How To Stop Uploads Folders Listing Their Files With BetterShield?

Place blank index files in your uploads folders so a browser asking for a folder gets no list of what is in it. Works on every web server.

With BetterShield, place blank index files in your uploads folders so a browser asking for a folder gets no list of what is in it. Works on every web server.

What it does

In BetterShield, a folder with no index file of its own can show a list of everything in it to anyone who asks for its address. WordPress ships blank index files in wp-content, plugins and themes, and leaves the uploads folder without one. Folder listing protection fills that gap. It is off until you turn it on, under Hide site details on BetterShield › Protection › Hardening. Quick Setup offers it as Block directory browsing.

Places a blank index.php in the uploads folder and the folders below it, two levels deep. On the usual layout that is uploads itself, each year folder and each month folder, such as uploads/2026/10/.
Only where nothing is there. A folder that already has an index.php or index.html is left alone, and no file is ever overwritten.
Files load as before. Images and documents keep their addresses. Only a request for the folder itself stops returning a list.
Works on every web server, nginx and IIS included, because it needs no server rules.
Large uploads folders. One pass places up to 500 files. If more folders need one, a daily task places 500 a day until every folder has one.
New folders. Once every folder has a file, the daily task still covers the current month’s folder and its year folder each day, and walks the whole tree again each week.

Every file it places is recorded, so undo can take it away again.

Step 1: Open BetterShield › Protection › Hardening

Open BetterShield › Protection › Hardening and find Folder listing protection under Hide site details.

Stop uploads folders listing their files: saved state and available controls in BetterShield. — Review the state and choices shown on your own site before applying a change.

Step 2: Stop uploads folders listing their files

Press Preview the change. It lists what applying would do and changes nothing.
Turn the switch on. The row shows On since, Undo never expires, and what it did.

It has no options, and Monitor first cannot watch it in advance: its panel points you back to the preview. From WP-CLI, wp bettershield harden directory_browsing --user=admin applies it and adding --undo reverses it. An AI assistant cannot apply or remove it: it writes files, so it stays your own switch.

What the row can say once it is on:

The row says	What it means
“Guard files were placed in 14 uploads directories that had none.”	The number of folders it covered.
“Every uploads directory already had a guard file, so none was placed. Nothing here is left listable.”	There was nothing to do, and the switch still counts as on.
“3 directories could not be written and were skipped.”	The server would not let WordPress write there. The rest were covered.
“The uploads tree is unusually large; the daily task will keep placing guards, five hundred per day, until every directory has one.”	More than 500 folders needed one.

It is refused, with nothing changed, when the uploads folder does not exist (“The change was not applied: the uploads directory does not exist.”) or when no folder could be written to.

Recommended settings

We recommend turning it on for every site. It changes nothing a visitor uses, and a file you uploaded but never linked can no longer be found by listing the uploads folder or the folders up to two levels below it.

Site	What we recommend
Agency or many sites	On every site, from Quick Setup or with WP-CLI. On a network, apply it on each site.

What it can break, and how to undo

Very little. Files keep loading at their own addresses, and nothing a visitor uses depends on a folder list. If you share a folder listing from uploads on purpose, it stops: link to the files themselves instead.

To undo, turn the switch off. It removes the files it placed, including any the daily task added later, but only those still exactly as it wrote them. Index files that were there before are never touched. With Ask for my password before removing a protection on, undo asks for your password.

If a file placed when you applied it has been changed, undo leaves it, stops, and the row says the last undo did not complete. Delete that file, then turn the switch off again. A changed file the daily task placed is also left in place, but the undo completes and no screen says so: the file is named only in the details of the “Hardening undone” entry, which the activity log’s Export CSV includes.

The files stay in place while safe mode is on and while BetterShield is deactivated. Deleting BetterShield keeps them too, unless you chose to remove its records under When this plugin is deleted on Settings › General.

Final Outcome

From outside. In a private window, open your uploads folder, usually /wp-content/uploads/, and a month folder such as /wp-content/uploads/2026/10/. You no longer get a list of files.

The row. It shows what was placed, and “This one has no effect a page view can check, so it is reported from your settings.”
Quick Setup. Block directory browsing reads Already on once every folder has an index file, whoever placed it.
The activity log. “Hardening applied”, again whenever the daily task places more, and “Hardening undone”.

The finding Folders in your uploads can be listed in a browser (2 setup points while open) also passes without this fix when your web server refuses to list a folder that has no index file. No finding about the protection opens while it is off. While it is on, Some protections that are switched on are not working (Medium) names it if an index file it placed was removed and left its folder listable.

Good to know

Folders deeper than two levels below uploads are not covered.
A new month’s folder is covered within a day, and other new folders within a week; to cover one at once, turn the switch off and on again.

On multisite

Each site has its own uploads folder and its own switch. In the preview’s words: “On this network it covers this site’s uploads directory only, so apply it on each site that needs it.”

This is how you can stop uploads folders listing their files with BetterShield.

Getting Stuck? Feel free to contact our Dedicated Support Team.