For some time, we have noticed that Google was indexing /wp-content/uploads on our website. That folder also gets indexed as a webpage (and hence raises mobile usability issues on Search console). When browsed (even in private mode), the folder structure appears and one could browse it completely.

When we first found xml files in Google search results, we thought it was a index/no-index issue, but since we now see that many folders are accessible as such, we would like to find a solution to that.

We already made sure that on server-side, the files and folders had the correct permissions, applying:

chown www-data:www-data  -R *
find . -type d -exec chmod 755 {} ;
find . -type f -exec chmod 644 {} ;

Here is a paste to our .htaccess file: https://pastebin.com/raw/7fw9eAkv