If a folder on your server has no index file and directory listing is enabled, anyone who navigates directly to that folder’s URL sees a raw list of every file inside it — uploads, backups, configuration exports, anything that was ever placed there without being deliberately hidden. It’s a quiet, often long-standing exposure that most site owners never think to check for.
Check whether a folder on your own site is exposed right now
Visit a folder URL directly, like yoursite.com/wp-content/uploads/ , in your browser. If you see a plain list of files and folders instead of a 404 error or your normal site design, that folder is exposed to anyone who knows or guesses the URL — this is read-only to check and reveals nothing you don’t already have.
Directory listing & sensitive file exposure fix
A raw file listing exposed on your own server, found and closed — check it yourself first, it's free.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
This or something else?
| A folder on your site shows a raw file listing when visited directly | This fix covers it |
| You want broader file and directory permissions reviewed, not just listing specifically | Security hardening pass – config, permissions, XML-RPC, login, the broader version |
| Sensitive files (like a config backup) are exposed but listing itself is off | This fix also covers direct file exposure, not just folder listing |
| You suspect a file was actually accessed by someone through this exposure | Worth treating cautiously — check for other signs of compromise first |
What you are seeing
- A raw list of files and folders instead of your normal site design at a given URL
- Sensitive files like database exports, configuration backups, or old uploads visible in a folder listing
- The exposure possibly present on multiple folders across your server
- No indication in your normal site analytics that this is even happening, since it bypasses your actual pages
Common causes
- Server configuration allowing directory listing by default, with no index file present to override it
- A backup or export tool leaving sensitive files in a publicly accessible folder
- An old plugin or theme folder never cleaned up after removal, still reachable and exposed
- A misconfigured .htaccess or server block that doesn’t disable listing where it should
- File permissions set more permissively than necessary during a manual upload or migration
What we do
- Scan your site’s folder structure for directory listing exposure
- Identify any sensitive files currently exposed as a result
- Disable directory listing at the server or .htaccess level
- Remove or relocate any sensitive files found exposed, with your input on anything unclear
- Verify the fix across every folder checked, not just the one initially found
- Recommend where backups and exports should live instead, going forward
What is included
- Directory listing disabled across affected folders
- Any sensitive files found exposed relocated or removed, with your confirmation
- Verification across your full folder structure, not just one instance
- A written note on what was found and fixed
Not included
- Investigating whether an exposed file was actually accessed by someone else, a forensic question beyond this fix’s scope
- Broader file permission hardening, available as a separate, related fix
- Setting up a proper backup destination, a separate service
- Recovering from a compromise if evidence suggests one already occurred
Questions about this fix
How long could this have been exposed without me knowing?
Potentially a long time — this kind of exposure doesn't show up in normal site browsing or most analytics, since visitors don't typically stumble onto a raw folder URL by accident.
What if the exposed folder contained something sensitive, like a database backup?
That's worth taking seriously, and we'll flag it specifically rather than treating every exposure the same — a genuinely sensitive file being exposed is more urgent than an empty or harmless folder.
Does this mean my site was definitely accessed by someone malicious?
Not necessarily — exposure means it was possible, not that it definitely happened, though a sensitive file being exposed for a long period is worth treating with appropriate caution.
Will fixing this break anything that currently relies on direct folder access?
It's uncommon for legitimate functionality to depend on directory listing itself, though we check for anything unusual before disabling it, just in case.
Could I have found and fixed this myself for free?
Yes, checking a folder URL directly costs nothing, which is exactly why we show you how in the check above — the value here is in the systematic scan across every folder, not just the one you happen to think to check.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.