A visitor who opens an unprotected folder on your website may see a plain list of files instead of a normal web page. That can expose image names, old downloads, plugin files, backups, or documents you never intended to display. Knowing how to enable directory listing protection in cPanel is a quick way to close that gap without changing your website design.

For most small websites, this is a simple cPanel setting that takes only a few minutes. The key is choosing the right directory and understanding the difference between hiding a file list and password-protecting a folder.

What directory listing protection does

A directory listing happens when someone visits a folder URL that does not contain a default index file, such as index.html or index.php. Depending on the server configuration, the browser may display the folder’s contents. For example, a visit to yourdomain.com/uploads/ could reveal every file stored in that location.

Directory listing protection turns off that file browser view. Visitors who try to access the folder will usually see a forbidden or access denied message instead of a list of files.

This setting does not make files private if someone already knows the exact file URL. It also does not replace proper file permissions, login controls, or regular backups. It is one useful layer of website security that reduces unnecessary exposure.

Before you change the setting

Start by identifying the folder you want to protect. Your main website files are commonly stored in public_html, while addon domains, subdomains, and application folders may be stored elsewhere. You may want to disable listings for upload folders, old project folders, document directories, staging areas, or directories used by scripts.

Be careful with folders that are meant to display downloadable files to the public. Disabling directory listings will not stop direct downloads, but it will remove the browsable file index that some visitors may rely on. If your site intentionally uses a folder as a simple download library, create a proper page with labeled download links instead. It looks more professional and gives you control over what visitors can see.

You should also know whether a website application manages the folder. WordPress, ecommerce platforms, and other scripts may use folders behind the scenes. Turning off indexing is normally safe, but avoid deleting or moving files while you are making this change.

How to enable directory listing protection in cPanel

In most cPanel accounts, directory listing controls are found in the Indexes tool. Some hosting setups may label this area as Index Manager, but the purpose is the same.

1. Log in to cPanel

Open your hosting account’s cPanel dashboard. On a Visiba hosting plan, cPanel provides the main controls for files, domains, email, databases, and security settings in one familiar location.

From the dashboard, look for the Advanced section and select Indexes. If you do not immediately see it, use the cPanel search bar and type “Indexes.”

2. Choose the correct website directory

The Indexes tool displays a folder tree. Open the folder path for the domain or subdomain you want to manage.

For a primary domain, this is often public_html. However, you usually do not need to change the setting for every folder at once. Open the specific folder you want to protect, such as public_html/uploads, public_html/documents, or a directory created for an older site.

Take a moment to confirm the folder name before saving. Applying the setting to the wrong directory can cause confusion when testing your site later.

3. Select No Indexing

After selecting a folder, cPanel will show options for how the server handles a directory without an index file. The option you need is usually called No Indexing.

Select No Indexing, then click Save. cPanel should confirm that the index settings have been updated.

This setting instructs the web server not to show visitors a list of files inside that directory. It does not remove the files or alter your website content.

4. Test the folder in a private browser window

Open a private or incognito browser window and visit the folder’s URL. For example, if you protected public_html/uploads, test yourdomain.com/uploads/.

If the folder has no index page, you should no longer see a list of filenames. A 403 Forbidden message or a similar access-denied page generally means the protection is working as intended.

Testing in a private window matters because your normal browser session may cache an earlier version of the page. It also gives you a closer view of what a first-time visitor sees.

Do not confuse Indexes with Directory Privacy

cPanel includes another useful tool called Directory Privacy. Despite the similar name, it solves a different problem.

Indexes prevents visitors from browsing a folder’s file list. Directory Privacy requires a username and password before a visitor can open a directory at all. If you need to share client files, private reports, internal documents, or a protected staging area, password protection may be the better choice.

You can use both settings when appropriate. For example, turning off indexing prevents accidental file browsing, while Directory Privacy adds a login requirement for the entire folder. For a public uploads folder, No Indexing is often enough. For sensitive files, use a protected folder and avoid placing private content under a public web directory whenever possible.

What to do if the setting does not work

If you still see a directory listing after choosing No Indexing, first make sure you changed the setting for the exact folder shown in the URL. It is easy to protect public_html while testing a subdomain that uses a different document root.

Next, clear your browser cache or test in a private window. If the listing remains visible, check whether the directory contains an .htaccess file with rules that override the cPanel setting. Website software, security plugins, or previous site work can sometimes add custom Apache directives.

A common manual rule for disabling listings is:

Options -Indexes

This line belongs in the relevant .htaccess file. Use it carefully. A malformed .htaccess file can cause a server error, and some hosting configurations may handle directives differently. If you are not comfortable editing hidden files, use the cPanel Indexes tool first and contact hosting support if the result is not what you expect.

You may also see an index page instead of a forbidden message. That is normal if the folder contains an index.html or index.php file. The server loads that page rather than displaying the directory contents.

Folders worth checking on a small website

You do not need to treat every folder the same way. Focus on locations where a file list could reveal useful information about your site or business.

Common examples include folders for media uploads, PDFs, old site copies, exported data, development files, temporary downloads, and custom application assets. Backup archives deserve special attention. Ideally, backups should be stored outside public_html or in a separate backup service, not inside a web-accessible folder.

Avoid assuming that a hard-to-guess folder name is protection. Search engines, browser history, referral data, server logs, and simple URL guessing can all expose paths over time. Disabling directory listings removes one easy way for a visitor to map what is inside.

Keep protection part of routine site maintenance

Directory listing protection is a small setting, but it supports a better-managed website. Review it after migrating a site, adding a new subdomain, installing a script, or uploading files for a new project. It is especially worthwhile when multiple people have access to the hosting account.

A clean folder structure, current software, strong cPanel passwords, free SSL, and reliable backups all work together. Start by protecting the directories that should never act like public file browsers, then test them from a visitor’s point of view. That simple habit helps keep your website professional and your files less exposed.