From time to time, I see web sites that do not have directory listing disabled. This happens on an Apache server that is not configured properly. If the webmaster create a directory and does not place an index.html (or index.php) file, the contents of the directory are there for everyone to see.

Not allowing the visitors see the directory listing does not make a website secure per se. But visitors can go up and down the directory trees if the listing is not disabled. In order to disable a directory listing of a particular directory and all of its subdirectories, you can just place a file called .htaccess with the following line on it.

Options -Indexes

As long as a subdirectory does not have its own .htaccess file that allow directory listing, it works.