Seeing a "directory index is forbidden nginx" message usually means the server is blocking direct browsing of a folder because no default file is present or directory listing is explicitly disabled. This behavior is common on secure production sites where leaving directories open would expose sensitive files or reveal internal structure.
The issue is easy to fix once you understand how Nginx handles missing index files and directory permissions. Below you will find a quick reference, deeper explanations, configuration guidance, and answers to common questions about this specific error.
| Error Message | Typical Cause | Quick Diagnostic | Action |
|---|---|---|---|
| 403 Forbidden directory index is forbidden | No index file (e.g. index.html) and autoindex off | Check Nginx access and error logs for exact URI | Add an index file or enable autoindex for debugging only |
| 403 Forbidden | File permissions too restrictive for Nginx worker process | Verify that the Nginx user can read the directory and files | Adjust ownership or permissions to be readable by www-data or nginx user |
| 404 Not Found | Location or root path misconfigured in server block | Check root and alias directives along with try_files order | Correct the path or ensure try_files includes $uri $uri/ =404 |
How Nginx Handles Directory Index Requests
Default Index Behavior
Nginx looks for files defined by the index directive, typically index.html or index.php, when a request ends with a slash. If none of the listed files exist and autoindex is disabled, Nginx returns 403 with the error "directory index is forbidden". This protects directories that lack a default landing page.
Role of the Autoindex Directive
The autoindex on directive turns on directory listing, which generates a page showing all files in the folder. This is helpful for debugging or internal environments but should never be enabled on public, production servers because it exposes file names and potentially sensitive information.
Common Configuration Mistakes Leading to This Error
Missing Index File and Disabled Listing
A very frequent cause is a folder that does not contain an index file while autoindex remains off. For static content, you should either place an index.html in each public directory or adjust location blocks that should serve directory content differently.
Location Block Overrides
Location blocks that explicitly disable autoindex or change root can override broader rules. If you use try_files $uri $uri/ =403 inside a location that also governs directory access, a missing trailing slash or incorrect fallback can trigger the forbidden directory index message.
Server and File Permission Checks
File System Permissions
Even with correct Nginx configuration, the worker process, often running as www-data or nginx, must have read and execute permissions on the directory and read permissions on the files. A too-restrictive mode or wrong owner can cause a 403 that looks like a directory index issue.
Path and Root Context
Make sure the root or alias paths point to the exact directory you expect. A mismatched root combined with a location pattern can route requests to a folder that does not have an index file, producing the forbidden index error.
Recommended Actions and Best Practices
- Place a default index.html or index.php in every public directory served by Nginx.
- Verify Nginx user ownership and file permissions with ls -l and stat commands.
- Check server and location blocks for conflicting root, alias, or try_files settings.
- Use error_log at debug level temporarily to trace exactly which path Nginx is unable to serve.
- Never enable autoindex on publicly accessible servers, and remove it after debugging.
FAQ
Reader questions
Why do I see "directory index is forbidden nginx" on a folder that seems to have files?
The folder likely has no index file such as index.html and autoindex is turned off, which makes Nginx reject directory browsing by default.
Should I enable autoindex to fix this issue?
Enable autoindex only for temporary debugging on non-public servers. In production, add a proper default index file or adjust the location logic instead of exposing directory contents.
What permissions should the directory and files have for Nginx on Linux?
Directories need at least 755 and files need at least 644, with the Nginx worker user such as www-data having read and execute access to the directory hierarchy.
Can a proxy pass or internal redirect trigger this error?
Yes, if a proxy_pass or internal redirect points to a directory without an index file and autoindex is off, you will see the same 403 directory index forbidden response.