To my surprise I discovered that directory listing of apache is enabled by default on the apache web server on my ubuntu server 14.04.
This could be used to rip your back end code.
Please open /etc/apache2/apache2.conf in your favourite editor
and remove the work Indexes from the following part

<Directory /var/www/domain.com/pdfs>
Options Indexes FollowSymLinks
</Directory>

Dont forget to restart the apache by # /etc/init.d/apache2 restart
Hope this helps others to secure their servers.
I got a big scare when I discovered this being enabled by default.