Fix Browser Root Directory Access

TL;DR

Your website is letting people see files they shouldn’t because of a misconfigured web server. This guide shows you how to fix it, usually by setting up an index file or redirecting requests.

Understanding the Problem

When someone types your domain name (e.g., example.com) into their browser without specifying a specific page (like example.com/about), the web server looks for a default file to serve. Common defaults are index.html, index.php, or default.htm. If none of these exist, and your server isn’t configured correctly, it might list all the files in your website’s root directory – which is a major security risk.

Solution

1. Check for an Index File:

• The simplest fix is to create an index.html (or similar) file in your website’s root directory. This file will be displayed when someone visits your domain without specifying a page.
• Use a text editor to create the file and save it as index.html in the correct location on your server. The content of this file doesn’t matter much initially; you can add basic information or leave it blank for testing.

• If an index file exists but isn’t being served, check your Apache configuration. Open the main Apache configuration file (usually httpd.conf or apache2.conf). The location varies depending on your operating system and setup.
• Look for the DirectoryIndex directive within the <VirtualHost> block for your website. Make sure it includes the name of your index file. For example:

DirectoryIndex index.html index.php default.htm

sudo systemctl restart apache2

sudo systemctl restart httpd

• If you’re using Nginx, open your website’s configuration file (usually in /etc/nginx/sites-available/).
• Within the server block for your site, look for the index directive. Ensure it includes your index file name:

index index.html index.php;

sudo nginx -t

sudo systemctl reload nginx

• If you don’t want to serve an index file, you can redirect requests for the root directory to a specific page. This is often done using .htaccess files (Apache) or server blocks (Nginx).
• Apache (.htaccess): Create or edit a .htaccess file in your website’s root directory and add this line:

  Redirect / /about-us/

  (Replace /about-us/ with the URL you want to redirect to.)

• Nginx: Add a rewrite rule within your server block:

  rewrite ^/$ /about-us/ permanent;

  (Again, replace /about-us/ with your desired redirection target.) Remember to test the configuration after making changes.

• Ensure that files and directories have appropriate permissions set. Incorrect permissions could allow unintended access, even if the server is configured correctly. Generally, web server user should have read access to all public files.

Testing

After making any changes, clear your browser’s cache and try visiting your domain name without specifying a page (e.g., example.com). You should either see your index file or be redirected to the specified URL. If you still see a directory listing, double-check your configuration files and server logs for errors.