File-Directory-Browser

File & Directory Browser Banner

📁 File & Directory Browser

Enterprise-Grade Single-File PHP Directory Indexer & Secure File Explorer

Latest Release v4.1.0 PHP 8.0 to 8.5+ License: MIT PHPStan Level 9 WCAG 2.2 AAA Security Hardened PSR-12 Compliant

A secure, lightweight, and modern single-file PHP directory indexer with glassmorphic UI, real-time search, atomic hash caching, bcrypt folder protection, strict Content Security Policy, and zero external dependencies.

Download Latest Release v4.1.0 All Releases

Designed and maintained by
HARRY DERTIN SUTISNA ALSYUNDAWY (@alsyundawy) —
Modern drop-in replacement for Apache mod_autoindex and Nginx autoindex with zero database or package dependencies.

📦 GitHub Releases (v4.1.0)  |  ⚡ Quick Start  |  🔒 Security Architecture  |  📜 Full Changelog  |  💖 Support via PayPal  |  🇮🇩 QRIS Donation

🧭 Navigation

About The Project

File & Directory Browser is a security-hardened, high-performance, single-file PHP directory indexer and file explorer. Designed as a modern, elegant replacement for standard web server auto-indexing modules (such as Apache mod_autoindex or Nginx autoindex), it delivers a responsive web experience without requiring database servers, heavy backend frameworks, or NPM/Composer package dependencies.

Everything runs self-contained from a single index.php file, featuring instant client-side search filtering, deterministic multi-attribute sorting, on-demand checksum generation (CRC32, MD5, SHA-1) backed by an atomic local caching system, bcrypt folder protection, enterprise-grade defense-in-depth security headers (CSP nonce, HSTS, anti-indexing), and a Glassmorphic UI fully compliant with WCAG 2.2 AAA accessibility standards.

User Interface

Modern Glassmorphic Dark UI

Modern Glassmorphic Dark UI

Classic Ambient Dark UI

Classic Ambient Dark UI

Key Features

System Requirements

Requirement Minimum Version Recommended Notes
PHP 8.0 8.2 — 8.4+ Full compatibility across PHP 8.0, 8.1, 8.2, 8.3, and 8.4+
PHP Extensions session, hash, json, pcre, spl Standard All are standard built-in PHP core extensions
Web Server Any standard web server Apache 2.4+ / Nginx 1.20+ Works with Apache, Nginx, Caddy, Lighttpd, or PHP CLI built-in server
HTTPS / SSL Strongly Recommended Let’s Encrypt / TLS 1.3 Required for secure cookies, HSTS enforcement, and CSRF protection
Database None None Zero database required — operates completely file-based

Quick Start

  1. Download: Grab the latest index.php from the Releases page or clone the repository:

    git clone https://github.com/alsyundawy/File-Directory-Browser.git
  2. Deploy: Copy index.php into the directory on your web server that you want to browse and share.
  3. Configure: Open index.php in any text editor to customize optional settings (page title, password-protected folders, date format, etc.).
  4. Browse: Open your web browser and navigate to your directory URL (e.g. http://localhost/files/ or https://yourdomain.com/).

Production Installation Guide (Ubuntu / Debian)

Below are production-ready installation guides for Ubuntu (20.04 / 22.04 / 24.04 LTS) and Debian (11 / 12) using either Apache or Nginx + PHP-FPM.

Step 1: System Preparation & File Deployment

Update your system package repositories and deploy the project files to your target web directory:

# Update package repositories
sudo apt update && sudo apt upgrade -y

# Install Git and essential utilities
sudo apt install -y git unzip curl

# Create target web root directory
sudo mkdir -p /var/www/file-browser

# Clone repository into web directory
sudo git clone https://github.com/alsyundawy/File-Directory-Browser.git /var/www/file-browser

# Set ownership to the web server user (www-data)
sudo chown -R www-data:www-data /var/www/file-browser
sudo chmod -R 755 /var/www/file-browser

# Grant write permissions for the .cache directory (required for hash caching)
sudo chmod -R 775 /var/www/file-browser

Step 2 (Option A): Apache Web Server Setup

If you are using the Apache HTTP Server:

1. Install Apache & PHP Modules

# Install Apache and PHP runtime with required extensions
sudo apt install -y apache2 php php-cli libapache2-mod-php php-json php-mbstring

# Enable required Apache modules (rewrite & headers)
sudo a2enmod rewrite headers

2. Configure Apache Virtual Host

Create a new Virtual Host configuration:

sudo nano /etc/apache2/sites-available/file-browser.conf

Add the following configuration (replace files.example.com with your domain or server IP):

<VirtualHost *:80>
    ServerName files.example.com
    ServerAdmin webmaster@example.com
    DocumentRoot /var/www/file-browser

    <Directory /var/www/file-browser>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # Block direct access to hidden files and directories (.env, .git, etc.)
    <FilesMatch "^\.">
        Require all denied
    </FilesMatch>

    # Logging
    ErrorLog ${APACHE_LOG_DIR}/file-browser_error.log
    CustomLog ${APACHE_LOG_DIR}/file-browser_access.log combined
</VirtualHost>

3. Enable Site & Restart Apache

# Enable the Virtual Host
sudo a2ensite file-browser.conf

# Optional: Disable the default Apache welcome page
sudo a2dissite 000-default.conf

# Verify Apache configuration syntax
sudo apache2ctl configtest

# Restart Apache service
sudo systemctl restart apache2

Step 2 (Option B): Nginx + PHP-FPM Setup

If you are using Nginx for lightweight, high-performance web delivery:

1. Install Nginx & PHP-FPM

# Install Nginx and PHP-FPM with essential extensions
sudo apt install -y nginx php-fpm php-cli php-json php-mbstring

[!NOTE] Check your installed PHP-FPM socket version (e.g. /run/php/php8.3-fpm.sock or /run/php/php8.2-fpm.sock) by running: ls -la /run/php/php*-fpm.sock.

2. Configure Nginx Server Block

Create a new Nginx server configuration:

sudo nano /etc/nginx/sites-available/file-browser

Add the following configuration (adjust server_name and the fastcgi_pass socket path to match your environment):

server {
    listen 80;
    listen [::]:80;
    server_name files.example.com;

    root /var/www/file-browser;
    index index.php;

    charset utf-8;
    client_max_body_size 100M;

    # Primary routing: route through index.php if not a direct static file
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    # Pass PHP scripts to FastCGI server (PHP-FPM)
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;

        # Adjust PHP-FPM socket path to match your installed PHP version:
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        # For PHP 8.2 use: fastcgi_pass unix:/run/php/php8.2-fpm.sock;

        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Deny direct access to .cache directory and hidden dotfiles
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Deny direct access to sensitive file extensions
    location ~* \.(env|git|sql|htaccess|htpasswd)$ {
        deny all;
        return 404;
    }

    # Logging
    error_log  /var/log/nginx/file-browser_error.log;
    access_log /var/log/nginx/file-browser_access.log;
}

3. Enable Site & Restart Nginx

# Create symbolic link to enable site
sudo ln -s /etc/nginx/sites-available/file-browser /etc/nginx/sites-enabled/

# Optional: Remove default Nginx welcome site
sudo rm -f /etc/nginx/sites-enabled/default

# Verify Nginx configuration syntax
sudo nginx -t

# Restart Nginx and PHP-FPM services
sudo systemctl restart nginx
sudo systemctl restart php*-fpm

Step 3: SSL / HTTPS Encryption with Let’s Encrypt (Recommended)

To protect session cookies, authentication tokens, and enable automatic HSTS enforcement in transit, secure your installation with automated SSL certificates via Certbot:

# For Apache:
sudo apt install -y certbot python3-certbot-apache
sudo certbot --apache -d files.example.com

# For Nginx:
sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d files.example.com

Certbot will automatically install the certificate, configure HTTPS redirects, and establish an automated background renewal timer.

Configuration Reference

Open index.php in any text editor to adjust the configuration parameters located at the top of the file:

General Settings

// =================== GENERAL SETTINGS ===================
$browseDirectories       = true;                  // Allow browsing sub-directories
$title                   = 'Index of ';   // Page title format ( is dynamic)
$subtitle                = ' files,  total'; // Subtitle format
$showParent              = true;                  // Show parent directory link (..)
$showDirectories         = true;                  // Display directories in file table
$showDirectoriesFirst    = true;                  // Group directories at the top of listing
$showHiddenFiles         = false;                 // Hide/show dotfiles (.example)
$alignment               = 'left';                // Text alignment ('left' or 'center')
$showIcons               = true;                  // Display Font Awesome file/folder icons
$dateFormat              = 'd-M-Y H:i';           // Date format for file modified time
$sizeDecimals            = 1;                     // Decimal places for file sizes
$browseDefault           = '';                    // Default folder path on initial load
$allowExternalSymlinks   = false;                 // Allow symlinks outside base directory
$enableHashCache         = true;                  // Enable local cache for file checksums
$hashCacheVersion        = '2026-07-08-v2';       // Internal cache schema version
$timezone                = 'Asia/Jakarta';        // Default application timezone

Folder Password Protection

To password-protect specific folders, generate a bcrypt hash and map folder names to their hashes in $protectedFolders:

# Generate a secure bcrypt hash via your terminal:
php -r "echo password_hash('your_secret_password', PASSWORD_BCRYPT);"

Then configure the array in index.php:

// =================== FOLDER PASSWORD PROTECTION ===================
$protectedFolders = [
    'secret-docs' => '$2y$12$YourGeneratedBcryptHashHere...',
    'private'     => '$2y$12$AnotherGeneratedBcryptHashHere...',
];

$passwordSessionLifetime = 2400; // Login session validity in seconds (default: 40 minutes)
$loginMaxAttempts        = 5;    // Max failed login attempts before lockout
$loginLockSeconds        = 300;  // Lockout duration in seconds (5 minutes)

[!IMPORTANT] Never store plaintext passwords. Always use a bcrypt hash generated via password_hash($password, PASSWORD_BCRYPT).

Keyboard Shortcuts

Shortcut Action Description
/ or Ctrl + K (Cmd + K on macOS) Focus Search Instantly highlights and focuses the search input bar from anywhere on the page
Escape Clear & Dismiss Clears active search filters, restores the full listing, and removes input focus

Security Architecture

The application enforces a defense-in-depth security model across every layer:

  1. HTTP Strict Transport Security (HSTS): Automatically detected and emitted when served over HTTPS with a 1-year max-age and preload directives.
  2. Dynamic Nonce Content Security Policy (CSP): Eliminates XSS vectors by enforcing strict cryptographic nonces for script and style elements.
  3. Path Traversal Sanitization: Uses realpath() boundary validation and recursive directory traversal checks to reject any directory escape attempts.
  4. Symlink Containment Protection: Validates that symbolic links resolve strictly within the permitted webroot boundary before enumeration.
  5. Anti-Indexing Search Privacy: Standardized X-Robots-Tag and meta robots tags prevent search engine indexing of private directory hierarchies.
  6. Hardened Cookie Sessions: Session cookies leverage HttpOnly, SameSite=Strict, and Secure attributes with session fixation defenses.
  7. Timing-Attack Safe Authentication: Password verification uses constant-time password_verify() against bcrypt hashes.
  8. CSRF Token & Rate-Limiting: Cryptographic bin2hex(random_bytes(32)) CSRF tokens and brute-force attempt lockout timers.
  9. Multi-Server Cache Protection: Automatic .htaccess and index.html generation within .cache/ blocks directory listings across Apache, Nginx, Caddy, and Lighttpd.

Quality Assurance & Static Analysis

The codebase adheres to rigorous static analysis standards with zero tolerated warnings:

Changelog

Version 4.1.0 (October 26, 2026) — PHP2Shell Defense, TLS Hardening, Subdirectory Portability, Xiaomi/POCO Mobile, 2026 SEO & WCAG AAA Color Polish

Version 4.0.0 (September 27, 2026) — Security Hardening, Mobile SVH & Viewport Polish, WCAG 2.2 AAA & Semantic Architecture

Version 3.9 (August 3, 2026) — Full Security Audit, Accessibility WCAG 2.2, Strict PHPStan Max & Performance Polish

Version 3.8 (July 29–30, 2026) — Security Hardening, DevSkim, CSP Compliance & Code Quality

Version 3.7 (July 18, 2026) — Bug Fixes, Security Hardening & Code Quality

Version 3.6 (July 18, 2026) — Security Hardening, CSP Compliance & Performance

Version 3.5 (July 14, 2026) — Premium Glassmorphic Dark Theme

Version 3.4 (July 14, 2026) — URL Sanitizer, Rate-Limit & UI Enhancement

Version 3.3 (July 13, 2026) — Strict CSP Compliance & Clean Layout

Version 3.2 (July 13, 2026) — Password Protection & UI Enhancement

Version 3.1 (July 13, 2026) — Refactoring & Subresource Integrity

Version 3.0 (July 8, 2026) — Aesthetic Overhaul

Documentation Notes

[!IMPORTANT]

  1. Cache Folder Permissions: Ensure that the directory containing the script has write permissions so it can create the .cache folder automatically. If write permissions are unavailable, file checksum caching is safely bypassed to guarantee uninterrupted runtime.
  2. HTTPS/SSL Deployment: It is strongly recommended to host this script under an SSL/HTTPS domain to guarantee encryption of CSRF session cookies, authentication tokens, and automatic HSTS header activation.
  3. Exclusion of Sensitive Files: Critical file extensions including .php, .env, .sql, .htaccess, .git, and others are blocked by default from being listed, viewed, or hashed to prevent unauthorized code execution and credential leaks.
  4. Folder Passwords (Must Be Hashed): Folder protection passwords must not be stored in plaintext. Always use the output of password_hash('your_password', PASSWORD_BCRYPT). Generate a hash with: php -r "echo password_hash('your_password', PASSWORD_BCRYPT);"
  5. CSP & Nonce Enforcement: This script enforces a strict nonce-based Content-Security-Policy. Inline onclick="" or <script> elements without the dynamic nonce will be blocked by the browser.
  6. Multi-Webserver Cache Protection: The .cache/ folder automatically generates both .htaccess (Apache) and an empty index.html file to prevent unauthorized directory listings across Apache, Nginx, Caddy, Lighttpd, and PHP CLI server.
  7. Search Keyboard Shortcuts: Press / or Ctrl+K (Cmd+K on macOS) anywhere on the page to focus the search input, and press Escape to clear search filters and dismiss the input field.
  8. Accessibility Compliance (WCAG 2.2 AAA): The interface strictly adheres to modern accessibility standards featuring high contrast ratios (> 7.5:1), keyboard navigation with :focus-visible, breadcrumb aria-current="page", table column header aria-sort, semantic <output class="empty-state"> live regions, and prefers-reduced-motion support.

Project Directory Structure

File-Directory-Browser/
├── LICENSE                    # MIT License
├── README.md                  # Project overview, installation, and documentation
├── assets/                    # Repository banners, media, and visual assets
│   ├── alsyundawy-banner.png  # Alsyundawy IT Solution maintainer banner
│   └── file-directory-browser-banner.jpg # Production flyer & banner
└── index.php                  # Complete single-file directory indexer & file browser

Contributing

Contributions, issues, and feature requests are welcome:

  1. Fork the repository (https://github.com/alsyundawy/File-Directory-Browser/fork).
  2. Create your feature branch (git checkout -b feature/amazing-feature).
  3. Maintain strict PHP 8.0+ compatibility and zero PHPStan / Psalm / PSR-12 warnings.
  4. Commit your changes (git commit -m 'feat: add amazing feature').
  5. Push to the branch (git push origin feature/amazing-feature).
  6. Open a Pull Request with a clear summary of your changes.

Maintainer & Contact

Alsyundawy IT Solution Banner

Harry Dertin Sutisna Alsyundawy (@alsyundawy)

Support & Donation

If these scripts are helpful for your setup, you can support development here:

🇮🇩 QRIS (Quick Response Code Indonesian Standard)

Scan the QRIS barcode below using any Indonesian mobile banking app (BCA, Mandiri, BRI, BNI, BSI, CIMB Niaga, Permata) or e-wallet (GoPay, OVO, DANA, LinkAja, ShopeePay):

QRIS Donation Barcode - ALSYUNDAWY

License

This project is licensed under the MIT License — see the LICENSE file for details.

Copyright (c) 2026 Harry Dertin Sutisna Alsyundawy (alsyundawy).

Note: Please retain attribution credit to the original author (HARRY DS ALSYUNDAWY — ALSYUNDAWY IT SOLUTION) if you use or distribute this script. Attribution is appreciated though not legally mandated under the MIT License.

Repobeats analytics

This site is open source. Improve this page.