Apache 2.4 was refusing to disable directory listings, even with
-Indexes set under the VirtualHost’s options line. No matter what I tried, I was able to browse to a path on my server and Apache’s directory listing would show up.
Turns out that the directory itself had
+x permissions as
755. Removing the
+x and changing the directory’s permissions to
644 and restarting Apache immediately fixed the issue.