If a folder on your website has no index file (such as index.php or index.html), the server may show visitors a list of every file in it. That can give away backups, uploads or configuration files. This article shows how to turn directory listing off and how to block access to sensitive files such as .htaccess.
Turn off directory listing in cPanel
- Log in to cPanel and open Advanced › Indexes.
- Browse to the folder you want to change, usually
public_html, and click Edit. - Choose No Indexing and click Save.
The setting applies to that folder and the folders inside it.
Turn it off with .htaccess
Alternatively, add this line to the .htaccess file in public_html (see editing .htaccess in cPanel):
Options -Indexes
Visitors to a folder without an index file now get a 403 Forbidden error instead of a file list.
Protect .htaccess and other sensitive files
The server normally refuses requests for files beginning with .ht. You can add your own rule to make sure, and to cover other files that should never be downloaded. Add this to .htaccess:
<FilesMatch "^\.ht">Require all denied</FilesMatch>
To block a specific file, such as WordPress's wp-config.php or an .env file:
<Files "wp-config.php">Require all denied</Files>
This only stops web browsers fetching the file, so your site's own code can still read it as normal. Older guides use Order allow,deny and Deny from all. That's outdated Apache 2.2 syntax, so use Require all denied instead.
Good to know
- Back up
.htaccessbefore editing it. If your site shows a 500 Internal Server Error afterwards, there's a typo. Restore the backup or remove the lines you added. - For redirects and other rules, see using .htaccess for redirects and friendly URLs.
