YADI – Yet Another Directory Index

2026–present Status: Maintenance Category: AI

A single-file PHP directory listing script with a clean, modern UI. Drop index.php into any directory on your web server to get a styled, browsable file index.

# Features

  • Single-file deployment — just one index.php
  • Responsive design with a modern gradient UI
  • Subfolder navigation via query strings (?dir=path/to/folder)
  • Configurable depth limit for directory traversal
  • Breadcrumb navigation
  • File size display
  • Hidden file filtering
  • Directory traversal protection
  • Apache and Nginx rewrite rules included

# Installation

  1. Copy index.php to the root directory you want to index.
  2. (Optional) Copy .htaccess (Apache) or add the .nginx snippet to your Nginx server block.

The rewrite rules allow clean URLs by transparently routing directory requests through YADI, while still serving real files and directories that have their own index files.

# Configuration

All options are at the top of index.php:

OptionDefaultDescription
$hiddenFiles['index.php', 'index.html', 'robots.txt', '.htaccess', '.htpasswd', '.git', '.env']Files/folders to hide (case-insensitive)
$showDotFilesfalseList dotfiles (.gitignore, .well-known, …). Note that most web servers deny access to dotfiles, so the links may still 403.
$maxDepth-1Maximum directory depth (0 = root only, -1 = unlimited)
$relativeLinksAtMaxDepthfalseAt max depth, list folders as plain directory links instead of ?dir= query strings, handing navigation to the web server. Do not enable when using rewrite rules — it causes redirect loops.
$pageTitle'Directory Index'Page title

# Web Server Setup

  • Apache — copy .htaccess to your web root. It uses mod_rewrite to route directory requests without their own index file through YADI.
  • Nginx — copy the location / block from .nginx into your server block.

# Security

  • Path traversal is prevented by resolving paths with realpath() and verifying they remain within the base directory.
  • All output is escaped with htmlspecialchars() and urlencode() to prevent XSS.
  • Dotfiles are hidden by default ($showDotFiles), as are .htaccess, .htpasswd, .env and .git — those stay hidden even with dotfiles enabled.

# License

YADI by MadMakz is licensed under CC BY-NC-ND.