Support

Site Restoration

#42782 403 error when running kickstart

Posted in ‘Site restoration’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

PHP version
n/a
CMS Type
Joomla!
CMS Version
5.4.3
Backup Tool Version
10.3.2
Kickstart version
9.0.3

Latest post by nicholas on Sunday, 08 March 2026 03:06 CDT

wd5mush

I am trying to make a copy of my live site to a subdomain.  I copied a backup file from my public site to the root folder of my subdomain, then added kickstart.php, which I renamed to fred.php.

Each time I try to run fred.php I get a 403 error.  I have used Kickstart many times in the past when transferring a site from my PC to a public server, but this is the first time I  have encountered this error.  What am I doing wrong?  (and why do I always seem to have problems like this on a Friday evening!)

nicholas
Akeeba Staff
Manager

I recommend reading the following documentation pages, in this order, and follow the instructions therein:

3. Security

4. Uploading Kickstart

5. Bypassing PHAR

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

wd5mush

Thank you, Nicholas. I wasn't expecting a reply over the weekend, so your support is much appreciated.

I have not had any luck so far.  It is now clear that the problem lies with the .htaccess file in the root directory.  I temporarily renamed the .htaccess and .htpassword files, and that allowed me to fire up Kickstart.  However, I decided not to proceed without working .ht files.

As you suggested, the problem was having the subdomain in the root directory. I have asked my host to suggest a way forward.  He is now creating a clone of my site in the subdomain directory.  That has not worked so far, as I get an error message that the subdomain URL is not included in the list of authorised URLs.  I have now added that to the original site and suggested he try the cloning process again.

I have used Kickstart numerous times in the past without any major problems with this host.  Has something changed?

nicholas
Akeeba Staff
Manager

While Kickstart has had a major update, this has nothing to do with the problem you described. What you described is actually something that has to do with how Apache works. It's been something I have come across several times over the past 20 years and have documented since well over a decade ago in https://www.akeeba.com/documentation/akeeba-backup-joomla/restoring-backups.html#general-guidelines:

If you are restoring on a subdomain, make sure that the subdomain's root directory is NOT a subdirectory of your main site. This is the same as the previous paragraph, really. Most hosting control panel software default to using a subdirectory of your site's root when creating a subdomain. For example, if your site is www.example.com and its root is public_html if you create the subdomain dev.example.com your hosting control panel will put its root in public_html/dev. Therefore you will have the problem we described above. In this case ask your host what is the best way to create a root folder for the subdomain next to public_html, not inside it.

If you want to be technical, the whole problem comes from the fact that Apache does two things. First, it's what I described in the paragraph in the documentation I pasted above: Apache will include the contents of .htaccess based on the filesystem tree, not the logical organisation of virtual hosts (subdomains). The second problem is how RewriteRules are handled in this configuration cascading scenario. If you're used to cascading in programming languages and CSS, you probably expect that the more specific file (the one in your subdomain's root) will overwrite the least specific one (the one in your main site's root, i.e. the subdomain root's parent directory). Yeah, no, Apache doesn't do that. The least specific file is the one that overrides the more specific files because cascading works backwards: Apache reads the virtual host configuration, then the .htaccess file from the directory you are accessing, then the file from the directory above it etc. This can, technically, be overridden but only for RewriteRule directives with many caveats and weird conditions, making it absolutely impractical to deal with in an automated tool like Admin Tools' .htaccess Maker. Addressing this situation is unnecessarily complex. It makes a lot more sense simply doing the reasonable thing and having subdomain roots next to each other and next to the main site's root instead of nesting them like Russian dolls.

If you remove the subdomain and then create it afresh you will see that you are given a choice of where to put its root. It's prefilled with a directory of the main site, but you can change it.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

wd5mush

Thank you, Nicholas.

I sort of understand.  The subdomains are set up with a utility, so I don’t have much control.  I see you suggest how it might be done differently, but as the Host manager has cloned my site to a subdomain, and it appears to be working OK, I shall stick with what I have.  It sounds like I might run into issues if I try to restore a backup of the subdomain site.  I’m not going to risk experimenting, as I'll only need the subdomain setup while we add pages that require careful proofreading by many people.  Then I can revert to the main site.

As always, thank you for your help and advice.

Best wishes,

Alan

nicholas
Akeeba Staff
Manager

If all else fails, you can restore the subdomain using Kickstart's and the backup restoration script's CLI. These do not require any kind of web access.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!