Directory listing enabled on wp-content/uploads

What it is

Directory listing is enabled on wp-content/uploads — anyone can browse the full contents of that folder in a web browser, including files that were never meant to be linked from anywhere, and anything already dropped there by an attacker.

How to fix it

Disable directory listing on wp-content/uploads (an .htaccess/server rule) — the WordPress Plugin's Security tab applies this automatically.

In depth

Your website currently has a setting active that allows anyone to view a complete list of all the files stored in your uploads folder, similar to leaving a filing cabinet unlocked. This means visitors or potential attackers can browse through every image, document, or file you have ever uploaded, even if you never linked to them publicly. Attackers can use this to find files containing sensitive information, or to understand your site's structure in preparation for other attacks. To fix this, you need to disable directory listing so people can only access a file if they have the direct link to it. The fastest way is to install a security plugin like Wordfence or iThemes Security, which will add the necessary code to your uploads folder automatically. Alternatively, if you have access to your hosting control panel (cPanel), you can disable directory listing through the File Manager settings yourself. Either approach takes just a few minutes and immediately closes this security gap.