Wordfence causes major problems in migration
even if it’s inactive when creating the export package.
Note: When doing a migration, all security, caching, Captcha, and login-renaming plugins should be deactivated. You can do this in the Duplicator installer, in the installer’s Advanced Options section – select “none”
It might be a good idea to completely exclude the plugins folder during export – they can be added back into the site during Step 4 of the Duplicator installation, with caution. It’s also a good idea to filter out the cache folder in wp-content, if present – another villain in the migration process.
If Wordfence is installed, there are 2 items that need to be excluded from the archive –
The plugin’s folder, and the file
wordfence-waf.php
The latter will cause the Duplicator installer to fail, every time… if it’s contained in the Duplicator archive.
You can either filter them and get fails, or go on to a manual install.

Duplicator File Filters . The links on the right pre-populate useful file paths.
If that’s not done, you’ll get a 500 error when running the Duplicator installer.
There may be other conditions that will cause Duplicator to fail…
Common causes are too many media files in
wp-content/uploads/
or custom folders created by plugins, such as NextGen’s
wp-content/gallery/
resulting in an archive that’s too big for the server to handle. These can be filtered and copied manually. Doing this will permit using an archive of the rest of the site during the migration, with those folders migrated manually, unstuffed into the newly created site after running the Duplicator installer in the target new container.
If you have not done this, you’ve had a failed installation, and still want to try to use your export package, do the following:
Manual Migration Using Duplicator Pro, in Eight Steps
1. Create a compressed archive of
public_html
(or whatever the live site container is) via cPanel File Manager or FTP and download it (cPanel down is faster than FTP).
2. In Duplicator>New Package> Archive, choose “Database Only”
3. Take the usual MAMP steps to create your local site – create host, local folder, database, user, password, and keep the credentials handy for use during installation
4. *Copy* the Duplicator .daf or .sit and installer.php into the new empty directory (you may need these again if you get a fail).
(Make sure “Indexes” is selected in the Apache tab of MAMP, and SSL is turned on and local certificate selected)
Note: After you create your export package and download it, always copy the installation files over to the target local container rather than move them – in case you get a fail and need to start over.
5. Unstuff the zip of your live site into a new folder (not the target folder) – have the folder open and ready to drag files over.
Prepare the unstuffed flies for copy – remove plugins:
- Wordfence
- Rename Login
- Captcha
and the file:
wordfence-waf.php
(if present)
and the folder
cache
(if present)
Note: If this is a second (or later) attempt to install into the local container, there will be hidden files from previous attempts. The installer writes new
.htaccess
files into the directory, which will break subsequent install attempts if they’re still in the directory after you clean it out for a re-try. You might also see a .well-known hidden folder… delete it.
In order to delete them, you need to see them. In OSX Sierra and later, the keyboard shortcut command-shift-period will cause them to show. Alternatively, use Transmit to look at the local folder (it always shows hidden files) and use it to delete them. You can also view and edit them in BBEdit if your directory view filter is set to “Everything” (magnifying glass icon, lower left, under your project file list).
6. Start the installation; use the “go to site” arrow in MAMP to get to the site index page, click Installer.php.
Run it up through step 4. Pause to copy files over…
7. Before clicking “Log In To Site, copy all the live site files over except
wp-config.php (a new one has been created by the installer)
8. Then log in, as usual! You’re done!