My site build with Magento
someone sends me a mail with an attached image which is my listed directory. My question is how they fetch this. Did any setting to avoid this type of access.

enter image description here

2 Answers 2


Hiding directory listing is quite simply adding below line to .htaccess:

Options All -Indexes

This is normally the case for public facing folders like media where users will need access for product images however you still do not want them listing files when accessing domain.com/media

For many folders within magento there should already be .htaccess set up for which should not have public access. This will then just show the folder as Forbidden when browsed e.g. /var driectory:

Order deny,allow
Deny from all

Check your .htaccess are all present similar to magento 1 base code.

  • What is the directory you got listed? I have improved my explanation. Media needs access but not listing the later completely blocks access to files within that folder e.g. var
    – harri
    Nov 2, 2017 at 9:37
  • That is looking better i was just looking at all your var directory cached configs and then you blocked that atleast.
    – harri
    Nov 2, 2017 at 9:43
  • images can't load if I put htaccess on skin folder. Nov 3, 2017 at 11:48
  • Yeah that's what i said in the answer. Use the Option All -indexes on media. There should already be a htaccess present with this in there however. But yeah dont deny access on folders like media
    – harri
    Nov 3, 2017 at 11:59
  • @PratikKamani did you fix this?
    – harri
    Nov 6, 2017 at 10:43

As far as i know, below points can be considered of the hacking possibilities.

  1. Few of the security patches are not installed : https://www.magereport.com/scan/?s=https://www.yourshop.com/

  2. Check the proper folder permissions, maintain strong passwords and reset all old/previous settings.

  3. Contact your hosting provider on what are the possibilities for causing this. they may have clear tracking on ftp ssh/ftp log-ins with ip's.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.