If I had a site with a directory inside the root....


www.myurl.co.uk/directory

with a index.html file in this dir, this index.html would open automatically.

with no index.html, some browsers combinded with some servers would display the contents of the dir as a file list.

If you didn't know what the directory was called, could you still gain access to it??




I think what I am asking is, is there a way to list what files are on a server from the url??  what about files placed in the root of my site?  Can they be accessed if you don't know the name??

I am looking at protecting a directory with the use of .htaccess files, so only my employees can access reference material online.  I was just thinking that if the directory name was a garble of letters, could anyone figure out what the directory name was, and gain access to the files within??

Just make sure you don't put any images in the directory that appear on the Index page. If you do that someone could look at the source code to find the directory name.

So .htaccess and .htpasswd is the way to go.....either that or sessions?