Enable directory listings
Show a file listing for directories without an index page — and why it is disabled by default.
Make the web server list a directory's contents when it has no index page. Applies to shared, reseller and Premium hosting.
By default, requesting a directory with no index.html or index.php returns
403 Forbidden. Directory listings are off for a reason.
Enabling this exposes every file in the directory to anyone who finds the URL — including backups, exports, configuration files and anything else you assumed nobody knew about.
Do it for a directory you deliberately intend to be browsable, never for a whole site.
Enable it
Create or edit .htaccess in the directory you want listed — not in your
document root — and add:
Options +IndexesBetter: control what is shown
Plain +Indexes shows filenames only. +FancyIndexing adds sizes, dates and
sorting:
Options +Indexes +FancyIndexing
IndexOptions FancyIndexing HTMLTable NameWidth=*Hide files that should not be listed even when browsing is intended:
IndexIgnore .htaccess *.php *.sql *.zip *.bakDisable it for a directory
Options -IndexesUseful for an upload directory inside an otherwise browsable area.
Check it worked
Visit the directory URL. You should see the listing rather than a 403.
Then check what is actually exposed. Look at the list and ask whether every file on it is one you would hand to a stranger — this is the point at which people notice a database dump they forgot about.
A better approach for downloads
If the goal is offering files for download, an index page listing them deliberately is safer than exposing the directory. You control what appears, and adding a file to the directory does not silently publish it.