Apache: How to Display a Directory Listing

To display a list of files and subdirectories in a directory on the Apache HTTP Server, set Options +Indexes in that directory. The list is generated when access permissions are granted, no default index file exists, and mod_autoindex is activated.

Conditions under which the list is displayed

When a directory URL is requested in Apache 2.4, it first looks for files specified in DirectoryIndex. For example, if index.html exists, that file is usually displayed. If the file does not exist and Indexes is activated, mod_autoindex can create the list. For detailed behavior, see Apache's DirectoryIndex description and mod_autoindex documentation.

Listing settings do not grant access permissions. Directories that are denied access or paths that Apache cannot read will not display a listing. Also, a 403 Forbidden can occur for various reasons, such as authentication or file system permissions, so you should not enable listing just because a 403 appears.

Check before setting

• Prepare a dedicated directory where listings and files can be made public. Do not put materials that should not be public, such as configuration files, backups, or personal information.
• Confirm the virtual host of the site to be configured and the actual file path. The example below is for Ubuntu Apache 2.4 when the site's document root is /var/www/html and the public directory is downloads underneath it. Replace with the actual environment path and URL.
• Back up existing settings and confirm that you have permission to manage the site and reload Apache. If it is a production server, check in a test environment first.

Even if files do not appear in the listing, they may be accessible if you know the file URL directly. Hiding names in the listing is not a substitute for permissions that block file access.

Apply to a specific directory in the virtual host

On Ubuntu, the active site configuration is usually in a file under /etc/apache2/sites-available/. Add the following block to the virtual host configuration of the site or modify the existing path configuration. Do not carelessly add public permissions to directories that already have access restrictions.

<Directory "/var/www/html/downloads">
    Options +Indexes
    Require all granted
</Directory>

Options +Indexes adds a directory listing to inherited options. Require all granted allows access to this path, so use it only in directories intended to be public. The actual scope of application may vary depending on other configuration sections or subdirectory settings. You can check the inheritance and merging rules of options in the Apache Options directive.

After saving the configuration, check the syntax on Ubuntu. If Syntax OK is displayed, reload the configuration. If errors occur, correct the path and typos, and do not reload until the check is successful.

sudo apache2ctl configtest
sudo systemctl reload apache2

Distributions other than Ubuntu may have different configuration file locations and service names. Also, follow the guidance of that distribution for syntax check and reload commands.

Checking directory listings and access scope

1. Place a test file that can be publicly accessed in the target directory and make sure that the specified index file is not there.
2. Open the directory URL in your browser. In the example above, if the server address is https://example.com, https://example.com/downloads/ would be the sample URL. Replace it with the actual domain.
3. Check if the test files are displayed in the list and open the links to ensure that the access scope matches the intended setting. Since settings can be inherited by subdirectories, review the public access scope as well.

If a page appears instead of a list, check whether there is a DirectoryIndex file or other handler/redirects. If it’s a 403 error, check the access restrictions, directory permissions, and index settings in the error logs. You can also check whether the autoindex module is active using apache2ctl -M. If the path is incorrect, a 404 error may occur.

When using .htaccess

If the server administrator has allowed Options changes in .htaccess for the directory, you can also add the following line to that file. If the AllowOverride of the parent settings does not allow this option, it may not work or may cause a server error, so confirm with the administrator.

Options +Indexes

If you have access to server settings, Apache generally recommends using the main configuration file. Check the applicable conditions in Apache’s .htaccess guide.

To stop displaying the list

Set Options -Indexes in the given path or restore the settings from before your changes, then check the syntax and reload Apache. If you added it to .htaccess, either remove that line or, if allowed, change it to Options -Indexes. Since inherited settings may exist, check the directory URL again after making changes.

Simply turning off the list does not block access to already known file URLs. To protect the files themselves, apply separate access controls and verify that unauthorized users are actually blocked.