Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few folders in which i did not have any index.htm or index.php and i dont want to have one so that i can see all the html files in that. I dont have other extensions other than .htm in those folders.

What will be the security risk in having directory listing enabled?

share|improve this question
up vote 3 down vote accepted

The security risk is such that users can see whats in that directory and if that directory has other directories below it.

Some PCI security scanners will detect directory indexing as a security issue because malicious users could potentially work out what file structure you are using, which system and even sometimes which web script if you use one and use that info to launch an attack - this risk is generally classified as low though

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.