Apache｜How to Disable the "Index of /" Directory Listing Page (CentOS 6)

When browsing a site built with Apache, you may sometimes see an "Index of /" page like the one below.

This page appears when there is no index page (such as index.html) in the directory accessed via the browser. When this happens, all files and directories under that path become visible.

Because exposing directory contents can be a security risk, it is best to prevent the "Index of /" page from appearing unless you intentionally want to show it.

There are two ways to disable the "Index of /" page:

(1) Always place an index page in each directory.

　　※ An index page is a file specified by DirectoryIndex in httpd.conf.

　　　Example DirectoryIndex setting: DirectoryIndex index.html index.html.php

(2) Disable the Indexes feature in Apache's Options directive.

Reference: core - Apache HTTP Server Options Directive
http://httpd.apache.org/docs/2.2/mod/core.html#options

Indexes -- If a request maps to a directory and the file specified by DirectoryIndex (e.g., index.html) does not exist, mod_autoindex formats and returns a listing of the directory contents.

Before modifying httpd.conf -- excerpt from /etc/httpd/conf/httpd.conf

<Directory "/var/www/html">

#
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* -- "Options All"
# does not include it.
#
# The Options directive is both complicated and important. Please see
# http://httpd.apache.org/docs/2.2/mod/core.html#options
# for more information.
#
Options Indexes FollowSymLinks

After modifying httpd.conf -- excerpt from /etc/httpd/conf/httpd.conf

<Directory "/var/www/html">

#
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* -- "Options All"
# does not include it.
#
# The Options directive is both complicated and important. Please see
# http://httpd.apache.org/docs/2.2/mod/core.html#options
# for more information.
#
Options -Indexes FollowSymLinks　← Add a hyphen ("-") before Indexes.

Restarting Apache

[root@test conf.d]# /etc/rc.d/init.d/httpd restart

Once the configuration is applied, accessing a directory without an index page will show a 403 Forbidden page instead of "Index of /".