Wordfence allowing access to various pages that should be blocked

Has nothing to do with WordFence. This happens without WordFence having any knowledge OR a way to control it.

Apache (your web-server) by default, and if it is allowed, will show an index of a directory, if no index.php/index.html or similar exists to show.
Normally, this is turned off in the global configs, unless you have a local option to turn it ON.

You need to tell Apache that showing directory content is NOT valid.
Normally done in the global configs, you can also do it by simply entering

<IfModule mod_autoindex.c>
   Options -Indexes
</IfModule>

in your .htaccess file. That will tell Apache to stop showing directory indexes.

Another way, if only certain directories are not allowed to be “indexed” (show file-listing), would be to add a local .htacess file in that directory disallowing it, or to simply create a dummy “index.html” for Apache to find in that directory. ??
Then magically that index.html file will be shown instead of a full directory listing..
Showing file-listings is only Apache’s fallback, if there is nothing else to show, and when it is allowed to by the “Options” settings..

When you disallow it in .htaccess, users will get an error message if trying.
Which is the normal way to do it.

Hi MegT,
On web servers there is an option that allows you to choose whether the contents of folders are listed or not when you browse to the folder. This is called “directory indexing”. I would recommend that you reach out to your host and ask them how you can disable directory indexing on your server. Often, there will be an option for this in your web hosts administration panel.

Hope you have a great weekend!

Thanks for the help. Disabling Directory Indexing did address the wp-content/uploads page being displayed, but the https://thehartwoodclub.org/category/minutes/ is still visible to logged out users, and shouldn’t be. Actually, any url that matches a post category on the site is accessible via a link that reads https://thehartwoodclub.org/category/***SampleCategoryName***/

How do I block that access?

Sorry! Just realized that my second question is actually intended for a different plugin, NOT Wordfence! Thanks for the help with the directory pages!