File security on the server?

Question

PHP

Hello. Maybe I asked not a very correct question, but still.
There is a site. It has a download folder.
Suppose this path sayt.ru/download/
This folder contains files and folders.
How can a cracker or just any not good person look through them and how to secure it?
Moreover, following this path, the server responds that there is no page. Why didn't the server just show a list of files in that folder? And is it possible to bypass this and how to avoid it?

Answer 1

Why didn't the server just show a list of files in that folder?

Because the corresponding function is disabled in nginx/apache.
If you want to hide something from the user - just store the files one level above the root directory of the site.

Answer 2

htaccess + htpasswd to the rescue

Answer 3

Solve the settings of the server you are using!