When using a almost empty file named index.html in my apache directories in order to avoid directory listings (e.g. /image folder), what is the minimum content of this file? Can it be empty, or should I include something like:
<!DOCTYPE html><title></title>
or
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title></title>
</head>
<body>
&npsp;
</body>
</html>
or something in between?
Indeed the first line of code is the minimum valid HTML5 code. <!DOCTYPE html><title> </title>
Though you must have a title, wether that be a space or text. Otherwise use the full declaration if you do not wish to give a title in order to be valid markup.
This can be verified using the W3C validator
If you just want to avoid directory listing, it might just be better to make one single page for the error code 403, then change the following in your Apache configuration:
Options Includes Indexes FollowSymLinks MultiViews
to:
Options Includes FollowSymLinks MultiViews
removing Indexes from the list. If you don't have access to the http.conf file, placing Options -Indexes in a .htaccess file will have the same effect. This will make Apache send a 403 Access Denied error whenever a visitor is trying to access a URL which resulted in the directory list before. Now, all you need to do is to redirect these errors to your own custom error page. You can do this using
ErrorDocument 403 /path/to/custom403errorpage.html
This is not just an easier and more secure way of doing it, but also lets the users know that they shouldn't be looking around your stuff.
To avoid directory listing you need no HTML file at all. You can just add a .htaccess file in the folder with the options you want. To disable folder listing add this line to your .htaccess file
Options -Indexes
Note that on most live hosts directory listing is disabled by default
As a question about formally minimal HTML document, this depends on the version of HTML. Regarding the alternatives in the question, the first one is not valid according to current HTML5 drafts (the title element must have some content, e.g. a space), and the second one is not minimal at all (it has many optional tags) and it is not valid (URL is missing from the doctype declaration, and the entity reference &npsp; is undefined); besides, HTML 4.0 was obsoleted by HTML 4.01 in 1999.
For the purposes of avoiding directory listings (which can be avoided in other ways, too), any file will do, even an empty one.
However, an empty file, or an HTML document with blank content, will result in a blank page shown to the user when the user tries to access, say, http://foo.example.com/images/, when http://foo.example.com/images/index.html exists with no content. Therefore, you may consider using content like this:
<!doctype html>
<title>Directory listing not allowed</title>
Directory listing not allowed.
