This is one of the problem that kind of concerns me alot, like how is it possible wordpress allow directory indexing not only wp-includes but some plugins also does not have index.php to cover the directory. Basicly we can do it manually by putting index.php in all the folder but that would be a lot but .htaccess already preparing the code to prevent this problem.
# disable directory listing Options -Indexes
– copy the code above
– open .htaccess that located in wordpress root folder
– paste the code that you already copy at the end of file and make sure you hit the ENTER key after entering the “Options -Indexes” words so that the file ends with a blank line.
– save the file
Try to access it, for example “yourdomain/wp-includes/” , If all goes well, you should get a “Forbidden” error when you try to access a directory that doesn’t have an index file.