Request a directory that has no index file and many servers show the file list instead. Backups, exports, an old copy of a configuration file - anything sitting there is now public, and automated scanners look for exactly this.

Nginx

autoindex off;      # the default, so check nobody turned it on\ngrep -rn autoindex /etc/nginx/

Apache and LiteSpeed

Options -Indexes\n\n# or per directory, in .htaccess\nOptions -Indexes

Check every directory, not just the root

for d in uploads backup files export logs tmp; do\n  printf '%-10s ' "$d"\n  curl -sS -o /dev/null -w '%{http_code}\n' "https://yourdomain.com/$d/"\ndone

200 on any of those is worth opening in a browser right now. 403 or 404 is what you want.

An empty index file is a weak fix

Dropping an index.html into each folder hides the listing and the files are still reachable by name. It stops a casual look and nothing else - turn the option off at the server instead.

The real answer for private files

Anything that should not be public should not be under the document root at all. Keep it outside and serve it through a script that checks who is asking.

/var/www/site/\n  public/      <- the document root\n  storage/     <- backups, exports, logs: no URL can reach these
While you are looking, check for the files people leave behind: .env, .git, config.php.bak, database.sql. A source backup left in the web root has leaked whole applications - request each one and confirm it is not there.