This question already has an answer here:
I have a website in PHP (e.g. xyz.com). It is on my local server. And all the images used in the website are stored in xyz/images. When somebody types my website name with the folder name ("images") he can see all the images. How to prevent that?
Note: I have used HTML, PHP, JQuery and CSS to make my website. I don't have htaccess file.
</div>
Create an empty file index.php inside your "images" folder.