You need to tell the web server to stop the directory listing. For apache add this to your httpd.conf or any other related configuration file
<Directory /path/to/directory> Options -Indexes </Directory>
If it is placed in a .htaccess file, AllowOverride Options must be enabled for the desired directory.
source share