Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Heya, how goes it? I have a straight forward ubuntu server running with a bunch of vhosts for multiple subdomains.

But when someone hits http://IP_ADDRESS/ directly, they see the full index of my /var/www/ directory where all the domain files are hosted.

I've searched high and low but can't figure out how to solve this. I know Options -Indexes is the solution but it's not listening to the ones I have in there, namely:

Options -Indexes

Any help would be really appreciated. Thanks!

share|improve this question

migrated from Aug 10 '10 at 12:11

This question came from our site for professional and enthusiast programmers.

If Options -Indexes isn't working for you remember that it may be overridden somewhere else. Your Apache uses a variety of configuration files within /etc/apache/conf.d for example as well as its main configuration file. But as for me, I just put in a blank index.html file (see my answer below). – thomasrutter Aug 10 '10 at 3:40

What I do is just create a blank file named index.html and put it it /var/www

So simple, but effective.

share|improve this answer
easiest solution wins. thanks brotha. any thoughts on this one:… – onassar Aug 10 '10 at 3:56

The default server is the virst vitual server in the list of servers. It will catch all requests by ip address. In your case you should restrict the access using allow and deny statements. Access is probabably something like.

        <Directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all

Replace the order and allow statements with something like.

        Order deny,allow
        Deny from all
        Allow from ::1/128

You can add additional allow statements for your lan addresses if you like.

share|improve this answer
I woulda tried this, but I got somewhat lost. I'm sorry if it's the 'right' solution.. normally I'd tend to promote that, but the other options offered are wayyy easier. I feel like a dick right now :( Thanks for the thoughts tho! – onassar Aug 10 '10 at 3:47
@onassar - no reason to be so hard on yourself. Surely you don't feel like one of those. ;) – Patrick R Aug 10 '10 at 14:32
Best security practice is to lock everything down and open up what needs to be open as required. Don't kick yourself if you didn't do so now. A lot of experienced people run servers which are fairly wide open. – BillThor Aug 11 '10 at 20:04

Try putting the Options -Indexes in the appropriate VHost directive or in the .htaccess file in /var/www. You can also just create an index file which the users will get instead of the directory listing. Finally, you can disable mod_autoindex.

share|improve this answer

I always put an index.html to my site root as a safety belt. If I later move the site or the settings get modified, the directory listing won't get accidentally revealed. An index.html is a very simple and effective way to stop accidents happening. :-)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.