After completing an installation with Duplicator, it’s essential to remove the installer files to keep the site secure. Deleting the Duplicator plugin will not automatically remove these files.

There’s no need to remove the plugin itself after installation unless it’s no longer needed. This guide covers four ways to remove the installer files, plus what to check for afterward.

Option 1: Leave “Auto delete installer” Checked

When the installer finishes, you can leave the Auto delete installer files after login to secure site checked and this will delete the files for you when you login.

If this option was unchecked for diagnostic reasons or you still need to remove the files for any other reason, see the other options below.

Option 2: Use the Admin Notification Link

1. Log in to your newly installed site’s WordPress admin area.
2. Click the “Remove Installation Files Now!” link at the top of the dashboard.
3. This will immediately delete the installer files.

Option 3: Use Duplicator Tools

1. Log in to your WordPress admin area.
2. Navigate to Duplicator » Tools » General.
3. Click the “Delete Installation Files” button.
4. Confirm the action if prompted.

For a full walkthrough of this page, see A Complete Guide on Duplicator Tools.

Option 4: Manually Delete Files via FTP or File Manager

If you prefer to remove the files manually, follow these steps:

1. Connect to your website using FTP, SFTP, or your host’s file manager.
2. Locate the root directory of your WordPress site. This is usually where the wp-config.php file resides or where the wp-includes and wp-admin folders are located.
3. Delete the following files and folders:

Files and Folders to Remove

Duplicator Pro and Lite 1.3+ Versions

• dup-installer (directory)
• installer.php
• installer-backup.php
• installer-bootlog_[HASH].txt
• [HASH]_archive.zip/daf

Duplicator Lite 1.2 (Older Versions)

• installer.php
• installer-backup.php
• dup-installer-data_[HASH].sql
• dup-installer-log_[HASH].txt
• dup-database_[HASH].sql
• [HASH]_archive.zip/daf

Note: In older versions, these files may have been named: installer-data.sql, database.sql, or installer-log.txt

Important Security Reminder

Even though Duplicator’s installer includes password protection, it should only be used temporarily. To prevent unauthorized access, all installer files must be removed after the installation is complete.

Installer files left in the web root are publicly reachable over the internet and are a known attack vector, anyone who finds the URL can potentially re-run the installer or access the archive.

After removing the files with any option above, browse directly to yoursite.com/installer.php. A 404 or “file not found” confirms it’s gone; if the installer page still loads, the files weren’t fully removed.

Deleting these files protects the site from potential security risks.

That’s it. Following these steps helps keep the site safe and secure by removing the installer files. For the complete installer walkthrough, including where this cleanup fits in the overall process, see Step 4 of The Ultimate Guide to the Installer.

That’s it. Following these steps helps keep the site safe and secure by removing the installer files. For the complete installer walkthrough, including where this cleanup fits in the overall process, see Step 4 of The Ultimate Guide to the Installer.

Looking for a way to solve migration issues? Check out How to Resolve WordPress Migration Issues.