Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I haven't uploaded index.html or index.php to my root directory. How can I prevent people from looking at a listing of files in parent directory?


Also, is it possible for people to obtain a list of all the files in the root directory once I upload index.html?

I'm currently using .htaccess and htusers to prompt someone to enter a username and password when they try to access any file in the root directory.

This may sound like a weird request but would it be possible to have them come to the site (without an index.html) and just have them not see the files? All it would say on the page would be the following:

Index of/

Apache Server at Port 80

share|improve this question
up vote 2 down vote accepted

Use Options -Indexes to turn off auto-generation of indexes.

share|improve this answer

Add this to your .htaccess:

Options -Indexes

it will show an "Forbidden 403" Error when a user tries to access the page.
Also after you have uploaded an proper index.html the users won't be able to get the listing.
It is still good practice to keep the -Indexes Option in it if you don't want ever to show the list, in case for example of a misconfiguration or you moved the index.html away by accident.

share|improve this answer

In addition to AlexD's answer, you can try putting in .htaccess:

IndexIgnore *.csv

for specific file extensions.

More help is available at

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.