Support

Site Restoration

#42466 No Restoration - 403 You do not have permission

Posted in ‘Site restoration’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

PHP version
8.4
CMS Type
Joomla!
CMS Version
5.4.0
Backup Tool Version
Kickstart
Kickstart version
8.06

Latest post by Ben Kenobi on Wednesday, 26 November 2025 08:42 CST

Ben Kenobi

The current published wisdom is not working in my case. Joomla update from 5.4.0 to 5.4.1 failed, as a result access to the backend and frontend is not possible. Kickstart fails with a 403 permission error, nothing I do resolves this - I have no htaccess, no web config, I also cannot disable akeeba admin tools - no main.php there to rename - 

Really need to cover all the potential failure vectors that may be encountered in the documentation - and keep it up to date.

Not sure what to do with this now - you need to create a much better restore method that doesn't get impacted by akeeba tools or better still doesn't require Apache / web server to be functional

nicholas
Akeeba Staff
Manager

Let's start with the fact that your site redirects to HTTPS but you do not have a valid TLS certificate (it is expired). This will always cause your browser show you a connection error. You can fix that very easily in your hosting control panel. After all, you are using a free of charge Let's Encrypt certificate like all of us; your hosting control panel has a way to renew it. If you do not know how, ask your host.

The fact that we get an HTTP 301 redirection to HTTPS when we try to access any URL on your site over plain HTTP tells me that for sure you have a .htaccess file for this kind of redirection can only be implemented in either the .htaccess file, or the server's virtual host configuration. Please do remember that dot-files (files whose name starts with a dot) are hidden. Unless you explicitly tell your FTP/SFTP client or hosting control panel file manager to show you hidden files you won't see it. A very simple way around it is to upload an empty file named .htaccess.

As I said, and since I see that you are running on an Ubuntu server (which is an odd choice for a commercial host), is it possible that you are self-hosting, or at the very least using a server someone else is managing for you? If so, what would normally be in the .htaccess file would be in Apache's virtual host configuration. This can include the aforementioned redirect from HTTP to HTTPS, as well as blocking access to .php files including Kickstart itself. If uploading the blank .htaccess file did not work for you, ask your host / server admin if this is the case.

If that did not help, do remember what I have written in the documentation:

Do not restore in a subdirectory of your main site. For example, if your site's root is in public_html do not restore to public_html/dev. The reason is that the .htaccess files, which tell Apache (your web server) how to server your site, cascade. That is, Apache will read all .htaccess files in all folders leading to the one hosting your site's index.php file. This will cause problems with the restored site which you will experience as 404, 403 and 500 error messages or blank pages. These have nothing to do with our software and / or the restoration. It's how your web server works. Use a subdomain instead.

If you are restoring on a subdomain, make sure that the subdomain's root directory is NOT a subdirectory of your main site. This is the same as the previous paragraph, really. Most hosting control panel software default to using a subdirectory of your site's root when creating a subdomain. For example, if your site is www.example.com and its root is public_html if you create the subdomain dev.example.com your hosting control panel will put its root in public_html/dev. Therefore you will have the problem we described above. In this case ask your host what is the best way to create a root folder for the subdomain next to public_html, not inside it.

If you are using a subdirectory or subdomain to restore your site, that would be the problem. If that's the case, please provide further information about your directory structure and whether you are using Admin Tools' .htaccess maker on the main site so I can guide you further.

Now, I want to address your complaint:

 you need to create a much better restore method that doesn't get impacted by akeeba tools or better still doesn't require Apache / web server to be functional

You mean like what has been in place for the past 18 to 20 years? 

Remember that the first thing you see in the documentation is this:

Akeeba Backup is a complete site backup solution for your Joomla!™ powered website. It will take a copy of your entire site – files and database data – and put it in a backup archive file. You can restore the backup archive file on the same or a different site, even a completely different server. The restoration uses a web installer script. The installer script is included in the backup archive itself.

In other words, all backup archives taken by Akeeba Backup are fully self contained: they have your site's files, a copy of your database, and the restoration script.  That's how this software has worked for the past 20 years. And I repeat: twenty years. Since Joomla 1.0, when it was called JoomlaPack. This is the core design philosophy of this software since its first stages of inception, all the way back in 2004. All you need to do is somehow extract the backup archive and transfer all extracted files into the hosting account where you are restoring your site into. And, boy, do I ever give you tonnes of alternatives to do exactly that!

Regarding restoring when Apache is completely dead or not even installed, I have been doing that for 18 years if you would please pay attention. From 2008 to 2025 there was Akeeba UNiTE which would do a full unattended restoration using nothing but the CLI. All you needed was the CLI PHP binary and a functioning database server (of course!).

What bugged me is that you needed a separate script (UNiTE) to do that, and that UNiTE itself was doing too much: remote backups, backup downloads, and restoration. That was confusing. Since earlier this year (2025), this CLI restoration functionality is rolled into the Akeeba Backup Restoration Script, reducing your dependency count even further. All you need is extract your backup archive using Kickstart in CLI mode, set up your restoration information YAML file, and let BRS go to town with it, all from the CLI. I spent three months on reimplementing the restoration script. I never expected to make me more money, nor it ever did for that matter, but I did it anyway because I care.

But I digress. Let's go back to the web interface, for there are many alternatives and, as you will soon see, if you want to eschew using my software to restore a backup you absolutely can do that. It's not gonna be fun, and there are easier ways to go about it, but I do give you that option because who am I to dictate your use case?

So, let's see what are your options.

The most common BUT NOT THE ONLY option is uploading the backup archive and Kickstart into it. It works for 99% of use cases, and that's what I recommend most people use. Remember, this is most typical and easiest for most people, but far from the only option. Do not conflate popularity and/or ease of use with availability.

The integrated restoration is just the same as above, just dressed differently. Insert the "Corporate wants you to find the differences between these two pictures" meme from (the American knockoff of) The Office. The integrated restoration uses a headless version of Kickstart with the client-side interface being rendered inside Joomla. That's all. In both cases, the archive is extracted and you're redirected to the /installation directory where it extracted the backup restoration script which was included in the backup archive itself.

But here's the thing. As Kickstart tells you every time it starts, it's just an archive extraction tool. The actual restoration script is in the backup archive. Corollary: you just need to extract the backup archive somewhere, somehow, and get the extracted files into your site. The extraction does not have to take place on the same site, or even server. And the backup archive does not necessarily have to be a JPA or JPS file. You see where I am going with this?

Sticking to the beaten path, but perhaps straying off towards its more overgrown edges, we have another option. You can restore on a different server and take a backup as a ZIP file. Upload that ZIP file on your host and extract it using your host's tools. Try to access the site and you'll see the restoration script. This, by the way, was how Akeeba Backup worked back when it was still called JoomlaPack in the Joomla 1.0 era, twenty years ago. Why not still use it? Not only it's more steps, but it takes  f o r e v e r  to upload the tens of thousands of files a modern Joomla site consists of. A simple, empty installation of Joomla 6.0.0 with just Akeeba Backup Professional installed transferred over a gigabit connection to a server across the office (sub-1msec latency) takes the better part of 15 minutes. Extracting the same backup archive directly on the same local server takes, um, under five seconds. That's why I made Kickstart in 2008. Still, the OG option of manually uploading files has, does, and will exist as it's made possible by the core design philosophy of the backup system I have developed.

Now we're stepping a bit further into the bushes. We can extend the previous method, without an intermediate restoration. You can use Kickstart on any server, live or local, to extract the backup archive. When you reach the point where it says "Run the restoration script" stop. Upload the extracted files into your live server instead. For a local server you can install something like XAMPP, MAMP, WAMPserver etc on your computer. For a live server, just create a subdomain, making sure its web root is OUTSIDE your main site, as noted in the documentation I pasted above. Again, the annoying thing about this method is that transferring the files to the live server over (S)FTP happens at a glacial pace. I hope you understand that I am not responsible for the 50-year-old FTP protocol, or the nearly 40-year-old SFTP protocol as I am about to turn 45 which means I wasn't even born for the former, and barely into kindergarten for the latter.

But that's not all! Let's leave the beaten path and go straight into the woods. You have more options. As I mentioned, you can use Kickstart on the command line. If you are handy with a terminal, SSH into your site, cd into your site's web root, and run php kickstart.php your_backup_archive.jpa where kickstart.php is the name of your Kickstart file and your_backup_archive.jpa is the name of your backup archive file. Once the backup archive is extracted, you can of course go to your browser and use the web interface – or use the CLI-based restoration. Whatever floats your boat.

If you want to completely forego the beaten path, and all sense of sanity and self-preservation, I have you covered! Even if all else fails you can still restore your site as documented with the unorthodox emergency restoration. I have seen a small handful of use cases where this was actually necessary, and we are talking about some really messed up sites and servers.

Finally, even if you do not want to use Kickstart to extract your backup archives, I have both documented the JPA and JPS archive format, and give you the option to eschew that altogether using the ZIP archive format (even providing an alternative which DOES NOT use any of my code, instead using PHP's ZipArchive class).

If you are dead set against using any of my code to make your life easier restoring a site you can take a backup in the ZIP format, and implement the unorthodox emergency restoration procedure using nothing but system tools (unzip and sed), which works when you do not have Apache or PHP installed on your server; you only need a MySQL-compatible database server to restore the database (which should be fairly obvious).

So, what exactly are you asking me? Is this not enough?

😉

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Ben Kenobi

OK - I will explore the command line options and see where that goes - hadn't considered that. 

On the Ubuntu thing - my choice is based on a dislike of Red Hat and distro's that use 'se linux' - overcomplicated and insane just like a lot of Linux stuff - no I am not a Linux fan but it serves a purpose. If I have to start messing around in config files to do even basic things that is just not acceptable and SE linux caused me so many problems that I will never entertain it again - once upon a time I did use Red Hat ..

I am the host, because again I don't care for being constrained by external providers that dicatate what I can or cannot use, or pay by the gigabyte and bandwidth throttling based on 'grade' of account - I operate two websites and two email servers over which I have total control and can be sure that the only backend access is by me alone - yes I am very trusting - not ....  I do use a commercial grade firewall as a frontline access provision and also use Akeeba as a secondary defence, backend access is not possible from external sources but I also restrict access internally - so I am more than happy with your code and products, and yes I like the security options in Akeeba - they're straightforward enough to use - unlike SE Linux that requires far too much input and is too obtuse when fault finding why things don't work. 

On the cert thing I do use Lets Encrypt and you must have looked at the site when I was replacing the images - I also take disk images so Akeeba Backup is my 1st preference but I do have other restoration options as  backups. I restored an image from August. I identified the issue as being a 'patching' issue in the OS itself linked to Apache that had failed, and had corrupted things to a point where I had to do a lot of manual 'updating' to clean up the mess, so  I had to go back 3 generations to figure this out - my backups ironically contained the error and it wasn't obvious, everything looked fine, except a deep dive in logs showed that it wasn't. What is frustrating that of the 3 servers operated only one demonstrated this 'corruption' - further compounding my dislike of Linux in general because all 4 servers despite very similar configs are inconsistent when it comes to updates and patching - I would expect them all to apply the same updates and patches but they don't.

So what am I asking - maybe a decision matrix that is very close to your response - if you have this then do this, if you encounter this then do this, sort of a flowchart if you like - or an interface that can inspect the config and make recommendations exactly like those in the response (guess I could be deemed lazy) - and I do get your sites hint to rehearse and practice and I do this but this is the second time I have encountered a scenario that I hadn't rehearsed - the 1st was the firewall blocking all attempts to do anything (locked out) but couldn't get it disabled despite following countless 'solutions' from the internet and there is a limit to how much time I am prepared to donate to chasing squirrels in Linux configs. I wonder if some sort of log scanning tool could be created that would identify potential issues as part of the backup process - I have no time to create such a thing though.

I am almost tempted to set up a virtual restoration site that should work unless Apache is dead,  

nicholas
Akeeba Staff
Manager

I am a Linux enjoyer. My dev machine is a desktop running Arch Linux, my local server is a fairly powerful ARM board with 4 NVMe drives running Debian Trixie. If I could get a Linux phone which runs the bank and government apps I am required to use I would absolutely do that (one day, I hope).

For my live sites I mostly use Rochen because they have very clear and gracious policies. For a couple of sites which require more low level access to the OS I use Debian. Like you, I am not fond of SELinux either. I get what they are trying to do, but it gives me an icky Microsoft-y feeling.

Regarding a flow chart, it's not as clear cut as that. I mean sure, if I could get accurate information from users we could narrow it down but a. It would be dozens of printed pages b. It would require a level of technical acumen which is rarely found among my users and c. I have been doing end user support for 25 years so I know for a fact most people would be complaining about being given this option!

Here is the thing. You don't have to go about it on your lonesome. You are paying me downloads and support. You know what? Someone like you, giving me spot on information and technical background of their situation makes my life INCREDIBLY easier arriving at a solution. I can't describe how vague, accidentally misleading, and frustrating most tickets are. Patients lie, in the sense that they give their (mis)interpretation of the situation instead of cold facts. Not having to guess the facts out of someone's interpretation cuts down my workload by a good 80%. So, please, next time just ask me for help. I will honestly be GLAD to have a technical person giving me good quality information to help them solve a prickly technical issue. 

Now that I have your full story, yup, I would have pointed you to the CLI restoration option in BRS. Nothing else. Once you get it working you can and will automate it into a script. You are the target audience for this feature.

PS: I have to ask. Is this your real name? It is okay if you would rather not answer. I am just noting a propos of nothing in particular that my office is full of Star Wars items 😀

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Ben Kenobi

Would that I had the skills that the name implies - alas I am forced to work much harder at getting stuff 'done' - names Neil ... and although I've been described as a Jedi (problem solving skills ironically) being one is but a dream. The concepts proposed in Sci Fi sooner or later become science fact, I also like the principles and philosophy's that are explored in the likes of Star Trek and Star Wars - I actually believe there are significant similarities in Star Wars 'evil empire' to the politics of the day - aka oppression and subjucation - aka Goerge Orwells 1984 thought police - or the people meddling explored in Serenity ...  

As for the flowchart isn't straight forward - yup I totally get that - accounting for all possible combinations would be a task that had no end, what may work for one distro would not work for another. I do find the amount of log file scanning required to be laborious and error prone, so many dependencies and potential places having unexpected impacts that simply looking in the right place becomes trial and error, worse still you can spend hours trawling through logs and the answer isn't there ... it is the time commitment that Linux demands from a support perspective that holds it back - sure you can get good at it but why should we have to. In this particular instance the system was lying, claimed everything was up to date but it wasn't and some dependencies as a result were screwed up - unfortunately I didn't document the error which was a mismatch in a request to an expectation in an application - likely some deprecation of a command - I had to get the server backup and didn't think to record what I identified - I will do better next time.

I'll work on the CLI strategy on a sacrificial box and maybe post the results.

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!