---
title: Export/import package directory browsing
related:
  - https://docs.kentico.com/13/securing-websites/developing-secure-websites/enumeration.md
  - https://docs.kentico.com/13/securing-websites/deploying-websites-to-a-secure-environment/restricting-access-to-directories.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

It is highly recommended to disable **Directory Browsing** in IIS for websites on live servers, at least for the **CMSSiteUtils** directory. If enabled, sensitive data from site export/import packages, such as user credentials, can be accessed directly from the browser.

Directory Browsing is disabled by default.

> **Info:** **Note**: To protect the CMSSiteUtils folder from enumeration attacks, disabling directory browsing is not enough. You also have to forbid access to the folder in the web.config file. See [Enumeration](https://docs.kentico.com/13/securing-websites/developing-secure-websites/enumeration.md) for more security information.

![Disabling Directory Browsing in IIS](https://docs.kentico.com/docsassets/13/export-import-package-directory-browsing/IIS_Directory_Browsing.png "Disabling Directory Browsing in IIS")