the .htaccess file in /public_html/Davood/ will protect all folders within Davood, including Test1, Test1/Test, Test2, and any other subfolders.
This passing down of rules makes it easy to protect many directories with one .htaccess file. You don't need to make separate .htaccess files for each subfolder.
To protect all subdirectories:
- Put the .htaccess file in the top directory you want to protect (/public_html/Davood/ in this case)
- Include the "Options -Indexes" directive in the file
- Save the file
This setup will stop directory listing for /public_html/Davood/ and all its subfolders, giving a simple fix to the problem.
Example: Overriding .htaccess Rules
If you want to allow directory listing for a specific subfolder while keeping it disabled for others, you can create another .htaccess file in that subfolder with the following content:
Options +IndexesThis will override the parent directory's setting and enable directory listing for this specific subfolder.
Verifying the Directory Listing Prevention
After setting up the .htaccess file to prevent directory listing, check if the configuration works correctly. Here's how to test and what to expect:
Testing the configuration:
-
Open a web browser and enter the URL of a directory without an index file. Example: http://yourdomain.com/Davood/Test1/
-
Access different subdirectories to make sure the rule applies to all of them.
-
Test from a different device or network to confirm the changes are not just cached on your local machine.
Tip: Use Incognito Mode
When testing your directory listing prevention, use your browser's incognito or private browsing mode. This helps avoid cached content and provides a more accurate test of your server's response.
Expected behavior when accessing directories:
-
Instead of seeing a list of files and folders, you should get a "403 Forbidden" error or a similar message.
-
The error message may vary depending on your server configuration, but it should indicate that access is not allowed.
-
If you have a custom error page set up, it might show instead of the default error message.
-
Accessing files directly by their full URL should still work, if the user has the correct permissions.
If you still see directory listings after setting up the .htaccess file, try these steps:
-
Check if the .htaccess file is in the correct location (/public_html/Davood/).
-
Make sure the file permissions allow the web server to read the .htaccess file.
-
Confirm that your Apache configuration allows .htaccess files to override settings (AllowOverride directive).
-
Clear your browser cache and try again.
By following these steps, you can confirm that your directory listing prevention is working as intended, adding security to your web server.
