Are directory contents publicly listed by default on IONOS Linux hosting?

The Citead team, updated

In short. IONOS disables directory listing by default and documents Options +Indexes for enabling Apache's automatic directory index.

Definition: No. IONOS documents directory listing as disabled by default on its Linux Web Hosting and Managed Dedicated Servers. It can be enabled in an .htaccess file with Options +Indexes.

Key facts

  • IONOS's reference applies to Linux Web Hosting and Managed Dedicated Servers. IONOS's .htaccess directives reference says directory listing displays a web space's folder and file structure in the browser.
  • IONOS says that listing can be viewed from outside by every visitor and that it has disabled the function on its servers by default for security.
  • The IONOS example enables the feature with Options +Indexes in .htaccess.
  • Apache defines Options as the directive that controls which server features are available in a particular directory. Its Indexes option makes mod_autoindex return a formatted directory listing when the requested directory has no DirectoryIndex, such as index.html. Apache's Options documentation lists .htaccess as one valid context.

What does IONOS's default policy mean?

IONOS describes directory listing as a view of the folder and file structure of a web space. The page says that this view can be seen from outside by every visitor, then states that the function is disabled on its servers by default for security. The reference is specifically labelled for Linux Web Hosting and Managed Dedicated Servers.

The default policy concerns automatic directory indexes. It does not describe the contents of a normal page that your site serves. Apache's documentation separates a directory index supplied by a file, typically index.html, from a listing generated by the server. A request for a directory can therefore resolve to a configured index file, while a listing is the fallback described by the Indexes option when no DirectoryIndex is present.

How does the Options directive change listing behavior?

IONOS gives this configuration in its example:

Options +Indexes

Apache's Options directive documentation says that the directive configures which features are available in a particular directory. The syntax accepts an option preceded by + or -, and the documented contexts include server configuration, virtual hosts, directories and .htaccess files. The + form adds an option to those currently in force; the - form removes one. For a directory where the setting is allowed, the corresponding disable line is:

Options -Indexes

Apache also documents that when all options on an Options directive use + or -, the settings are merged with the options already in force. A line that combines prefixed and unprefixed options is rejected as invalid syntax. This makes the prefix important when changing only directory indexing while retaining other inherited options.

When does Apache generate the directory listing?

Apache's mod_autoindex documentation describes two possible sources for a directory index. The first is a file in the directory, with DirectoryIndex setting the file name or names. The second is a listing generated by the server, whose format is controlled by mod_autoindex directives.

The same documentation states that automatic index generation is enabled with Options +Indexes. Apache's Options reference adds the condition: when a URL maps to a directory and no DirectoryIndex, such as index.html, exists, mod_autoindex returns a formatted listing. The IONOS default therefore prevents this automatic listing until the Indexes option is enabled for the applicable directory.

What should you check in an IONOS site?

Open the relevant .htaccess file and look for an Options line affecting the directory. Options +Indexes is the exact enabling rule shown by IONOS; Options -Indexes is the Apache form that removes the Indexes option. Also check whether the directory contains the configured DirectoryIndex, because Apache documents that a file such as index.html is a separate source for the directory index.

FAQ

Does IONOS show directory contents to every visitor by default?

No. IONOS says the directory listing function is disabled on its servers by default for security, although its documentation describes the enabled listing as visible from outside by every visitor.

Which line enables a directory listing?

Use Options +Indexes in the applicable .htaccess file, subject to the hosting configuration accepting that directive.

How do you disable the Indexes option?

Use Options -Indexes. Apache documents the minus form as removing an option currently in force.

Sources

  1. IONOS, "Frequently Used .htaccess Directives", undated
  2. Apache HTTP Server, "Options Directive", undated
  3. Apache HTTP Server, "mod_autoindex", undated

Check how a page reads to answer engines. Open the GEO score analyzer

Test a page and see what to fix first

The analysis usually takes less than 10 seconds and needs no account.

400,000+ pages scored in the public benchmark