Disable directory listing

Directory listing is when the server shows a file menu for a folder that has no index page. On LogicWeb shared hosting, cPanel and LiteSpeed usually keep this off by default. A copied .htaccess or a plugin can turn it back on, so you disable it with Options -Indexes in .htaccess rather than relying on an empty index.html forever.

Why open listings are a problem

An open /uploads/ or /backup/ folder is convenient for you and for anyone else who finds the URL. The common failure is a backup.sql sitting in a listable directory. That single fetch can expose users, password hashes, and anything left in options. The same risk applies to zip files of wp-content, .env files, and old copies such as wp-config.php.bak.

A .htaccess taken from an Apache tutorial with Options +Indexes will override the server default. Some file-manager plugins that browse uploads in public can do the same. Check the HTTP response, not what the tool claimed it would do.

Confirm listing is off

Test the folders that matter before you change anything. You want a 403, or a 200 that returns your theme’s page, not a 200 whose body contains “Index of”.

curl -sI https://example.com/wp-content/uploads/ | head

Also try /wp-content/ and any /backup/ path you ever created. If you see a listing, add Options -Indexes to the account’s .htaccess. On a VPS you can set the same option in the vhost include so a deleted .htaccess cannot reopen the menu. Remove every +Indexes line you find, then curl again.

Clean up what the menu would have shown

Year-month folders under uploads inherit the parent. If the parent lists, they list. Older backup plugins often use paths like /wp-content/backup-db/ or /public_html/old/. Curl those too. A 200 with a file listing is the incident; a 403 means you are done for that path.

LiteSpeed honors Options -Indexes in .htaccess unless a later include turns indexing back on. Turning the menu off is not a storage policy. Search public_html for zip, sql, tar, and bak files after you disable listing. The menu is gone, but those files may still download if someone already knows the name. Rename is not enough. Delete them or move them above public_html. JetBackup already keeps copies that are not reachable by URL.

Moving wp-config above the document root is useful extra hardening for that one file. Directory listing is the menu that tells people which names to try first. Turn the menu off, then remove the sensitive files from the web root.