Generally, when you try to open a web directory in your browser, the browser will either return you an “index” page – an HTML page (or PHP or ASP etc.) that’s in the root of the directory, or if the index file is absent, it will deny access to the directory. But if the index file is missing and the webmaster forgot to password protect the folder, the server will return a listing of the files that are within the directory. An unprotected web directory is like a publicly accessible open computer. You can navigate within the folders, view files or even download them. Many webmasters routinely forget to configure their webservers to deny directory access, thereby exposing their content on the internet for anybody to see.