Directory & File Exposure
EasyScans for publicly accessible sensitive files (logs, .git).
Estimated fix time: 5 minutes
What is Directory Exposure?
Directory listing allows visitors to browse files and folders on your server. This exposes your application structure and can reveal sensitive files.
Security Impact
Severity: Medium
- File structure exposure
- Discovery of sensitive files
- Information gathering for attacks
- Potential file downloads
How to Fix
Apache
# Disable directory listing
Options -Indexes
# Or in .htaccess
<IfModule mod_autoindex.c>
Options -Indexes
</IfModule>
Nginx
# Nginx disables directory listing by default
# But ensure autoindex is off
autoindex off;
Verify Web Root
Ensure your web server points to the public directory:
root /var/www/html/public;
Verification Steps
- Visit a directory URL (e.g.,
/storage/) - Should return 404 or 403, not file listing
- Test multiple directories
- Verify with security scanner
Related Issues
- Sensitive Files
- Exposed .env Files
Automatically detect this issue
StackShield can automatically scan your Laravel application for this security issue and alert you when it's detected.
Start Free Trial
Was this guide helpful?