Check option AllowOverride All
is included in apache configuration file (/etc/apache2/apache2.conf). This option is used to make .htaccess file under wordpress menu take effect.
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
Add below option to .htacess file (under WordPress folder) to disable file list access via browser
Options All -Indexes