My site build with Magento 126.96.36.199.
someone sends me a mail with an attached image which is my listed directory. My question is how they fetch this. Did any setting to avoid this type of access.
As far as i know, below points can be considered of the hacking possibilities.
Few of the security patches are not installed : https://www.magereport.com/scan/?s=https://www.yourshop.com/
Check the proper folder permissions, maintain strong passwords and reset all old/previous settings.
- Contact your hosting provider on what are the possibilities for causing this. they may have clear tracking on ftp ssh/ftp log-ins with ip's.
Hope this helps.
Hiding directory listing is quite simply adding below line to .htaccess:
Options All -Indexes
This is normally the case for public facing folders like media where users will need access for product images however you still do not want them listing files when accessing domain.com/media
For many folders within magento there should already be .htaccess set up for which should not have public access. This will then just show the folder as Forbidden when browsed e.g. /var driectory:
Order deny,allow Deny from all
Check your .htaccess are all present similar to magento 1 base code.