Today I found that my web server doesn’t disable directory listing by default. This can be a vulnerability for WordPress since the wp-content directory can be exploited. So test your blog: if your web server doesn’t turn off directory listing by default, please follow these steps (only works for Apache web server):
1. Create or edit the existing .htaccess file.
2. Add this code:
Options -Indexes3. Save and close the .htaccess file.
4. Test it!
That step will turn off directory listing. Thank you for reading, and have a nice day… 🙂