A blank installer.php page usually means PHP execution was blocked, a fatal PHP or database error occurred, a security rule intercepted the request, the server does not meet Duplicator’s runtime requirements, or the files have unusable permissions. First record the exact symptom and HTTP status, then obtain the server error-log entry for the failure time. A page that contains only a date and time has a particularly useful lead: Duplicator documents Wordfence and an incorrect auto_prepend_file path in a parent or destination .htaccess/.user.ini file as common causes. Avoid repeatedly rerunning the installer before recording evidence; repeated attempts can create confusing logs or partial files.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Identify the exact failure before changing files
Open the complete installer URL in a private browser window and record what appears. The distinction determines which checks are useful:
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- Completely white page: PHP may have stopped on a fatal error, or the web server may be refusing to execute the script.
- A page showing only a date and time: investigate Wordfence and stale
auto_prepend_filedirectives first. - 403, 404, or 405: access controls, rewrite rules, a web application firewall, or host restrictions are more likely than a database problem.
- 500: inspect PHP and web-server logs for a fatal error, incompatible extension, permission problem, or security module rejection.
Write down the full URL, status code, visible text, and exact time. Give those details to your host and request the PHP and web-server log lines generated at that time. A blank response is not evidence that the archive is damaged; the log normally identifies whether execution reached PHP.
Also note where the files were uploaded, whether the URL is HTTP or HTTPS, and whether the installer is being opened from a subdirectory, staging domain, or document root. Confirm that the filename is exactly installer.php; a renamed file or a URL pointing at the wrong document root commonly produces a 404 that looks like an installation failure.
Fix a date-and-time-only installer page
Temporarily disable Wordfence on the destination
Duplicator’s troubleshooting documentation associates a date/time-only installer page with Wordfence. Temporarily disable Wordfence on the destination site. If the destination sits below another WordPress installation in the directory tree, also check whether Wordfence is active in that parent installation; its protection can affect requests in child directories. Retry the installer after the narrowly scoped test.
Do not leave the security plugin disabled beyond the migration window. If the page remains unchanged, restore it and continue with the path check below. If you cannot reach wp-admin, rename the Wordfence plugin directory through FTP or a hosting file manager only long enough to test, then restore its original name.
Check auto_prepend_file in every relevant configuration file
Inspect the destination directory and its parent directories for .htaccess and .user.ini files. Look for an auto_prepend_file setting that points to a file or account path from the old server. A stale absolute path can make PHP fail before installer.php runs.
- Make a backup copy of each file before editing.
- Comment out or correct the obsolete
auto_prepend_fileline for the controlled test. - Run the installer again and compare the result with the original timestamped failure.
- Restore the intended security/bootstrap setting as soon as the installation is complete.
Check both the parent and destination files: a rule inherited from the parent can break a script that appears correctly configured in its own directory. Also check the account-level PHP settings in the hosting panel; a local .user.ini may be overridden by a parent file or may remain cached briefly by PHP, so allow the host’s normal configuration reload interval before concluding that an edit had no effect.
When PHP is not executing installer.php
Look for PHP-blocking rules
Open the applicable .htaccess files and search for rules that deny PHP files, such as a <Files *.php> block containing Deny from all. Make a backup, then temporarily rename only the suspected blocking file for a controlled test. If the installer starts afterward, replace the broad rule with a narrowly scoped exception for the migration directory or ask the host to implement the equivalent safely.
Do not delete unrelated rewrite, authentication, or cache directives. A renamed file changes the behavior of the whole directory, so use the test briefly and restore or edit it immediately. On hosts using Nginx, the equivalent restriction may be in a server block rather than .htaccess; only the host can change that configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check ModSecurity and other WAF rules
ModSecurity or another web application firewall can reject the installer or its archive-upload requests before PHP receives them. Review the security-module log for the request time and ask the host for a targeted exception for the installer operation. Duplicator describes an “AJAX 403 Forbidden” response as a sign that a server security layer is blocking the upload request.
Avoid turning off a firewall for the entire account or server. A host can usually identify the rule ID and scope an exception to the temporary migration URL, source IP, or operation. Remove the exception when the migration ends and verify that ordinary requests are still protected.
Use a direct PHP execution test only when your host permits it
If you control the account, ask the host whether PHP is enabled for the directory and whether the selected PHP handler applies to the destination path. A request that downloads the PHP source, returns a 403/405, or produces a server error indicates a handler or policy issue rather than a Duplicator setting. Do not leave diagnostic scripts containing server details publicly accessible. Delete any test file immediately after confirming the handler.
Verify permissions and ownership
Duplicator documents 755 for directories and 644 for files as normal starting points. The web-server process must also have the expected owner and group; correct numeric modes cannot compensate for ownership that prevents reads or writes.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Inspect the directory containing
installer.php, the archive, and the destination WordPress files. - Set directories to 755 and regular files to 644 where those values match your host’s normal WordPress policy.
- Confirm that the account owner and group are consistent with neighboring WordPress files.
- Retry the installer and check the log if the response changes.
Duplicator mentions 777 as a temporary diagnostic test, but it creates a serious security risk. Never leave directories or files at 777; if that test appears to help, revert immediately and have the host correct ownership or the PHP handler.
Check parent-directory traversal as well as the files themselves. A directory can be readable while one parent directory denies execute (traverse) permission. On shared hosting, ask support to reset ownership recursively to the account user rather than applying a blanket world-writable mode. Keep the archive readable by the installer but inaccessible to unrelated accounts whenever the host supports that distinction.
Confirm the server meets Duplicator’s runtime requirements
The current WordPress.org listing for Duplicator states PHP 7.4 or newer and WordPress 5.3 or newer. Duplicator’s system guidance also requires a 64-bit operating system and 64-bit PHP. A 32-bit PHP build cannot handle files larger than 2 GB, regardless of available disk space.
| Requirement | What to verify | Why it matters |
|---|---|---|
| PHP version | 7.4 or newer | Older runtimes do not meet the current plugin minimum. |
| WordPress version | 5.3 or newer | The current plugin listing uses this as its minimum. |
| Architecture | 64-bit operating system and 64-bit PHP | 32-bit PHP cannot process files above 2 GB. |
| Database extension | mysqli enabled |
The installer needs it to connect to MySQL-compatible WordPress databases. |
| Archive capability | ZipArchive or supported shell-zip capability |
The available archive engine depends on what PHP and the host expose. |
| Database-dump engine | An engine supported by the selected Duplicator build and enabled on the server | The dump method must be compatible with the runtime and database size. |
Check these values in your hosting panel or ask support for the PHP version, architecture, loaded extensions, and active handler. Also confirm sufficient disk space and memory for the archive and extraction; the error log is the authority when a resource limit is reached. The archive may need room for both the compressed file and its extracted contents, plus temporary database files. A full filesystem can therefore appear as a permissions or extraction failure even when modes are correct.
Compare the source package’s PHP assumptions with the destination runtime. Raising PHP to meet the minimum can expose an old theme or plugin error, so take a backup and test the destination in a maintenance window. Conversely, lowering PHP solely to accommodate legacy code leaves the server below Duplicator’s stated minimum and is not a durable fix.
Separate a WordPress white-screen problem from an installer problem
If the blank page occurs during an ordinary WordPress request rather than when the standalone installer is opened, follow WordPress’s standard white-screen process. WordPress Developer Resources notes that both PHP errors and database errors can appear as a blank screen with no information.
Enable temporary logging
In a controlled maintenance window, enable debugging and logging in wp-config.php before the line that says to stop editing. Use settings equivalent to:
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
define('WP_DEBUG_DISPLAY', false);Repeat the failing request, then inspect wp-content/debug.log and the server log. Do not display errors to visitors on a live site, and remove or disable these settings after diagnosis. Compare the timestamp in debug.log with the web-server entry; a missing WordPress log entry usually means the request never reached WordPress.
Isolate plugins and themes
- Back up the site and use FTP or the hosting file manager.
- Rename
wp-content/pluginsto a temporary name to disable plugins in bulk. - Retry the request. If it works, restore the directory name and disable plugins individually until the conflict is identified.
- If plugins are not responsible, switch to a default theme when you can do so safely and test again.
Review .htaccess at the same time, because a rewrite or access rule can produce a white screen or HTTP error even when WordPress files are intact. Restore each renamed directory and configuration file after the test so that the site is not left in a partially disabled state.
Choose the correct Duplicator installation mode
Import mode and a blocked import directory
Some hosts prevent PHP execution in an import or temporary directory. If you cannot obtain a narrowly scoped exception, upload installer.php and the archive to the WordPress document root and use Duplicator’s Classic/Overwrite installation mode. This avoids relying on execution rules in the blocked import location, but it overwrites the selected destination and therefore requires a verified backup and a maintenance window.
Import is preferable when the host permits the intended directory and you need to preserve an existing site structure. Classic/Overwrite is the practical fallback when execution policy, not the package, is the obstacle. Before choosing it, confirm the document root, record the database credentials required by the installer, and make sure DNS or the temporary domain points to that root. Never overwrite a production directory without a recoverable backup and a tested rollback plan.
Rank #4
Update the plugin when launch patches apply
Duplicator states that Pro 4.5.1 and later include patches for a class of installer-launch issues. Update when the site’s PHP and WordPress versions are compatible, and keep a rollback copy of the existing package. Updating cannot fix a host-level 403, a denied PHP handler, or a stale auto_prepend_file path, so continue to use the symptom-based checks above.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Use the HTTP status to select the next test
| Observed result | Most useful next checks |
|---|---|
| Blank page with no text | PHP and web-server logs, PHP handler, fatal errors, extensions, memory, and permissions. |
| Date and time only | Temporarily disable Wordfence; inspect parent and destination .htaccess/.user.ini for stale auto_prepend_file. |
| 403 Forbidden | ModSecurity/WAF log, PHP-deny rules, directory permissions, ownership, and host access policy. |
| 404 Not Found | Confirm the exact URL and filename, document root, rewrite rules, and whether the file was uploaded to the directory being served. |
| 405 Method Not Allowed | Check web-server method restrictions, WAF policy, and whether the request is reaching the intended PHP handler. |
| 500 Internal Server Error | Read the PHP fatal-error and web-server logs, then check runtime version, extensions, configuration paths, and permissions. |
The table is a triage order, not a guarantee: a host can return a generic status for several underlying causes. The timestamped log entry is the deciding evidence. If the status changes after one controlled edit, record that change and undo unrelated edits; changing several layers at once makes a later rollback difficult.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Escalate efficiently when you lack server access
Send support the installer URL (without passwords or database credentials), the exact timestamp and timezone, the HTTP status, the PHP version, whether the server is 64-bit, and the relevant log excerpt. Ask the host to confirm:
- PHP execution and the active PHP handler for the destination directory.
- Whether ModSecurity or another WAF blocked the request, including the rule identifier.
- That
mysqliand an archive capability such asZipArchiveare enabled. - File and directory ownership, write access, and the host’s permitted permission policy.
- Whether a parent
.htaccessor.user.iniinjects an obsoleteauto_prepend_file. - Whether the account has sufficient memory, execution time, and storage for the archive and database dump.
Request a temporary, narrowly scoped exception rather than a blanket firewall or security disablement. Give the host the exact path and operation so the exception can be removed after the migration. If support asks for credentials, create temporary credentials with the minimum required privileges and revoke them when testing ends.
Clean up after a successful install
- Restore the intended
.htaccessand.user.inirules, including any valid security bootstrap path. - Re-enable Wordfence and any other security controls disabled for testing.
- Turn off
WP_DEBUGand remove temporary diagnostic changes. - Delete
installer.php, the archive, logs, and any temporary extraction or test files when the migration workflow requires it. - Test the front end, WordPress login, permalinks, media, and database-backed features from a fresh browser session.
Leaving an installer or migration archive accessible can expose the site, database, or configuration, so cleanup is part of the fix rather than an optional final step. Purge cached copies at the CDN or host after deleting files, and confirm that the old installer URL no longer returns a downloadable response.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick decision checklist
- Did you record the exact response, URL, and failure time?
- Did the server log show a PHP fatal error, database error, WAF block, or permission denial?
- If the page showed only a date and time, did you check Wordfence and inherited
auto_prepend_filesettings? - Are PHP 7.4+, WordPress 5.3+, 64-bit PHP/OS,
mysqli, and archive support available? - Are directories 755, files 644, and ownership consistent with the host’s WordPress files?
- Did you test a suspected rule narrowly instead of disabling security globally?
- If the import path blocks PHP, did you consider the document-root Classic/Overwrite method?
- After success, did you restore security settings and remove installer materials?
Frequently Asked Questions
Why does installer.php show only a date and time?
Duplicator specifically associates that display with Wordfence and with an incorrect auto_prepend_file path in a parent or destination .htaccess or .user.ini file. Test those causes first, then restore the security settings after the migration.
What should I do when the Duplicator installer returns 403?
Check ModSecurity or another WAF log, PHP-deny rules, directory ownership and permissions, and host access policy. Ask the host for a narrowly scoped exception instead of disabling the firewall globally.
Can 32-bit PHP cause a blank installer?
Yes. Duplicator’s system guidance requires 64-bit PHP and a 64-bit operating system; 32-bit PHP cannot handle files larger than 2 GB. Confirm the architecture with your host.
Are 755 and 644 permissions mandatory?
They are Duplicator’s normal starting points: 755 for directories and 644 for files. Ownership and group must also allow the PHP process to read and write the needed paths. Do not leave anything at 777.
Which PHP and WordPress versions does Duplicator require?
The current WordPress.org listing states PHP 7.4 or newer and WordPress 5.3 or newer. Verify those versions before troubleshooting application files.
What if PHP execution is blocked in the import directory?
Upload installer.php and the archive to the WordPress document root and use Classic/Overwrite installation, provided you have a verified backup and maintenance window. This changes the destination and should not be attempted without a rollback plan.
Should I enable WP_DEBUG on a live site?
Enable logging only during a controlled maintenance window, keep WP_DEBUG_DISPLAY false, inspect the logs, and disable the settings afterward. Displaying errors publicly can expose paths and credentials.
Do I need to update Duplicator before troubleshooting?
Duplicator says Pro 4.5.1 and later contain patches for a class of launch issues. Update when compatible, but an update will not fix a host-level 403, blocked PHP handler, or stale auto_prepend_file path.
Recommended Free Tools
The Bottom Line
Start with the timestamped server log, then match the symptom: date/time-only pages point to Wordfence or stale auto_prepend_file settings; HTTP errors point to execution rules, WAF controls, permissions, or host policy; a true blank page requires PHP, database, and runtime checks. Correct the narrow cause, use Classic/Overwrite only when the import directory cannot execute PHP, and remove all temporary installer and debugging files afterward.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
