Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →If a WordPress URL displays a list of files instead of a page, disable NGINX directory indexes with autoindex off;. Put the directive in the NGINX http, server, or location context that serves the affected path, test the effective configuration, reload NGINX, and then request a directory that has no index file. With autoindex disabled, NGINX will not generate a browsable file list; the request instead produces the normal application response, a 403, or a 404 according to the rest of your configuration.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What directory browsing means on a WordPress LEMP server
A LEMP stack uses Linux, NGINX, a database such as MySQL or MariaDB, and PHP through PHP-FPM. NGINX serves static files and forwards PHP requests to PHP-FPM. When a browser requests a path ending in a slash, such as /wp-content/uploads/, NGINX treats it as a directory request.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
NGINX first checks the filenames configured by the index directive. If it finds an index file, that file is served or passed to the application. If no index file exists and directory listing is enabled, NGINX’s index module creates an HTML list of the directory’s contents. This is directory browsing, also called autoindexing.
The control is independent of WordPress. Turning it off does not remove files, change Unix ownership, repair permissions, or add authentication. It only stops NGINX from generating a listing when a directory has no usable index file.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
The directive that turns listings off
autoindex off;autoindex is valid in NGINX http, server, and location contexts. NGINX documents off as the default, but declaring it explicitly is useful when an included file, a hosting panel, or another administrator has enabled listings elsewhere.
Do not use an Apache-style .htaccess file for this setting. Standalone NGINX does not read per-directory .htaccess files, and WordPress cannot automatically change the NGINX server configuration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsChoose the correct scope
Place the directive at the narrowest level that matches your policy. A setting in a virtual host’s server block covers that site. A setting in a location block affects only requests matched by that location. An http-level setting can establish a default for all virtual hosts in the NGINX instance.
| Scope | Example | Use it when | Important consideration |
|---|---|---|---|
http |
autoindex off; in the main NGINX configuration |
You want a default policy for every virtual host | A more specific server or location setting can override the inherited value. |
server |
autoindex off; inside one site’s virtual host |
The entire WordPress site should reject generated listings | This is usually the clearest choice for a single-site deployment. |
location |
location /wp-content/uploads/ { autoindex off; } |
Only one path needs the policy | Check location matching carefully; a different, more specific location may handle the request. |
If you are unsure which file is active, inspect the enabled site configuration and the files it includes. Editing an unused template or a disabled virtual host will not change the running site.
A complete single-site NGINX example
The following pattern combines the directory-listing setting with the common WordPress front-controller arrangement. Replace the domain, document root, include files, and PHP-FPM socket with the values used by your server.
server {
server_name example.com;
root /var/www/example.com/public;
index index.php index.html;
autoindex off;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php-fpm.sock;
}
}The index line tells NGINX which files to look for on a directory request. The try_files rule preserves normal WordPress permalink routing by serving an existing file or directory and sending other requests to index.php. The PHP location’s try_files $uri =404; prevents NGINX from passing a nonexistent PHP filename to PHP-FPM.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Your distribution may use a versioned socket, a TCP address, a different FastCGI include, or a different document-root directory. Do not copy those values blindly. A correct autoindex directive does not compensate for an incorrect PHP-FPM endpoint or root path.
How to edit the active configuration
- Identify the virtual host. Find the enabled NGINX server block whose
server_nameandrootmatch the WordPress site. Follow itsincludestatements so you know which file owns the relevantlocation. - Back up the file. Make a copy of the active site configuration before editing. Keep the backup outside any directory that NGINX serves publicly.
- Choose the policy level. Add
autoindex off;in the server block for whole-site protection, or add it to the affected location for path-specific protection. - Save without changing unrelated directives. A typo in a regular expression, brace, semicolon, root path, or FastCGI parameter can prevent NGINX from reloading or can create an unintended access path.
- Test the configuration. Run the NGINX configuration-test command supplied by your platform. The commonly used command is
nginx -t, but a hosting panel, container image, or service wrapper may provide a different command or require elevated privileges. - Reload through the service manager. Use the normal reload operation for your Linux distribution or hosting environment. A reload applies the new configuration to new requests without unnecessarily terminating existing connections; the exact command is platform-dependent.
If the test fails, read the reported filename and line number, restore the backup if necessary, correct the syntax, and test again. Do not force a reload of a configuration that has not passed validation.
Verify that the listing is gone
Test a directory that genuinely has no index.html or index.php. Testing a directory containing an index file will only show that the index file works; it does not prove that autoindexing is disabled.
- Request the path with a trailing slash, for example
https://example.com/wp-content/uploads/. - Confirm that NGINX does not return its generated file-list page.
- Acceptable results include a WordPress response, a 403 Forbidden response, or a 404 Not Found response, depending on your routing, permissions, and application rules.
- Request an ordinary front-end permalink and confirm that WordPress still routes it normally.
- Request a known upload file, such as an image, and confirm that legitimate static-file delivery still works.
A command-line check can make the result easier to inspect. Use your preferred HTTP client, such as curl -I https://example.com/wp-content/uploads/, but interpret the status in the context of your site’s configuration. A 200 response alone is not proof of a listing; an application-generated page may also return 200. Inspect the response body for a generated directory index.
Why a WordPress uploads folder often exposes a file list
WordPress commonly stores media under wp-content/uploads/, organized by year and month. Those directories may contain images, documents, and other media but usually do not need an index document. If NGINX is configured with autoindex on;, a request for one of those directories can therefore reveal filenames and subdirectories.
The exposure is an information-disclosure problem rather than a WordPress routing feature. A listing can reveal naming conventions, backup files accidentally left in the web root, document titles, user-uploaded filenames, or the existence of paths that were not intended to be browsed. Disabling generated indexes removes that convenient directory view, but it does not make a known file URL private. Anyone who knows or guesses a directly accessible filename may still request it.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Server-wide versus uploads-only protection
Protect the complete virtual host
Use a server-level directive when every directory in the WordPress virtual host should avoid generated listings:
server {
server_name example.com;
root /var/www/example.com/public;
autoindex off;
# other WordPress locations
}This reduces the chance that a newly created directory inherits an unsafe behavior. It also avoids having to remember the setting for every current and future path.
Protect only the uploads path
If another part of the site intentionally needs a different behavior, scope the directive to uploads:
location /wp-content/uploads/ {
autoindex off;
}Use this approach only when you understand the surrounding location rules. A regex location, an exact-match location, or an included file may take precedence for a particular request. Check the final effective configuration rather than assuming that the block you edited is the block NGINX used.
Common reasons the file list remains visible
The wrong file was edited
Sites often have a default server, a staging server, and one or more enabled site files. If the request’s hostname resolves to another virtual host, changing the intended site’s file will have no visible effect. Confirm the active server_name, listen address, and document root.
An include enables autoindex later
NGINX combines directives from included files. Search the complete active configuration for autoindex on; and inspect the context in which it appears. A more specific setting can override an inherited value.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
The location does not match the requested URL
A location for /wp-content/uploads/ will not affect a different alias, a rewritten path, or a request handled by another location. Review the location hierarchy and any alias directives.
The browser is showing a cached response
Reload the page without using the browser cache, test with a command-line client, and check any reverse proxy or CDN cache. Purging a cache may be necessary if an earlier 200 response containing a directory page was stored.
A panel or container regenerated the configuration
Managed control panels, deployment scripts, and container entrypoints can overwrite hand edits. Make the change in the supported template or administration interface, then confirm that the generated configuration contains autoindex off;.
There is an application-generated file index
NGINX’s autoindex page is only one kind of listing. A PHP script, plugin, object-storage gateway, or custom application can generate its own directory-like page. Turning off NGINX autoindex will not disable an application that deliberately returns a file list.
What disabling autoindex does not fix
Directory-listing prevention is one hardening measure, not a complete WordPress security policy.
- Known-file access: A visitor can still retrieve a file whose URL is public and known. Use authentication, authorization, or storage outside the web root for private material.
- File permissions: Correct Unix ownership and mode settings so the web service can read required files without granting unnecessary write access.
- Hidden files: Add an appropriate NGINX rule to deny accidental access to hidden files such as deployment metadata, while explicitly allowing any hidden path your application genuinely needs.
- PHP execution in uploads: Upload directories generally should serve media as static content, not execute uploaded PHP. WordPress’s NGINX guidance includes restrictions for this case; adapt them to your deployment and test legitimate uploads afterward.
- Backups and configuration files: Remove database dumps, archives, editor swap files, and credentials from publicly served directories. A 403 on a directory does not protect a sensitive file if its direct URL remains readable.
- Application permissions: Review WordPress roles, plugin behavior, and upload validation separately from NGINX access controls.
Managed hosting and limited server access
On managed WordPress hosting, you may not have permission to edit the NGINX server block or reload the service. Do not create an .htaccess file expecting NGINX to read it. Ask the host or administrator to disable autoindexing for the virtual host or the affected uploads path, and request confirmation that the change is present in the effective configuration.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
If you operate the server through a control panel, use its supported NGINX configuration field or custom-includes mechanism. A panel may validate and deploy the file for you, while direct edits can be discarded during the next service update.
Operational checklist
- Identify the active WordPress virtual host and document root.
- Back up the configuration before editing.
- Set
autoindex off;in the appropriatehttp,server, orlocationcontext. - Check included files and more-specific locations for conflicting settings.
- Run the platform’s NGINX configuration test.
- Reload NGINX using the platform’s normal service manager.
- Request a directory with no index file and verify that no generated list appears.
- Test a normal WordPress permalink and a known upload file.
- Review permissions, hidden-file rules, upload PHP execution, and publicly accessible backups.
Frequently asked questions
Is autoindex off; already the default?
Yes. NGINX documents off as the default value, but explicitly setting it makes the intended policy clear and protects against an inherited or included autoindex on; setting.
Should the directive go in wp-config.php?
No. wp-config.php is a WordPress application file. Directory listing is controlled by NGINX, so configure it in the active NGINX configuration.
Will this break WordPress media?
It should not prevent direct access to valid media files. It only prevents NGINX from generating a directory index when a directory lacks an index file. Test an actual image or document URL after reloading.
Why did I receive 403 instead of 404 after disabling browsing?
Both can be normal. The result depends on directory permissions, access rules, the matched location, and WordPress or other application handling. The key verification point is that no generated file list is returned.
Can I enable browsing for one directory while disabling it elsewhere?
Technically, a more specific location can set autoindex on;, but intentionally exposing a listing should be treated as an exception with a documented reason and review. The safer default for WordPress content is to keep listings disabled.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
