Server Configuration
Drupal Upload Folder Indexing Check (sites/default/files/)
The Drupal upload folder (sites/default/files/) may be exposed if indexing is enabled. Learn how to protect your files from public viewing.
What this test checks
This test checks whether the Drupal upload folder (sites/default/files/) is accessible and whether indexing is enabled. An unprotected folder allows any visitor to list all uploaded files, including images, documents, and sometimes sensitive files, exposing your data.
Our recommendation
Protect the files folder with a .htaccess file containing 'Options -Indexes' or, for Nginx, 'autoindex off;'. Add an empty index.html file in the folder. Regularly check the folder access to ensure indexing is disabled.
Security tests
Read more
Communication Security