AllowOverride All is included in apache configuration file (/etc/apache2/apache2.conf). This option is used to make .htaccess file under wordpress menu take effect.
<Directory /var/www/> Options Indexes FollowSymLinks AllowOverride All Require all granted </Directory>
Add below option to .htacess file (under WordPress folder) to disable file list access via browser
Options All -Indexes