Directory listing visible

Why it matters

A visible folder list shows every upload, also files that were never linked, such as old documents, exports or invoices. It also shows how the site is built.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It asks the uploads folder, or a few common image folders, and checks whether the server shows a file list.

Common causes

• Directory listings are on by default at the host
• No empty index file in the folder
• A server rule that was lost when moving

How to fix it

1. Add Options -Indexes to .htaccess, or ask the host to switch off directory listings.
2. Check whether files are visible that should not be online, and remove them.
3. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Anyone can browse the folders of your site". When everything is in order, the report says: "Folders cannot be browsed".