Turn off Apache directory listings and version banners

The fixapache2.conf / httpd.conf

<Directory /var/www/html>
    Options -Indexes +FollowSymLinks
</Directory>

ServerTokens Prod
ServerSignature Off

Directory listings are the real item here

When a directory has no index file, mod_autoindex generates a browsable listing of everything in it. That is a genuine disclosure, and it is a qualitatively different thing from the version banner below it on this page.

What tends to be in those directories:

• /uploads/ — every file your users uploaded, enumerable.
• /backup/, /old/, /tmp/ — database.sql.bak, config.php.old, .env.backup. Files nobody linked to but everybody can now find.
• /.git/ — if the repository was deployed, the listing hands over the whole source history including secrets that were committed and later “removed”.

None of those require a bug. Apache is doing its job: you asked for a directory, there was no index, here’s what’s in it.

Options -Indexes turns it off. Better still, disable the module, so the directive is belt and braces rather than the only thing standing between a visitor and your file list:

sudo a2dismod autoindex

ServerTokens is obscurity, and worth saying so

ServerTokens Prod

That changes Server: Apache/2.4.68 (Debian) to Server: Apache. It removes the version and the OS. It does not remove the Server header, and it does not hide that you’re running Apache.

The narrow, real benefit: mass scanners match on version strings. A bot working through the internet for hosts vulnerable to a specific CVE reads the banner and moves on if it doesn’t match. Removing the version drops you out of that bucket.

It buys nothing against anyone who has decided to look at you — response fingerprinting identifies Apache and narrows the version anyway.

And the important part: the version number is not the vulnerability. On 2.4.68 you’re patched whether or not anyone knows. On 2.4.66 you have a remotely reachable double-free and hiding the banner does not unpatch the attacker. This is housekeeping, not a control — which is why the whole page is medium and it’s the listings half carrying that rating.

ServerSignature Off removes the version footer Apache appends to its own error pages. Same category, same value.

Options is all-or-nothing per directory

A subtlety that bites: Options does not merge. If a directory specifies any Options without + or -, it replaces the inherited set entirely rather than adding to it.

<Directory /var/www/html>
    Options -Indexes +FollowSymLinks
</Directory>
<Directory /var/www/html/app>
    Options FollowSymLinks          # replaces — and -Indexes is now gone
</Directory>

That second block has silently re-enabled indexes for /app, because a bare Options FollowSymLinks discards the parent’s -Indexes. Always use + and -, never a bare list, and Apache will merge rather than replace.

This is Apache’s version of nginx’s add_header trap — different directive, same shape of surprise.

Verify it worked

Find directories that would list. This is the check that matters:

sudo grep -rn 'Options' /etc/apache2/ /etc/httpd/ 2>/dev/null | grep -vE '\-Indexes|Options None'

Any Options line containing Indexes — or a bare Options list that drops an inherited -Indexes — is a directory that publishes its contents.

Confirm the module:

sudo apachectl -M 2>/dev/null | grep autoindex

Then prove it from outside. Make a directory with no index and ask for it:

sudo mkdir -p /var/www/html/_listtest && echo x | sudo tee /var/www/html/_listtest/f.txt >/dev/null
curl -si http://localhost/_listtest/ | head -1
sudo rm -rf /var/www/html/_listtest

Expect 403 Forbidden. 200 with an “Index of /_listtest” page is the finding.

Check the banners:

curl -sI https://your.site/ | grep -i '^server:'
curl -s https://your.site/definitely-not-real | grep -i apache

Expect Server: Apache with no version, and no version in the error page footer — the footer is where people find it after “removing” it from the header.

Before you apply this

Options -Indexes breaks anything that relied on a browsable listing — a downloads directory, a file drop, a package repository served as plain files. Those are real use cases and the failure is a 403 where users expect a list.

Check whether anything is actually being browsed:

sudo grep -E ' "GET [^"]*/ HTTP' /var/log/apache2/access.log 2>/dev/null | \
  grep ' 200 ' | awk '{print $7}' | sort | uniq -c | sort -rn | head

Directory paths returning 200 there are listings people are using. If one is legitimate, re-enable it for that path alone rather than globally:

<Directory /var/www/html/downloads>
    Options +Indexes
</Directory>

Watch the Options merge rule when you do that — Options +Indexes adds to the inherited set; Options Indexes replaces it and would drop +FollowSymLinks, which may break symlinked content elsewhere.

ServerTokens and ServerSignature break nothing. The only risk is the false sense of progress: they are the easiest items on the checklist and produce a visible change, which makes them a tempting place to stop. Confirm the thing that actually matters first:

apachectl -v
apt list --upgradable 2>/dev/null | grep -i apache

Related

• Disable unused modules — removing mod_autoindex entirely.
• Keep Require all denied — the block where Options None lives.