Fix Nginx “directory index is forbidden” errors

This error usually means Nginx reached a directory but could not select an index file, and directory listing was disabled. Decide whether the URL should serve an application page, an index file, or a public file listing before changing the configuration.

Configure the intended index

For a request such as /downloads/, Nginx checks the filenames listed by index; the default is index.html. If the page has a different name:

location / {
    index index.php index.html index.htm;
}

Names are tried in order. Selecting an index performs an internal redirect, which can select another location. Adding index.php does not execute PHP by itself: the resulting PHP request must have a working FastCGI handler. Otherwise, source code could be served as a file.

Enable listing only for a public directory

For a directory deliberately offered for browsing:

location /downloads/ {
    autoindex on;
    autoindex_exact_size off;
    autoindex_localtime on;
}

This shows readable file sizes and server-local timestamps. An available index file still takes precedence over listing. Keep backups, configuration files, and private uploads out of the listed directory; listing is not an access-control mechanism.

Check the path and permissions

An index file's presence does not rule out a wrong root, another location, access rules, or a security-policy denial. Inspect the exact path named in the error log:

ls -la /var/www/site/
namei -l /var/www/site/index.html
sudo tail -50 /var/log/nginx/error.log

The worker user needs search (x) permission on every parent directory and read access to the file it serves. Check the worker's user and group rather than assuming the root-owned master also serves files.

On SELinux systems, inspect enforcement, labels, and audit denials:

getenforce
ls -Z /var/www/site/

Static web content commonly uses httpd_sys_content_t. Make persistent label changes through the system's file-context policy when necessary; ordinary Unix mode bits cannot override an SELinux denial.

After a configuration change, test and reload the correct instance, then request the original directory URL. A successful direct request to /downloads/file.zip does not prove /downloads/ selects the right index.

FAQ

Can I hide the directory listing and keep direct downloads?

Yes. Leave autoindex off. A directory without a usable index can return 403 while an allowed, readable file beneath it remains accessible by its exact URL.

Why does an index directive in my location appear ineffective?

Inspect the matched location, inherited settings, and any internal redirect. Use nginx -T to inspect the on-disk include chain, and check reload logs before assuming workers accepted it.

Does every 403 mean the index is missing?

No. Use the specific error message. Permission denied and access forbidden by rule point to different checks from directory index ... is forbidden.

References: index files, directory listing.