Do your folders list their contents?
Folders on your site that show a list of every file inside when someone opens them in a browser.
Why it matters
A listing shows files you never linked to: uploads, backups, old versions and configuration. It saves an attacker the work of guessing names.
How a survey checks it
Verified check: runs once you prove you own the site.
This is a verified check. We open a few likely folders, including the ones your site loads files from, and recognise a real listing page. We never keep the listing itself.
How to fix it
- Turn off directory listings in your web server or host settings.
- Move anything private out of public folders entirely.
Prefer us to do it? Ask for a fix quote
Common questions
Is a listing of my images folder a problem?
Less so, which is why folders with only static files count as low. It is still worth switching off.
Do static hosts show listings?
Most do not by default. Listings are more common on self-managed servers.