Free tools Windows power users keep installed
One-click scans. No signup required.
Changing upload_max_filesize in php.ini does not guarantee that your website will accept a larger file. The web request may be using a different PHP configuration, the PHP process may still be running with its old settings, or Nginx, Apache, a proxy, your PHP-FPM pool, hosting policy, or the application may reject the request first.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Fix the limit from the outside in: identify the web server’s PHP SAPI and loaded configuration, raise PHP’s related directives together, raise any web-server request-body limit, reload the process that owns each configuration, and verify the effective values with a web request rather than with the command-line PHP binary.
As an Amazon Associate I earn from qualifying purchases.
What “maximum upload size” means in PHP
PHP has several different limits that are often described as one upload limit. They apply at different stages and to different amounts of data.
| Directive | What it limits | Documented default | Important detail |
|---|---|---|---|
upload_max_filesize |
One uploaded file | 2M | The limit applies per file, not to the entire request. |
post_max_size |
The complete HTTP POST body, including files and ordinary form fields | 8M | It must be larger than upload_max_filesize. If the body exceeds it, PHP leaves $_POST and $_FILES empty. |
memory_limit |
PHP’s memory allowance while processing the request | Not fixed here | PHP documentation generally recommends keeping it larger than post_max_size. |
max_file_uploads |
How many files can be uploaded in one request | 20 | A request can fail because it contains too many files even when each file is small. |
A practical planning order is memory_limit > post_max_size > upload_max_filesize. This is a sizing rule, not a promise that every application holds the full request in memory. Application limits, reverse proxies, web servers, and hosting providers can still impose a lower ceiling.
#1 Best Overall
For example, if you want to accept one 100 MB file, set upload_max_filesize to at least 100M and post_max_size above 100M to leave room for multipart overhead and other fields. Do not set both directives to exactly the same value.
Why changing php.ini appears to do nothing
You edited a file used by the CLI, not by the website
PHP can load different configuration files for the command-line interface (CLI), CGI, PHP-FPM, and an Apache PHP module. The command php --ini reports the configuration used by the CLI binary. It does not prove that the web server is using that file.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe PHP manual notes that the server-module version reads php.ini when the web server starts. CGI and CLI versions read configuration when each invocation begins. Consequently, a terminal test can show your new value while a browser request still uses an older value—or the reverse.
| Deployment | Process that reads PHP settings | What to reload after editing | Best verification |
|---|---|---|---|
| CLI script | The CLI PHP binary for that invocation | Run the command again | php --ini and php -i |
| PHP-FPM behind Nginx or Apache | The relevant PHP-FPM master process and pool | Reload or restart that FPM service or pool | A diagnostic page served through the website |
| Apache PHP module | Apache’s loaded PHP module | Gracefully reload or restart Apache | A diagnostic page served by Apache |
| CGI | The CGI process for each request | Usually no persistent PHP process, but restart the owning service if your platform keeps one | A diagnostic page served through CGI |
The owning process was never reloaded
Even when you edit the correct file, a long-running PHP-FPM worker or Apache process can continue using the old values. Reload the service that actually reads the configuration. Reloading Nginx alone does not reload PHP-FPM, and restarting PHP-FPM does not reread an Nginx configuration change.
Nginx rejects the request before PHP receives it
Nginx applies client_max_body_size to the client request body before handing the request to PHP. Its documented default is 1m. When the request exceeds that value, Nginx returns HTTP 413, commonly shown as “Request Entity Too Large,” and PHP never gets a chance to evaluate upload_max_filesize.
Rank #2
Setting client_max_body_size 0; disables Nginx’s size check, although an explicit operational limit is usually safer than unlimited requests. The directive can be placed at http, server, or location scope; a more specific block can override a broader one.
Apache imposes its own request-body limit
Apache’s LimitRequestBody restricts request-body bytes independently of PHP. It can be configured in server, virtual-host, directory, file, or location context. Apache documents a value of 0 as unlimited. If a virtual host or directory has a lower value than your PHP settings, changing php.ini cannot raise the effective limit.
A PHP-FPM pool, managed host, or application overrides PHP
PHP-FPM pools can apply administrative settings separately from the main php.ini. Managed hosting accounts may also enforce account-level caps that are not visible in the file you edited. Finally, a content-management system, framework, plugin, or custom upload handler may enforce its own maximum.
If a web diagnostic page shows the values you expect but the application still rejects the file, inspect the FPM pool configuration, the applicable virtual host, the application’s upload setting, and your provider’s policy. Do not keep changing php.ini when the rejection is happening in a later layer.
Verify the configuration that the website is actually using
Use a temporary, access-controlled diagnostic endpoint served through the same hostname and PHP route as the failing upload. A minimal example is:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →<?php
header('Content-Type: text/plain');
echo 'SAPI: ' . PHP_SAPI . "n";
echo 'Loaded php.ini: ' . (php_ini_loaded_file() ?: 'none') . "n";
echo 'Scanned .ini files: ' . (php_ini_scanned_files() ?: 'none') . "n";
echo 'upload_max_filesize: ' . ini_get('upload_max_filesize') . "n";
echo 'post_max_size: ' . ini_get('post_max_size') . "n";
echo 'memory_limit: ' . ini_get('memory_limit') . "n";
echo 'max_input_time: ' . ini_get('max_input_time') . "n";
echo 'max_file_uploads: ' . ini_get('max_file_uploads') . "n";
Protect the page with authentication or an IP restriction. Remove it as soon as you finish; a public phpinfo() page can disclose paths, modules, environment variables, and other useful information to an attacker.
Record four things before making changes:
- The value of
PHP_SAPI, such as FPM, CGI, or an Apache module. - The exact path printed by
php_ini_loaded_file(). - Any additional files listed by
php_ini_scanned_files(); a later scanned file may override an earlier directive. - The effective values of all related directives, not just
upload_max_filesize.
Then compare that output with php --ini in a shell. If the paths or values differ, your CLI test is examining a different PHP installation or SAPI.
A repeatable fix procedure
- Reproduce the failure and note the response. Record the HTTP status, the visible error, and whether the application receives any file metadata. HTTP 413 strongly indicates a request-body limit in Nginx, a proxy, or Apache. A PHP upload error points to PHP or application handling.
- Measure the web SAPI. From the protected diagnostic page, record
PHP_SAPI, the loaded and scanned configuration files,upload_max_filesize,post_max_size,memory_limit,max_input_time, andmax_file_uploads. - Edit the file actually loaded by the web SAPI. Set the per-file limit and make the total POST limit larger. For a 100 MB target, a conceptual configuration might be:
upload_max_filesize = 100M post_max_size = 110M memory_limit = 128MThe numbers are an example of the required relationship, not a universal recommendation. Choose values that fit your application and server resources.
- Check every scanned override. If a later
.inifile sets a smaller value, changing the main file will not win. Make one deliberate change in the file that is loaded last, or remove the conflicting override according to your platform’s configuration policy. - Raise the web-server request limit. If Nginx handles the request, set
client_max_body_sizeat the correcthttp,server, orlocationscope to at least the intended request size. If Apache handles it, inspectLimitRequestBodyat every applicable scope. - Validate and reload Nginx. Run
nginx -tbefore applying a change. If the test succeeds, reload withnginx -s reload, which sends Nginx a SIGHUP to reread its configuration. - Reload PHP-FPM or Apache. Reload or restart the relevant PHP-FPM service or pool. With the Apache PHP module, gracefully reload or restart Apache. Use the service-management command appropriate to your operating system; do not assume that restarting Nginx also restarts FPM.
- Verify again through the browser. Reopen the diagnostic endpoint and confirm that the effective values changed. If they did not, you either edited the wrong file, reloaded the wrong process, or are viewing a different virtual host or pool.
- Run controlled uploads. Test a file comfortably below the intended limit, one close to it, and one above it. Keep the request’s other fields and upload route the same so that you can identify the threshold accurately.
- Remove the diagnostic endpoint. Delete it or leave it behind a strong access control once troubleshooting is complete.
Nginx: fixing a 413 response
A 413 response means Nginx rejected the request body before PHP could process it. Add the directive in the configuration block that serves the upload URL, for example:
server {
client_max_body_size 110M;
# other directives
}
The value must cover the complete request body, not merely the raw file. If a more specific location block has a smaller value, it can still win over the server setting. After editing:
Rank #4
- Run
nginx -tand correct any syntax error. - Reload with
nginx -s reload. - Retry the upload and check the response status.
If Nginx is behind another reverse proxy or load balancer, that upstream service may have its own body-size or timeout limit. A successful Nginx reload does not prove that every proxy in front of it accepts the same request.
Apache: checking LimitRequestBody
Search the active Apache configuration, virtual host, directory rules, and location-specific rules for LimitRequestBody. The directive counts request-body bytes and is independent of PHP’s upload directives. Apache allows it at several configuration scopes, so a directory or location rule can override a server-wide value. A value of 0 means unlimited according to Apache’s documentation, but setting an explicit ceiling is generally easier to operate safely.
After changing the applicable rule, gracefully reload or restart Apache, then verify the request through the browser. If PHP’s diagnostic page shows the new values but Apache still blocks the upload, inspect the Apache error log and the most specific configuration scope serving the URL.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →PHP-FPM and pool-level overrides
PHP-FPM commonly serves multiple websites or pools from one installation. A pool can apply administrative values that differ from the global file. This explains cases where the expected php.ini path is displayed but an application still behaves as though a smaller limit is active.
- Identify the FPM pool handling the affected virtual host.
- Inspect pool configuration for administrative PHP settings and request-related overrides.
- Reload or restart that pool or the FPM master process.
- Recheck the values through the affected hostname, not through a different site on the same server.
On managed hosting, you may not have permission to change these settings. Ask the provider which PHP SAPI, pool, and account-level cap apply to the domain; provide the observed HTTP status and the web diagnostic values rather than only saying that php.ini was edited.
When the PHP values are correct but uploads still fail
The upload is too slow
max_input_time limits how long PHP spends parsing request input. A large file on a slow connection can exceed this time even when its size is allowed. Increase it only after considering worker occupancy and denial-of-service risk, and check reverse-proxy and web-server read timeouts as well.
The temporary upload directory is unavailable
PHP writes incoming files to a temporary directory before the application moves them. An unwritable upload_tmp_dir, incorrect ownership, a full filesystem, or insufficient free space can make an otherwise valid upload fail. Check directory permissions, the effective PHP user, mount capacity, and the relevant PHP or web-server error log.
Recommended Free Tools
There are too many files in one request
The documented default for max_file_uploads is 20. If a form sends more files than that, raise the directive deliberately or redesign the form. Increasing it also increases the amount of work and temporary storage a single request can consume.
The application has its own validation
Applications often impose a smaller limit for security, storage, or business reasons. Look for an application setting, framework validation rule, API gateway policy, or JavaScript-side check. A browser message generated by the application is not evidence that PHP rejected the request.
A proxy or hosting policy is smaller
Reverse proxies, control panels, web application firewalls, and hosting plans can cap request size or duration. Trace the request path from the client to the edge proxy, web server, PHP-FPM, and application. The first component to reject the body determines the visible error.
Use the error and threshold to locate the failing layer
| Observation | Most likely layer | Next check |
|---|---|---|
| HTTP 413 before the application responds | Nginx, Apache, or another proxy | Check client_max_body_size, LimitRequestBody, and upstream proxy limits. |
$_POST and $_FILES are both empty for an oversized body |
PHP post_max_size |
Confirm the web value and make it larger than the complete request. |
| A single file fails near the configured per-file threshold | PHP upload_max_filesize or an application rule |
Compare the web diagnostic value with the application’s configured limit. |
| Small uploads work, but long uploads time out | max_input_time, proxy timeout, or web-server timeout |
Inspect timing limits and logs rather than only increasing size directives. |
| Values look correct, but PHP reports temporary-file or write errors | Temporary directory or filesystem | Check upload_tmp_dir, permissions, ownership, and free space. |
| CLI reports one value and the browser reports another | Different SAPI or PHP installation | Use the web diagnostic page as the authority for web uploads. |
How to test the final configuration safely
- Choose a target per-file size and write down the required request size, including a margin for multipart fields.
- Confirm the intended relationships among
memory_limit,post_max_size, andupload_max_filesize. - Confirm that Nginx, Apache, and any proxy accept at least the complete request size.
- Upload a small control file to prove that the route and permissions work.
- Upload a file just below the target and record the HTTP status, application response, and temporary-storage behavior.
- Upload a file just above the target. It should fail predictably at the layer you intended to enforce the limit.
- Check logs for the web server, PHP-FPM, and application, then remove the diagnostic page.
Keep limits finite and proportionate to available memory, worker capacity, disk space, and expected traffic. An unlimited body-size setting can turn a configuration mistake or abusive request into exhausted storage or occupied workers.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
