---
title: "Files to remove after installing"
url: https://phatdev.net/en/docs/sl-migrations/which-files-need-to-be-removed-after-an-install
lang: en
updated: 2026-10-20
alternate:
  vi: https://phatdev.net/docs/sl-migrations/which-files-need-to-be-removed-after-an-install
markdown: https://phatdev.net/en/docs/sl-migrations/which-files-need-to-be-removed-after-an-install.md
---

# Files to remove after installing

Part of the doc set: [SL Migrations](https://phatdev.net/en/docs/sl-migrations.md)

> The files the installer leaves behind - they must be removed for security.

**Important** - if you do not remove these files, your database credentials are exposed and you leave the door open to attackers.

## Auto cleanup

SL Migrations automatically deletes the following files after step 4 succeeds:

- `installer.php`
- `installer-backup.php`
- The `slm-installer/` folder (all of it)
- `dup-archive__*.txt`, `.daf`, `.zip`
- `dup-database__*.sql`, `.sql.gz`
- `dup-params__*.json`
- `slm-installer-csrf__*.txt`
- `slm-installer-log__*.txt`
- `slm-installer-data__*.sql`

## Verify manually

After installing, check the web root (through FTP, cPanel File Manager or SSH). If any installer file or any file with the `dup-` or `slm-installer` prefix is left → delete it right away.

## Why it is dangerous

Each file holds a different kind of sensitive data:

| File | What it contains |
|---|---|
| `installer.php` | A script that runs SQL/file writes - an attacker could reuse it |
| `dup-params__*.json` | Database credentials in plaintext |
| `slm-installer-csrf__*.txt` | The archive password + CSRF tokens |
| `dup-database__*.sql` | A full database dump - including users' password hashes |
| Archive file | A snapshot of the entire source site |

If an attacker guesses the URL (by brute-forcing the hash) → reads the file over HTTP → gets the database credentials → takes over the site.

## Prevention

1. **Add a rule that blocks access to installer files at the web server level**. For example, with Nginx:

   ```
   location ~* /(installer\.php|dup-.+\.(txt|json|sql|log)|slm-installer-.+\.txt) {
       deny all;
       return 404;
   }
   ```

   With Apache, use `.htaccess`:
   ```
   <FilesMatch "^(dup-.+\.(txt|json|sql|log)|slm-installer-.+\.txt)$">
       Require all denied
   </FilesMatch>
   ```

2. Verify that the rule works: open any URL such as `https://example.com/dup-params__test.json` → it must return 404.

3. After every install, spend 1 minute checking for leftover files.

## See also

- [Quick Start](https://phatdev.net/en/docs/sl-migrations/quick-start)
- [Fixing permissions](https://phatdev.net/en/docs/sl-migrations/how-to-fix-file-permissions-issues)