PerfoMetrix

All guides · Security

Default Pages and Directory Listings: Unfinished Setup

Two kinds of page signal that a web server is serving something nobody meant to publish.

A default page is the placeholder a web server or hosting panel installs: “Welcome to nginx!”, “Apache2 Ubuntu Default Page”, “It works!”, the IIS start page, or a host’s “this domain has just been set up” page. It means the site was never deployed to this address, the deployment went to a different directory, or a virtual host does not match and the server fell back to its default.

A directory listing (“Index of /”) appears when a URL points at a folder with no index file and the server is configured to list the folder’s contents instead of returning an error.

Why it matters

  • Exposed files. Listings reveal everything in the folder: backups (site.zip, db.sql), configuration copies (config.php.bak), logs, uploads that were meant to be private, and old versions of scripts. Search engines index listings, so these files can turn up in search results.
  • Information for attackers. Default pages name the server software and often the operating system. They also suggest the server is unmaintained, which makes it a more attractive target.
  • Trust and search. Visitors who land on a placeholder leave. Search engines may index the placeholder instead of your content.

How to fix a default page

  1. Check which virtual host answered. On nginx, nginx -T prints the full configuration; make sure a server block has your domain in server_name and the right root. On Apache, apachectl -S lists the virtual hosts and which one is the default.
  2. Deploy the site to the directory that host serves, or point the host at your deployment.
  3. Remove the placeholder file (for example /var/www/html/index.html on Ubuntu and Debian) so unmatched requests do not show it.
  4. On shared hosting, make sure the domain is attached to the right folder in the control panel.

How to turn off directory listings

nginx lists folders only when autoindex is on. Make sure it is off (the default):

location / {
  autoindex off;
}

Apache lists folders when Options Indexes is enabled. Turn it off in the virtual host or an .htaccess file:

<Directory /var/www/example>
  Options -Indexes
</Directory>

# .htaccess
Options -Indexes

IIS (web.config):

<configuration>
  <system.webServer>
    <directoryBrowse enabled="false" />
  </system.webServer>
</configuration>

WordPress sites on Apache commonly expose /wp-content/uploads/ as a listing. Add Options -Indexes to the root .htaccess; an empty index.php in a folder also stops a listing there.

After turning listings off, remove anything sensitive that was exposed. Assume it has been downloaded: rotate credentials that appeared in backups or configuration files.

How PerfoMetrix checks this

We look at the title and first heading of the page we already downloaded. We send no extra requests to your site and do not probe other folders.

The check fails when the title or heading starts with “Index of /” (a directory listing), or matches a known placeholder: the Apache, nginx, IIS, OpenResty and CentOS welcome or test pages, “It works!”, and common hosting-panel placeholder pages. The report shows the title we matched.

Because we only see the scanned URL, a pass does not mean other folders on the server are protected. Request a few folders without index files yourself, such as your uploads or assets directory, and check that they return 403 or 404.

Further reading: OWASP Web Security Testing Guide: old, backup and unreferenced files and nginx: autoindex.

Last updated October 28, 2026

Scan your website