Unless the web server is being utilised to share static and
non-sensitive files, enabling directory listing is considered a poor
security practice

This can typically be done with a simple
configuration change on the server. The steps to disable the directory
listing will differ depending on the type of server being used (IIS,
Apache, etc.). If directory listing is required, and permitted, then
steps should be taken to ensure that the risk of such a configuration
is reduced.

These can include:

1. Requiring authentication to access affected pages.

2. Adding the affected path to the `robots.txt` file to prevent the
directory contents being searchable via search engines.

3. Ensuring that sensitive files are not stored within the
web or document root.

4. Removing any files that are not required for the application to
function.
