Does your server list the files in a folder to anyone?
The folder listing check flags a page that is an automatic listing of the files in a server folder. A listing shows files you may have forgotten, to anyone who finds it.
What does this check look at?
It looks at whether a page is an automatic listing of the files in a server folder. Make sure your upload or build step only publishes the site itself, and turn off folder listings on your host.
Pulse and Deep scans both run it.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Low finding | A page matched a directory listing. | Turn listings off unless the folder is meant to be browsed. |
Listed files are not downloaded, and some sites publish listings on purpose. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | Anyone on the internet, with no account, cookie or credential |
| The protection that should stop it | Directory listing should be off |
| What is reached | A list of the files in a folder |
| What follows | Helps find files not meant to be public; no access on its own |
Which standards does it relate to?
| Standard | Reference |
|---|---|
| OWASP Top Ten | A02:2025 Security Misconfiguration |
| CWE | CWE-548 |
Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.
Fix it with your AI
Listings are a server setting, usually one line.
A folder on my site shows an automatic file listing. Turn off directory listings on my web server or host (for example autoindex off in nginx, Options -Indexes in Apache, or the equivalent setting on my host). Then check the folder for files that should not be public, such as backups, exports or old uploads, and list them for me to remove.How to check
Say Atlas, our example app at atlas.example, serves an uploads folder from a plain web server with listings on. The check flags the listing page without downloading any listed file.
Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.
Questions people ask
Is a folder listing always bad?
No. Some sites publish download folders on purpose. It matters when the folder holds files nobody meant to share.
Did Lockpick download the listed files?
No. It recognises the listing page itself and stops there.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- Files you forgot were public Lockpick docs, read on October 7, 2026
- How we rate findings Lockpick docs, read on October 7, 2026