Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

To enable uploads, prepare a secure, writable upload directory and a PHP installation that accepts uploads, then add this setting to LocalSettings.php:

$wgEnableUploads = true;

Users who have the upload permission can then use Special:Upload. The setting alone is not sufficient: PHP limits, directory permissions, file-type rules, web-server request limits, and script-execution protections all have to agree.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What enabling uploads actually requires

MediaWiki stores uploaded files outside the page database, normally in the wiki installation’s images directory. A successful upload therefore depends on three separate layers:

  • PHP: file uploads must be enabled, and PHP must permit a file of the requested size in both the request body and the temporary upload area.
  • MediaWiki: uploads must be enabled, the user must have the upload right, and the file extension and detected MIME type must pass MediaWiki’s checks.
  • Web server and operating system: the upload directory must be writable by the web-server process but must not allow an uploaded script to execute.

If any one of these layers rejects the request, the user may see a generic failure even though the other settings are correct. Work through the following sequence rather than changing several unrelated settings at once.

#1 Best Overall
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter | 4Pack Type C Female to A Male Cable Converter for Apple Duo 17 16 15 14 Plus,iWatch Watch 12 11 10,iPad 9 8 Air,Airpods 5 4
  • Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
  • Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
  • Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
  • Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
  • 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.

1. Confirm PHP upload support

Enable PHP file uploads

Open the PHP configuration used by the web server, not merely the configuration used by a command-line PHP binary. Set:

file_uploads = On

After changing the file, restart or reload the PHP handler and web server as required by your deployment. If the web server uses PHP-FPM, for example, the running FPM pool must be reloaded before it sees the new value.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Check open_basedir

When open_basedir is enabled, its allowed paths must include both the MediaWiki upload directory (normally the wiki’s $IP/images) and PHP’s temporary upload directory. A missing temporary path can cause an upload to fail before MediaWiki can inspect it, while a missing images path prevents the final move into MediaWiki storage.

Identify the active configuration

Verify values through the PHP environment serving the wiki. A command-line php.ini can differ from the configuration used by Apache, nginx with PHP-FPM, or IIS. If a value appears correct in a shell but the web interface still reports a limit or upload error, inspect the web-serving PHP process and its pool-specific overrides.

2. Prepare and protect the upload directory

Use the directory MediaWiki expects

The default upload directory is usually images under the MediaWiki installation directory. Older installations may use uploads, and administrators can set a different path with $wgUploadDirectory. Confirm the actual configured path before changing permissions.

Give the web-server account write access

The account running the web server or PHP handler must be able to create directories and files there. The official manual recommends permissions equivalent to 755 for the directory and says uploaded files must not be executable. Ownership, access-control lists, and mandatory access controls such as SELinux can override ordinary mode bits, so check all three when a write fails.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Do not make the directory universally writable as a quick fix. Grant the minimum write access to the service account, retain ordinary read access needed to display files, and test creation and retrieval as the web process.

Rank #2
Sale
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter | USB C Dongle with 90W Max Power Delivery, 3×5Gbps USB A Data Ports, for MacBook, Dell, and More (Charger Not Included)
  • 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
  • 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
  • Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
  • 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
  • What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.

Preserve web-server protections

MediaWiki installations include protection rules for the upload directory, commonly in a supplied .htaccess file. Keep those rules when moving or restoring the directory. If the site does not use Apache, apply equivalent rules in nginx, IIS, or the relevant server so a visitor cannot upload a server-side program and then request it for execution.

The critical security boundary is that an uploaded file may be downloadable data, but it must never become executable code in the web directory. Also consider disabling directory listings where your server would otherwise expose a browsable file index.

3. Turn on MediaWiki uploads

Edit LocalSettings.php

After PHP and storage are ready, edit the wiki’s LocalSettings.php and add the setting shown above. MediaWiki 1.5 and later use this setting in LocalSettings.php. Put it in the normal configuration area, after the MediaWiki installation bootstrap has been included, and ensure the PHP syntax remains valid.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Save the file, reload the wiki, and open Special:Upload. If the page is still unavailable, continue with the rights and troubleshooting checks instead of assuming the setting was ignored.

Understand the scope

$wgEnableUploads controls whether the upload feature is available. It does not grant every user permission, override prohibited extensions, increase PHP’s request limit, or make an unsafe directory safe. Those controls remain independent by design.

4. Give the right users permission to upload

The upload right

Uploading requires the upload user right. MediaWiki’s image-administration documentation says this is granted to logged-in users by default in a standard installation. Check the effective group permissions if your wiki uses custom groups, an access-control extension, or anonymous editing.

To restrict uploads, use $wgGroupPermissions for the group you intend to authorize rather than exposing the right to every visitor. Test with an account in that group and with an account outside it; an administrator account can hide an ordinary-user permission mistake.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter | 85W Max PD, 2 USB 3.0 & 1 USBC Data Ports, SD/TF Card Reader, for Laptops/Mac and Other Type C Devices (Charger Not Included)
  • Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
  • Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
  • Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
  • Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
  • What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.

The reupload right is separate

The reupload right controls replacement of an existing file. A person may be allowed to add new files but not overwrite one already stored. Decide these rights separately, especially on a public or collaborative wiki where replacing an established file can affect many pages.

5. Allow the file formats your wiki needs

Add an extension deliberately

MediaWiki maintains an allowed-extension list. To add PDF support, for example, append the extension in LocalSettings.php:

$wgFileExtensions[] = 'pdf';

Use the extension without a leading dot and apply the same approach for another format only after confirming that your server and users actually need it. The extension on the name is only one check; MediaWiki also evaluates the detected MIME type and its prohibited-extension rules.

Why an allowed extension can still fail

A file can be rejected when its content does not match the claimed extension, when MIME detection fails, or when the extension is prohibited by a higher-priority rule. Renaming a file, accepting every MIME type, or broadly weakening strict checks is not a safe repair. Investigate the file’s actual format and the server’s MIME-detection behavior first.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keep strict checks on public wikis

The MediaWiki manual warns that disabling strict extension checks or changing prohibited extensions can expose users to security risks. Keep MIME verification and the normal prohibited-extension list enabled unless you have a documented, tested reason to change them. If a business workflow needs an unusual format, isolate the requirement, validate samples, and review how that format is served by the web server.

6. Align upload-size limits across every layer

The effective maximum is the smallest limit imposed by PHP, MediaWiki, and the web server. Raising only one value does not raise the limit users experience.

Layer Setting or default What it limits Qualification
MediaWiki $wgMaxUploadSize: 100 MiB MediaWiki’s configured maximum upload size Current MediaWiki core configuration-schema default; a local configuration or release-specific change may differ.
PHP upload_max_filesize: 2 MB Maximum size of an individual uploaded file Default documented by the MediaWiki upload manual; your PHP package or administrator may set another value.
PHP post_max_size: 8 MB Maximum size of the complete POST request, including fields and uploaded data Default documented by the MediaWiki upload manual; it must be large enough for the file plus request overhead.
Web server Request-body limit Whether the request reaches PHP at all nginx, Apache, IIS, a reverse proxy, or a hosting control panel may impose an additional limit; the applicable value is installation-specific.

Raise PHP values coherently

For a target file size above the documented 2 MB PHP default, raise both directives in the PHP configuration used by the web request. Set post_max_size higher than upload_max_filesize so the multipart request has room for form fields and overhead. Then reload the PHP service and verify the running values.

Rank #4
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray | Data transfer & Fast charging for MacBook, iPhone 17/16/15, iPad, Samsung Galaxy, Apple Watch
  • Dual Converters, Infinite Potential:Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
  • Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
  • Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
  • Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
  • Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft

Check MediaWiki and the front-end server

Set $wgMaxUploadSize no higher than the limit your PHP and front-end server can actually accept. If a reverse proxy or web server rejects the request first, MediaWiki cannot produce a useful upload error because it never receives the file. Compare all values when users report that small files work but larger ones fail.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use the smallest-limit rule when diagnosing

For example, a wiki with MediaWiki’s 100 MiB default still cannot accept a 20 MiB file if PHP allows only 2 MB. Conversely, raising PHP to 100 MiB does not help when the web server accepts only a smaller request. Record the value and scope of each limit so a later package update or hosting change does not silently reduce it.

7. Upload through Special:Upload

Normal single-file workflow

  1. Sign in with an account that has the upload right.
  2. Open Special:Upload.
  3. Choose the local file and enter the description and destination information requested by the form.
  4. Submit the form and read any extension, MIME, size, or permission message before retrying.
  5. Open the resulting file page and test the file from a normal reader account, not only from an administrator session.

Images, resizing, and thumbnails

Storing an image and generating a thumbnail are different operations. On-the-fly resizing and thumbnail creation require a working ImageMagick installation when that conversion path is configured. Install and configure ImageMagick, ensure the web-server process can execute the configured conversion command, and test a representative image. A successful upload with a broken thumbnail points to the conversion path rather than the upload directory.

8. Security controls that should remain in place

  • Block script execution: uploaded content must not be able to execute server-side scripts or otherwise access the web directory as code.
  • Keep MIME verification: extension names alone are not a trustworthy description of file content.
  • Keep prohibited extensions and strict checks: weakening them on a public wiki can turn the upload feature into a code-execution risk.
  • Protect the directory: preserve the supplied .htaccess protections or implement equivalent rules on another web server.
  • Limit rights: grant upload and, separately, reupload only to groups that need them.
  • Review exposure: restrict directory listings and monitor storage growth, especially when anonymous visitors can view uploaded files.

MediaWiki’s warning is practical: a user who can upload and execute a script may be able to exploit access to the web directory and damage the wiki or the wider site. Treat the upload directory as untrusted content even when all current users are trusted.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

9. Troubleshoot the specific failure

Special:Upload is missing or says uploads are disabled

  1. Confirm that $wgEnableUploads = true; is present in the active LocalSettings.php, with valid PHP syntax.
  2. Confirm that the request is reaching the wiki you edited; multiple installations or virtual hosts can use different configuration files.
  3. Check the user’s upload right and group membership.
  4. If the setting was just changed and the interface still looks unchanged, clear browser and applicable cache layers, then reload the page.

Permission denied or failed write

Verify the configured $wgUploadDirectory, the directory’s ownership and mode, and PHP’s temporary directory. The web-server account needs to write the temporary upload and the final destination. Check SELinux, AppArmor, ACLs, container mounts, and read-only filesystem flags when ordinary permissions appear correct.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

“File type not allowed”

Check the extension in $wgFileExtensions, the prohibited-extension list, MIME detection, and the user’s upload right. Do not add a broad wildcard or disable strict checks merely to accept one file. Test a known-good file of the intended format and inspect whether the failing file is mislabeled or malformed.

“File is corrupt” or “incorrect extension”

These messages usually indicate a mismatch between the filename and the detected content, or a MIME-detection problem. Confirm the file opens as the claimed format, verify the server’s MIME database and PHP behavior, and retry with an independently generated sample. Renaming the file does not repair invalid content.

Best Value
Sale
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display | 85W Max PD, 1 Powered USB-C 5Gbps & 2 Powered USB-A 3.0 5Gbps Data Ports, for MacBook Pro, MacBook Air, Dell and More (Black)
  • 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
  • Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
  • Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
  • HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
  • What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.

“File is too large”

Compare, in order, PHP’s upload_max_filesize, PHP’s post_max_size, MediaWiki’s $wgMaxUploadSize, and every nginx, Apache, IIS, proxy, or hosting request-size limit. The first smaller value wins. Remember that post_max_size covers the entire request, not just the file.

Upload succeeds but thumbnails fail

Check ImageMagick installation, the configured conversion command, executable permissions, and the web-server account’s ability to run it and write generated thumbnails. Review the web server and MediaWiki logs for the exact command or permission error.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

10. Decide between local uploads and a shared repository

Not every wiki needs to store every file locally. When comparing local uploads with InstantCommons, evaluate the following:

Decision axis Local uploads InstantCommons
Who controls the files Your wiki’s administrators and contributors control the local files and permissions. Files are provided from Wikimedia Commons under its policies and licensing framework.
Storage Your server stores the uploaded files and generated derivatives. Freely licensed Commons files can be used without storing each file locally.
Policy and licensing You must define acceptable formats, copyright handling, retention, and moderation. You must follow Commons availability and licensing conditions and account for the fact that availability can change.
Security responsibility You are responsible for directory protection, permissions, limits, and backups. You reduce local storage responsibility but still need to configure and govern how remote files are used.
Workflow Suitable when contributors need to add files unique to your wiki. Suitable when the needed media already exists as freely licensed material in the shared repository.

Choose local storage for files that belong to your project or must remain under its retention policy. Choose a shared repository when reuse of eligible Commons media is the goal and local copies are unnecessary.

11. Batch-upload options

For many files, the standard single-file form may be too slow. The official MediaWiki upload documentation lists UploadWizard, MsUpload, and SimpleBatchUpload as extension options. Each has its own MediaWiki version requirements and configuration behavior, so verify compatibility against the version installed on your wiki before enabling one.

Batch tools do not remove the underlying safeguards. They still need a writable, non-executable upload directory, valid PHP and web-server size limits, extension and MIME checks, and appropriate user rights. Pilot a small set of files first and confirm that descriptions, licensing information, thumbnails, and failure reporting meet your editorial workflow.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

12. Production checklist

  • file_uploads = On is active in the PHP configuration serving the wiki.
  • open_basedir, if enabled, includes both the MediaWiki upload directory and PHP’s temporary directory.
  • The configured images (or alternate) directory is writable by the web-server process and uses non-executable file handling.
  • Supplied .htaccess rules or equivalent nginx/IIS protections are present.
  • $wgEnableUploads = true; is in the active LocalSettings.php.
  • The intended groups have upload; reupload is granted separately where needed.
  • Required extensions are explicitly listed, while prohibited extensions and MIME verification remain enabled.
  • PHP, MediaWiki, proxy, and web-server limits have been compared, with the smallest limit understood.
  • A normal upload, an oversized upload, a rejected extension, and an image thumbnail have each been tested with appropriate accounts.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.