Free tools Windows power users keep installed
One-click scans. No signup required.
Duplicator’s write-access error means the destination path cannot be written by the account or web-server process running the migration. Correct ownership first, use 755 directories and 644 files as the starting permission policy, then check PHP execution, .htaccess rules and host security controls if installer.php returns a 403 or will not launch. Never solve the problem by changing the whole site to 777.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the Duplicator error is actually telling you
During a migration, Duplicator must create directories, extract the archive and write WordPress files, uploads and temporary data. A message such as “permission denied,” “cannot write,” or “the uploaded file could not be moved” means the process that is performing that operation lacks permission on a particular destination path. The process may be your hosting account, the web server, PHP, or a combination determined by the host’s file-ownership model.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSeeing a file in FTP does not prove that PHP can modify it. FTP may authenticate as one user while the web server runs as another user or group. A directory can also have apparently normal mode bits but the wrong owner, group, parent-directory permissions, disk quota, or host policy.
A 403 response is a different class of symptom. It can result from an Apache or Nginx rule, a security plugin, ModSecurity, Imunify360, or another host firewall blocking installer.php or an AJAX/import request. It is not automatically evidence that chmod values are wrong. Duplicator also notes that an .htaccess file inside wp-content does not inherently prevent PHP execution; the specific rule and server configuration matter.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Before changing anything
Make a rollback point and identify exactly which site and destination you are editing. A migration can overwrite an existing installation, so keep the original site available until the new copy has been checked.
- Keep a complete Duplicator backup and verify that you have both the matching
archive.ziporarchive.dafandinstaller.php. - Record the destination domain, document root and the full path shown in the installer log.
- Confirm that the destination has enough storage for the archive, extracted files and temporary working data.
- Use SFTP, FTP or the host file manager with the account that owns the destination, not an unrelated administrative account.
- Pause automated deployment, caching or security rules that could delete the installer while you diagnose it.
Use a safe permission and ownership baseline
The standard starting point is 755 for directories and 644 for files. The web-server process must also be able to write the migration directory and any Duplicator storage or working directory required by the selected installation method. The correct owner and group are host-specific; on some hosts the account and web server share a group, while others run PHP as the account owner.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →| Object | Baseline mode | What must be true | Typical failure when it is wrong |
|---|---|---|---|
| Directories | 755 | The account and web-server process can traverse and, where required by the host setup, write the destination. | Archive extraction stops, or Duplicator cannot create a folder. |
| Regular files | 644 | The process can read files and write only where the host’s ownership model permits it. | installer.php cannot be read, or an extracted file cannot be replaced. |
| Migration root | Host-approved owner/group with the baseline modes | The account running PHP can create and remove files during installation. | Permission denied at the first extraction or database step. |
wp-content and required subdirectories |
755 directories; 644 files | The web server can write where WordPress and Duplicator need to store uploads, backups or temporary data. | Uploads, plugin files or Duplicator storage cannot be moved. |
Do not recursively set the site to 777. Duplicator explicitly warns that 777 allows anyone to modify files. It can create a security vulnerability and still fail when the real problem is ownership, a WAF rule or a host restriction.
Correct modes from a shell
If your host permits shell access, replace the example path with the actual WordPress installation path and use the host-approved owner and group. These commands set the documented baseline separately for directories and files:
find /path/to/your/wordpress/install/ -type d -exec chmod 755 {} ;
find /path/to/your/wordpress/install/ -type f -exec chmod 644 {} ;The commands do not repair an incorrect owner or group. If files were uploaded by a different account, or the host uses a special PHP user, ask hosting support to reset ownership and permissions for the specific destination rather than broadening access across the server. Hosts that do not provide shell access often expose a “reset permissions” action in the file manager.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Clean migration procedure
Establishing a clean destination removes many variables before you troubleshoot a particular error.
Recommended Free Tools
- Create the package. In the source WordPress site, create a Duplicator backup and download the generated archive and its matching
installer.php. Do not mix an installer from one package with an archive from another. - Prepare the destination. Create or select an empty directory that the web server can read and write. If the destination contains an old WordPress copy, decide whether you are intentionally overwriting it and retain a separate backup first.
- Upload both package files. Transfer the archive and installer with FTP, SFTP or the host file manager. They can be placed in the destination root or another directory that has a valid URL path and suitable permissions.
- Open the installer. Visit
https://your-domain.example/installer.php, or the equivalent URL for the directory where you uploaded the files. Complete the database connection, site URL and replacement steps requested by the installer. - Test the new copy. Check the front end, WordPress login, permalinks, media, forms and important plugins before directing traffic to the destination.
- Remove migration artifacts. Delete
installer.php, the archive and any installer logs or temporary files when the migration is complete, following Duplicator’s cleanup and security instructions. Leaving an installer or full backup publicly reachable exposes the site to misuse.
Follow this troubleshooting decision tree
1. Identify the exact path that fails
Read the visible error and the installer log instead of changing permissions globally. Note whether the failure names the destination root, wp-content, wp-content/uploads, Duplicator’s backup/import directory, or archive extraction. A single unwritable subdirectory can stop an otherwise valid migration.
Check the parent directories as well as the named folder. The process needs execute (traverse) access on every parent, and it needs write access on the directory where it creates or replaces files. Repair that path’s owner, group and mode, then retry the same step.
2. Check ownership as well as mode bits
Start with the 755-directory and 644-file baseline, then determine which account runs PHP on the destination. If the files were created by a different FTP account, the web server may be unable to modify them even though the modes look correct. On shared hosting, support may need to reassign ownership to the hosting account or place it in the group used by PHP.
Do not use a recursive 777 workaround. It conceals the ownership problem, increases the attack surface and can leave every WordPress file writable by unrelated processes.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
3. Separate filesystem denial from PHP or security denial
If the path is writable but installer.php never starts, inspect the server response and logs.
- Check .htaccess rules. Look for a rule such as a
<Files *.php>block that denies PHP execution. Rename an .htaccess file only as a controlled diagnostic, retry once, and restore it immediately afterward. An .htaccess file inwp-contentis not, by itself, proof that execution is blocked. - Check security plugins. Temporarily disable a security plugin such as Wordfence while testing, if you can do so safely and have another way to restore it. Re-enable it after the test.
- Check host security logs. Ask the host to inspect ModSecurity or Imunify360 logs for a blocked installer, import or AJAX request. Request a targeted exception for the migration action instead of permanently disabling the web application firewall.
- Check PHP execution policy. Some hosts allow PHP only in selected directories or block direct execution of unfamiliar files. Ask which directory is supported for a temporary installer and whether the account can execute PHP there.
A 403 that disappears when a targeted rule is relaxed identifies a security control as the cause; changing chmod values will not fix that control.
4. Use the supported fallback when browser import fails
Duplicator Pro’s Import workflow expects the archive in its import location. If drag-and-drop or a browser upload fails, transfer the .zip or .daf file manually to /wp-content/duplicator-backups/imports with FTP or the file manager, then select it under Duplicator Pro » Import.
If the host blocks that directory or the archive cannot be uploaded there, place the archive in the WordPress root and use Classic Installation. Classic Installation uses the pair of files in the destination path: upload the matching archive and installer.php, then open the installer URL. This avoids relying on the wp-admin upload request that may be blocked by size limits or a WAF.
When PHP execution is blocked in the normal folder, ask the host for an approved execution location. If the host supports it, place installer.php and the archive in the WordPress root and use Overwrite Install Mode only after backing up the existing site and confirming that overwriting is intentional.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
5. Verify versions and plugin state
The WordPress.org listing for Duplicator currently states PHP 7.4 or later and WordPress 5.3 or later. A lower PHP or WordPress version can produce installer failures unrelated to file modes. Check the active versions in the destination hosting panel or WordPress Site Health, and move to a compatible release before retrying.
Duplicator’s troubleshooting guidance says Pro 4.5.1 and later include patches that resolve installer-launch issues for most setups. Update to the latest release compatible with the destination before treating a recurring launch error as a permissions defect.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf plugin installation or updating shows “The uploaded file could not be moved to wp-content/uploads,” follow the separate upload guidance: disable FTP components when they force WordPress through an unavailable FTP server, or have the host correct system permissions and ownership for wp-content/uploads. Also inspect wp-config.php for DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS. Those constants can disable dashboard file changes even when the filesystem itself is writable.
Choose Import, Classic Installation or host assistance
| Situation | Best path | Why | What to verify first |
|---|---|---|---|
| WordPress already runs on the destination and wp-admin can accept the archive. | Duplicator Pro Import | It keeps the transfer inside the existing WordPress installation. | The import directory is writable and the archive can reach /wp-content/duplicator-backups/imports. |
| Browser upload, AJAX or WAF blocks the import. | Manual archive upload, then Import | FTP, SFTP or the file manager bypasses the browser transfer. | The manually uploaded archive is readable by PHP and has not been altered. |
| The archive is in the WordPress root or no usable wp-admin import exists. | Classic Installation | The matching archive and installer run directly from the destination URL. | PHP execution is allowed in that directory and the destination is backed up. |
| An existing installation must be replaced deliberately. | Overwrite Install Mode, where supported | It is designed for an intentional replacement rather than a side-by-side copy. | You have a rollback backup and have confirmed the domain, database and document root. |
| The host controls ownership, PHP execution or WAF rules. | Hosting support or a migration expert | Only the host can change server-level restrictions safely. | Provide the exact path, timestamp, HTTP status and installer-log message. |
When you should stop changing settings yourself
Ask the host to intervene when you cannot change ownership, the provider blocks PHP execution in every suitable directory, a WAF continues to reject the same request, or the account has no shell or file-manager permission to repair the destination. Send support the failing path and request a narrow correction: ownership for the migration directory, write access for the required Duplicator folder, or a temporary rule exception for the installer request.
Use an expert migration service when downtime is costly, the destination contains customer data, or the operation will overwrite a production site and you cannot independently restore the backup. A host or expert can also confirm whether the account uses a special PHP handler, isolation policy or filesystem quota that is invisible in FTP.
Quick Recap
Post-migration security checks
- Confirm that
installer.php, the archive and installer logs are removed from every publicly reachable directory. - Restore any .htaccess or security-plugin changes made for diagnosis.
- Re-enable the web application firewall and verify that normal logins, media uploads and scheduled tasks still work.
- Check that the destination owner and group remain the host-approved values and that directories and files have not been left world-writable.
- Change database or administrator credentials if they were exposed during an unsafe transfer, and invalidate temporary access granted to support personnel.
Fast symptom-to-fix reference
| Symptom | Most likely branch | Next action |
|---|---|---|
| “Permission denied” names a folder during extraction. | Ownership or directory write access. | Repair that folder and its parents; do not chmod the whole site to 777. |
installer.php returns 403 before showing the installer. |
.htaccess, WAF, security plugin or host execution policy. | Inspect logs and test a controlled, reversible exception. |
| Import drag-and-drop fails but FTP works. | Browser upload, AJAX, size or WAF restriction. | Manually upload the archive to the documented import directory. |
| The import directory is blocked. | Host restriction or directory policy. | Put the archive in the WordPress root and use Classic Installation. |
| “The uploaded file could not be moved to wp-content/uploads.” | WordPress upload ownership, permissions or FTP-component settings. | Correct system permissions or disable the unavailable FTP path, then retry. |
| Dashboard file changes are unavailable. | DISALLOW_FILE_EDIT or DISALLOW_FILE_MODS. |
Inspect wp-config.php and apply the site’s approved change procedure. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
