Is my website exposing its file directories?

Directory listing is when a web server, asked for a folder that has no index page, responds by showing the raw list of files inside it instead of an error. Left on, it hands visitors a map of your site’s internals:

• What gets exposed - backups, uploads, old files and configuration left in a folder become browsable, giving an attacker a head start on what to target.
• How to check - visit a folder path on your site directly, such as yourdomain.com.au/uploads/; if you see a bare list of files rather than your page or a ‘not found’ error, listing is on.
• The fix - switch directory listing off in your server or hosting control panel so those requests return a proper error instead.

A folder on your site should never answer with its file list - turn directory listing off everywhere.