Vanta Panel
Directory Indexes
Choose what visitors see when they open a folder with no index file: a 403 Forbidden, or a browsable listing of its contents. Covers why 403 is the safer default, which filenames count as an index file, and how to override the setting for a single folder.
Controlling directory listings in vPanel.
Directory Indexes (vPanel → Dashboard → Files → Directory Indexes) decides what a visitor sees when they open a folder on your site that has no index file in it. There are only two possible answers, and the page is a single dropdown to choose between them.
The two settings
Forbid directory listing (403) — the default and the recommendation. A folder with no index file returns 403 Forbidden and the names of the files inside it stay private.
Show a listing of the folder's files — Apache generates a browsable table of the folder's contents: names, sizes and dates, with folders sorted first.
Why the default matters
A directory listing is a free map of your site for anyone who cares to look. Open /uploads/, /backup/ or /includes/ and a visitor gets every filename, including the ones you assumed nobody would guess — a stray database dump, an old config.php.bak, a client's PDF. Nothing is being served that was not already reachable, but they no longer have to guess a name to reach it.
Leave listings off unless you have a folder you genuinely want browsable.
An "index file" means one of these
Vanta Panel's vhosts are created with DirectoryIndex index.php index.html index.htm. Apache serves the first of those it finds, in that order. If none is present, this setting decides what happens next. So the simplest fix for one folder you want closed is to drop an empty index.html into it.
How it is applied
The setting is written into ~/public_html/.htaccess, in a managed block:
# BEGIN vantapanel-index (managed by Vanta Panel)
Options +Indexes
IndexOptions FancyIndexing HTMLTable SuppressDescription NameWidth=* FoldersFirst
# END vantapanel-indexTurning listings off removes that block rather than adding a negative rule, because listings are already off in the Apache vhost — the vhost is created with Options -Indexes. The .htaccess block only ever exists to switch them on.
Only the text between the markers is rewritten; the rest of your .htaccess is preserved.
Scope and overrides
The block lives in public_html/.htaccess, so it applies to everything under it — including subdomain and addon domain folders, which sit inside public_html. It is a single account-wide switch, not a per-folder one.
Per-folder control is still available, just not from this page. Because AllowOverride All is set, an .htaccess in any subfolder wins for that subfolder and everything below it:
Options -Indexesor, to open one folder while listings are off account-wide:
Options +IndexesRelated
If what you actually want is to keep people out of a folder entirely rather than merely hide the file names, use Directory Privacy to require a username and password. And when a folder returns 403, that is the response your custom 403 error page is shown for.