Apache Disable Directory Index

Enabling Apache Directory Index exposes a security vulnerability wherein accessing a URL lacking an index file reveals a directory listing of all files within. This presents a risk as it allows hackers to view the entire directory structure, compromising security. To prevent directory listings from being displayed, you can employ a couple of methods. One approach is to generate a file named either index.html or index.php, depending on the file name specified in the Apache DirectoryIndex directive, and leave it empty. Alternatively, you can disable directory indexing for the website within the Apache virtual host configuration. To do this, within the virtual host configuration file,

Options -Indexes

Here is an example apache configuration file

<VirtualHost *:80>
ServerName fleetfoundation.com
ServerAlias www.fleetfoundation.com
ServerAdmin example@fleetfoundation.com
DocumentRoot /home/fleetfoundation.com/html
CustomLog ${APACHE_LOG_DIR}/fleetfoundation.com.log combined
ErrorLog ${APACHE_LOG_DIR}/fleetfoundation.com-error.log
<Directory "/home/fleetfoundation.com/html">
Options All -Indexes
AllowOverride All
Require all granted
Order allow,deny
allow from all
</Directory>
</VirtualHost>

Method 2:

The generation of directory listings is facilitated by the Apache module known as mod_autoindex. To prevent the generation of directory listings, you can deactivate this module. For Ubuntu/Debian systems:

a2dismod autoindex -f
systemctl restart apache2

https://fleetfoundation.com/2024/02/25/apache-disable-directory-index/