Files to remove after installing

Important - if you do not remove these files, your database credentials are exposed and you leave the door open to attackers.

Auto cleanup

SL Migrations automatically deletes the following files after step 4 succeeds:

installer.php
installer-backup.php
The slm-installer/ folder (all of it)
dup-archive__*.txt, .daf, .zip
dup-database__*.sql, .sql.gz
dup-params__*.json
slm-installer-csrf__*.txt
slm-installer-log__*.txt
slm-installer-data__*.sql

Verify manually

After installing, check the web root (through FTP, cPanel File Manager or SSH). If any installer file or any file with the dup- or slm-installer prefix is left → delete it right away.

Why it is dangerous

Each file holds a different kind of sensitive data:

File	What it contains
`installer.php`	A script that runs SQL/file writes - an attacker could reuse it
`dup-params__*.json`	Database credentials in plaintext
`slm-installer-csrf__*.txt`	The archive password + CSRF tokens
`dup-database__*.sql`	A full database dump - including users' password hashes
Archive file	A snapshot of the entire source site

If an attacker guesses the URL (by brute-forcing the hash) → reads the file over HTTP → gets the database credentials → takes over the site.

Prevention

Add a rule that blocks access to installer files at the web server level. For example, with Nginx:

location ~* /(installer\.php|dup-.+\.(txt|json|sql|log)|slm-installer-.+\.txt) {
    deny all;
    return 404;
}

With Apache, use .htaccess:

<FilesMatch "^(dup-.+\.(txt|json|sql|log)|slm-installer-.+\.txt)$">
    Require all denied
</FilesMatch>

Verify that the rule works: open any URL such as https://example.com/dup-params__test.json → it must return 404.
After every install, spend 1 minute checking for leftover files.

Files to remove after installing