# Ensure Vercel project has directory listing disabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790261999859131-ensure-vercel-project-has-directory-listing-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Directory Listing setting is disabled for the project, so that a request for a folder that has no index file returns a 404 error instead of showing a list of all the files in that folder. This keeps the structure and contents of deployments hidden from visitors.

**Rationale**

When directory listing is enabled, visitors can browse the contents of any folder that does not have an index file. This can reveal file names, backups, configuration files, and other files that were never meant to be linked or found. Attackers can use this information to map the application and find sensitive files.

**Impact**

-   Hides the file structure of deployments
    
-   Reduces the risk of exposing unlinked files
    
-   Folders without an index file return 404
    

**Default Value**

By default, Directory Listing is disabled for projects created after January 12, 2021, and it was turned off for older projects in 2021.

**Pre-Requisites**

-   Team Owner or Member role, or Project Administrator
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar and select Advanced.
    
5.  In the Directory Listing section, verify that the toggle shows Disabled.
    
6.  If it is enabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar and select Advanced.
    
5.  In the Directory Listing section, turn off the toggle so it shows Disabled, and select Save.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar and select Advanced.
    
5.  In the Directory Listing section, turn on the toggle and select Save.
    

**Reference**

-   [https://vercel.com/docs/directory-listing](https://vercel.com/docs/directory-listing)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.