Directory Listing Scanner

How this check works

Scanaris requests seven common folders on your domain: /uploads/, /images/, /assets/, /files/, /backup/, /static/ and /media/. If any answers with a page whose title or heading is "Index of …", the format Apache, nginx and most servers generate when listing a directory, it opens a medium-severity finding with the path. A plain 200 is not flagged: a single-page application returning its HTML on every route does not match the pattern.

Why it matters

A listing turns a folder into a browsable catalogue of everything it contains, including what you never linked from any page: backups, exports, documents uploaded by users, old versions of files, product images not yet published. No need to guess names; the server hands them over sorted and dated. And it is the first place an automated scanner looks, because finding an open listing usually leads to something worse in the same folder.

Why it happens

The web server, on a request for a folder without an index.html inside, has two options: answer 403 or generate a list. Apache and some shared hosting panels come with the list enabled; nginx has it off unless someone turned it on with autoindex on. In Express apps, a forgotten serve-index or an express.static with listing options does the same.

How to fix it

• nginx: look for autoindex on in the configuration and change it to off (or remove it; off is the default).
• Apache: in the VirtualHost or in a root .htaccess, Options -Indexes.
• Express: remove any use of serve-index and check that express.static only points at the build folder.
• Shared hosting: the panel usually has an "Index Manager" or "Directory browsing" option; set it to "No indexing" for the domain.
• Vercel, Netlify and similar do not generate listings; if you see the finding there, the folder belongs to another server answering under your domain.

Then review what was in the listed folders: everything there was public even if the list is no longer visible. If there were backups or user data, treat them as downloaded and act accordingly. And move private files out of the directory the server serves; the sensitive files and exposed backups checks cover the most serious cases.

Check it is fixed

for d in uploads images assets files backup static media; do
  printf "%-10s " "$d"; curl -s "https://yourdomain.com/$d/" | grep -c "Index of"
done

All must return 0. Also try any other folder you know exists on your server, such as /wp-content/uploads/ or /docs/.

Frequently asked questions

My images folder is public anyway. Why does it matter if it is listed?

The difference is between someone seeing an image whose URL they know and seeing all of them, including the ones you uploaded for a campaign that has not launched or those of a specific client. The listing also reveals file names that sometimes include personal data.

Why does it only test seven folders?

They concentrate most open listings on real sites. If your server has listing enabled, it is normally enabled for all folders, so the configuration fix closes it everywhere.

Is a listing of an empty folder a problem?

Minor, but it indicates that listing is enabled on the server. Turn it off anyway: the folder will not stay empty forever.