Question

I’ve heard this many and many times: “create a index.php on every folder in your web server to make sure users will not see a list of files in the folders”

is that true? I’m in need of some good pratices for security.

Answer 1

Short answer: No.

Long answer: Yes.

Having a default document may indeed prevent a directory listing to be outputted, but:

• You could prevent directory listings in other ways (.htaccess, server configuration)
• One could still find files if they guess the file name.
• You could put all files outside of the document root and only have a single script that routes all urls. Thus, there is nothing to list.

So while you’re right, it is easy to forget a directory, and a lot of work to create all those files. And it only protects your from listing, and only if index.html is indeed the default document name (again: server configuration). It doesn’t prevent any direct access to your script, so please please please use a more proper security.