Server exposes an auto-generated directory listing

A directory listing is what a web server shows when it's asked for a folder that has no index page, an automatically generated list of every file inside it. This check looks for this behaviour on common directories and confirms it's a genuine listing rather than a false alarm. On this site, one or more directories returned a real, content-verified directory listing. A public directory listing exposes uploaded files, backups, and internal folder structure that was never meant to be browsed or enumerated by visitors. This is a standard finding in any real security scan, because it often hands an attacker a ready-made map of what's on the server, including files someone may have forgotten were even there. Your developer should disable directory listing at the web server level. On Apache, this means adding 'Options -Indexes' to the configuration; on Nginx, it means setting 'autoindex off;'. This is a quick server configuration change, typically well under an hour, and should be followed by checking whether any of the exposed files need to be removed entirely rather than just hidden from listing.