Server Configuration
WordPress Upload Folder Indexing Check (wp-content/uploads/)
The wp-content/uploads/ folder may be exposed if indexing is enabled. Learn how to protect your uploaded files from public viewing and data leaks.
What this test checks
This test checks whether the WordPress upload folder (wp-content/uploads/) is accessible and whether indexing is enabled. An unprotected folder allows any visitor to list all uploaded files, including confidential documents, photos, invoices, or malicious files. This constitutes a critical information leak.
Our recommendation
Protect the uploads folder with a .htaccess file containing 'Options -Indexes' or, for Nginx, use 'autoindex off;'. Add an empty index.html file in the folder to hide its content. If you use a security plugin, enable its upload folder protection options. Regularly verify these protections remain in place.
Security tests
Read more
Server Configuration