Identify the domain’s actual document root and the folder you intend to change. Save its current index setting and check whether an application needs a legitimate public listing.

1. Open Indexes and select the appropriate domain root through Settings if necessary.
2. Navigate to the target folder and choose its edit action. Confirm the complete path before changing the setting.
3. Select No Indexing and save. The Inherit option follows a parent or server setting and may not explicitly disable listings.
4. Visit the folder URL without an index filename in a fresh browser session. Confirm the server no longer displays its contents.
5. Test the application’s normal pages and directly linked public assets. Move backups, credentials and private exports outside the public root rather than relying only on a hidden listing.

The directory should stop listing files while legitimate application URLs continue to work. A forbidden response for a bare directory can be the expected result when no index page exists.

If a listing remains, confirm the correct root, inherited configuration and any reverse-proxy cache. If a normal page breaks, restore the saved setting while investigating the application’s own routing. Do not add an empty homepage merely to conceal exposed confidential files.

Yes, disabling the listing does not automatically deny direct access to a file. Use proper access control or non-public storage for information visitors must never retrieve.

• Moving an addon domain to a new document root
• Finding hidden configuration files in cPanel File Manager
• Correcting file permissions without using 777
• Preventing unwanted image hotlinking with cPanel

• cPanel: Indexes
• cPanel: Directory Privacy