mediumSeverity: mediumRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.Web server configWhere it livesImplementationThis fix is applied in: Web server config. That's the surface you'll edit, DNS, response headers, or a static file.~5 minTime to fixEffortRoughly 5 minutes of hands-on work, propagation aside. Most of these are copy-paste.+10 posture+10 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

Directory listing: stop serving a public index of your files

Turning off auto-indexing stops the web server from handing visitors a browsable list of every file in a folder

The threat

When a visitor requests a folder that has no index page (like /uploads/ or /backup/), your web server has a choice: return a “not found,” or auto-generate a clickable list of everything in that folder. The scanner requested a directory and got the second one back, a full Index of /… listing.

That listing is a table of contents to files you never linked anywhere and may never have meant to publish: old backups, .zip exports, spreadsheets, draft PDFs, stray config files. Nobody has to guess a filename, the server shows them all, each one a click away from download. It isn’t an exploit, it’s an open filing cabinet.

The exact fix

The listing comes from the web server, so that’s where you turn it off. Lead with your stack:

nginx (autoindex off;):

# nginx auto-indexing is OFF by default, so a listing means
# a location block turned it on. Set it back off.
location / {
    autoindex off;
}

Apache (Options -Indexes):

# in the <Directory> block, the vhost, or .htaccess for that folder
Options -Indexes

The leading - removes the Indexes option, so requesting a folder with no index file returns 403 Forbidden instead of a listing.

Belt and suspenders: drop an empty index.html into any folder that should never list (uploads, exports, backups). Even if indexing gets switched on again by accident, the server serves that blank page instead of the file list.

This is about listing, not access. Turning off auto-index stops the folder from advertising its contents, but a file is still reachable if someone already knows or guesses its exact URL. For anything genuinely sensitive (backups, exports, anything with credentials), move it out of the web root entirely or put it behind auth, don’t just hide the index. On Netlify, Vercel and similar, requesting a directory won’t produce a listing at all, so this finding points at a server you control.

Verify it

curl -s https://yourdomain.com/uploads/ | grep -i 'index of'

Swap /uploads/ for the folder that was flagged. No output means the listing is gone (running curl -sI on the same path should now return a 403 or 404). If you still see Index of /uploads, auto-indexing is on.

Proof

Confirmed by a single GET that returns an Index of page, the ApeCyber scanner sees it the moment it does, passively, from the outside, touching nothing. Closing it is a 5-minute, −10 win, and one of the higher-value quick fixes, because a listed folder often points straight at backups or exports you would never choose to publish.