Can anyone browse a site's folders?
Directory listing is what a web server does when a folder is requested and there is no index file to send: instead of an error, it generates a page listing everything in that folder. It is a default on many servers, and it turns a directory nobody was meant to open into a catalog that can be read straight through.
What a browsable directory costs
The damage depends entirely on the folder. A browsable /backup/ is the serious case: database dumps and site archives are usually named predictably enough to be guessed, and a listing removes even that small obstacle by naming them outright. The deep audit rates those directories High for exactly this reason.
A browsable uploads folder is quieter and still matters. Files that were meant to be reachable only by their link, such as an invoice or a document shared with one customer, become enumerable once the folder lists itself. Listings of application directories add reconnaissance value on top: file names reveal which components are installed and how the site is put together.
Checked on a verified domain, not on strangers
Finding this means requesting folder paths that nothing on the site links to, which is active probing. CheckWeb runs it in the Deep Audit after domain ownership is verified, and never as part of the free passive scan on an arbitrary domain.
The audit walks a fixed list of the paths that matter in practice, covering backup and upload folders and common application directories, and reports a finding only when the response is a real auto-generated index rather than a page that happens to exist. A passing passive score says nothing about this either way.
How it looks in the report
In a Deep Audit each browsable folder is its own finding, titled for the directory it names, such as "Backup directory is browsable" or "WordPress uploads directory is browsable". The finding carries the path and the signal that identified it, an auto-generated index page, so a claim can be checked by opening the same URL.
Backup directory is browsable
The server lists the contents of /backup/, so every file in it can be found and downloaded without knowing its name.
/backup/
Browsable vs closed
Browsable
Opening /backup/ returns an "Index of /backup" page listing every file, with sizes and dates, ready to download.
Closed
The same request returns 403 or 404, and anything genuinely sensitive is not under the web root at all.
Turning listing off hides the names. Moving the files out of the web root is what stops them being served.
How to fix it
- Apache: set `Options -Indexes` for the site, or for the specific directory in .htaccess.
- Nginx: confirm `autoindex off;`, which is the default, and check that no location block switched it on for uploads or backups.
- Per folder, as a quick stopgap: drop an empty index.html into the directory so there is something to serve instead of a listing.
- Move backups and database dumps off the web server entirely. A backup under the document root is downloadable whether or not the folder lists itself, and that is the finding worth fixing first.
- Then verify: re-run the deep audit and confirm the directories no longer answer with an index.
See what a site publishes without meaning to
The free passive scan reads headers, TLS, and known CVEs in seconds, no signup. Verifying the domain adds the active checks: browsable folders, exposed files, and admin surfaces.
Check my websiteFAQ
- Is directory listing a vulnerability on its own?
- It is a misconfiguration that makes other problems findable. Nothing is exposed that the server would refuse to send anyway, but a listing removes the need to guess a filename, which is often the only thing keeping a stray backup private.
- Does an empty index.html count as fixed?
- For that one folder, yes: the server sends the index file instead of generating a listing. It is per-directory and easy to forget on the next new folder, so turning listing off in the server config is the version that keeps holding.
- Is a listing under /wp-content/uploads/ worth fixing?
- Yes, at a lower priority than a browsable backup folder. It exposes every media file and document ever uploaded, including the ones assumed to be private because only their link was shared.
- Why does the free scan not report this?
- Because detecting it requires requesting folders that are not linked from the site, which is an active probe. That runs only on a domain whose ownership has been verified, which is the same boundary the terms describe.