Directory listing enabled on WordPress
The web server displays the list of files in /wp-content/uploads/ (and potentially other folders). Anyone can browse your files.
Why it matters
An attacker can map your installation, discover backup files, private documents or identify installed plugins/themes.
How to fix
- 1
Disable via .htaccess (Apache)
apache# At the site root and in wp-content/uploads/ Options -Indexes - 2
Add an empty index.php in sensitive folders
bash# Create an empty index.php in each folder without an index touch wp-content/uploads/index.php touch wp-content/plugins/index.php touch wp-content/themes/index.php - 3
Via Nginx
nginx# In the vhost config location /wp-content/ { autoindex off; }
Ready to fix this issue on your site?
Audit my site for free →