Securing Your Website: A Step-by-Step Guide to Disabling Directory Browsing on Apache

Apache is one of the most widely used web servers in the world, providing a reliable and secure platform for hosting websites and applications. By default, Apache allows directory browsing, which means that if there is no index file in a directory, Apache will display a list of all the files and directories within it. However, in many cases, it is preferable to disable directory browsing to enhance the security of your website and prevent unauthorized access to your files.

Example of folder view:

In this article, we will guide you through the steps to disable directory browsing on Apache.

Step 1: Access the Apache Configuration File: The Apache configuration file, commonly named “httpd.conf,” contains all the settings and directives for your Apache server. Locate this file on your server, which is typically found in the Apache installation directory or in the /etc/httpd/ or /etc/apache2/ directory. Make sure you have the necessary permissions to modify the file.

Step 2: Find the Directory Options Directive: Within the Apache configuration file, search for the <Directory> directive that corresponds to the directory or directories for which you want to disable browsing. This directive sets the options for a particular directory or a directory hierarchy.

Step 3: Disable Directory Browsing: To disable directory browsing, you need to modify the options within the <Directory> directive. Look for the line that contains the Options directive and remove the "Indexes" option from the list. The line may look like this:

Options Indexes FollowSymLinks

Modify it to:

<Directory "/var/www/html/project_nam/public">
    Options -Indexes +FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>

Alternatively:

<Directory "/var/www/html/project_nam/public">
  Options FollowSymLinks
  AllowOverride None
  Require all granted
</Directory>

By removing “Indexes,” you are instructing Apache not to display the directory index.

Step 4: Save and Restart Apache: After making the necessary changes to the configuration file, save the file and restart the Apache server. This will ensure that the modifications take effect. The specific command to restart Apache may vary depending on your operating system and distribution. For example, you can use one of the following command:

sudo service apache2 restart  # For Ubuntu and Debian-based systems
sudo systemctl restart httpd  # For CentOS and Fedora-based systems

Step 5: Verify the Changes: To confirm that directory browsing is disabled, access a directory on your website that does not have an index file. Instead of displaying a list of files, Apache should now return a “403 Forbidden” error, indicating that directory browsing is not allowed.

Conclusion:

Disabling directory browsing on Apache is a simple yet effective step in securing your website and preventing unauthorized access to your files. By following the steps outlined in this article, you can easily modify the Apache configuration file to disable directory listing and enhance the privacy and security of your website. Remember to regularly update and maintain your Apache server to stay protected against potential vulnerabilities.