Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

To increase PHP’s upload limit, raise upload_max_filesize for the largest single file, set post_max_size higher than that value for the complete request, and allow enough max_input_time for the transfer. Large or multi-file uploads can also require a higher memory_limit and max_file_uploads. Apply the changes to the PHP configuration used by your website—not just the command-line PHP installation—then reload the relevant service and verify the effective values. If the upload still fails, the web server or reverse proxy may be rejecting the request before PHP sees it.

This guide shows which limits matter, where to change them on common hosting stacks, how WordPress calculates its displayed limit, and how to diagnose failures such as empty $_FILES, HTTP 413 responses, and timeouts.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What settings determine PHP’s maximum upload size?

No single directive controls every upload. PHP evaluates the file size, the total HTTP request, the time available to receive it, the memory available while processing it, and (for batches) the number of files.

Directive What it limits Current PHP manual default How to set it
upload_max_filesize One uploaded file 2M Set it to the largest individual file you will accept.
post_max_size The complete POST body, including the file, multipart overhead, and other form fields 8M Make it larger than upload_max_filesize; leave headroom.
max_input_time How long PHP parses incoming data, including file-transfer time Not stated in the supplied PHP guidance Increase it for slow connections. -1 uses max_execution_time; 0 means unlimited input time.
memory_limit Memory available to PHP while handling the request Varies by installation Increase only when processing the upload needs more memory.
max_file_uploads Number of files accepted in one request 20 Raise it for galleries, archives, or other multi-file forms.

The effective maximum is constrained by the smallest applicable limit. For one file, upload_max_filesize must fit inside post_max_size; for the request to arrive at PHP at all, the front-end web server must also allow a body at least that large.

Popular on Amazon
Lexar D40E 128GB Dual USB 3.2 Gen 1 Type-C Jump Drive, Champagne Silver | USB-C Flash, Metal Housing, Swivel Design, Thumb Drive
  • USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
  • Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
  • Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
  • Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
  • Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty

What values should I use for a larger upload?

Choose values from the actual files and forms your application accepts, rather than copying a very large number. A practical starting point for files up to about 64 MB is:

upload_max_filesize = 64M
post_max_size = 80M
max_input_time = 300

These are configuration choices, not PHP defaults. The 16 MB difference gives the multipart request room for form fields and encoding overhead. If a form sends several files, size the request for their combined total, not merely the largest file. For example, a form that accepts five 20 MB files needs a request limit above 100 MB plus overhead, and its max_file_uploads value must be at least five.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

PHP’s shorthand uses suffixes such as K, M, and G. Keep the units consistent when comparing values. Setting post_max_size equal to, or below, upload_max_filesize creates a confusing failure: an individual file appears to be allowed, but the enclosing POST request is rejected first.

How do I change the PHP configuration used by my website?

The correct file depends on the PHP SAPI, hosting permissions, and whether the site runs through Apache, Nginx with PHP-FPM, or another stack. A command-line change does not automatically affect web requests.

Option 1: Edit the active php.ini

  1. Identify the PHP configuration loaded by the web SAPI. A temporary page that calls phpinfo() shows the “Loaded Configuration File” and the effective values. Remove that diagnostic page immediately after checking it because it exposes server details.
  2. Open that php.ini with the hosting control panel’s PHP editor or your server administrator’s approved method.
  3. Add or edit the directives, for example:
    upload_max_filesize = 64M
    post_max_size = 80M
    max_input_time = 300
    memory_limit = 256M
    max_file_uploads = 50
  4. Save the file and reload the PHP handler or web service. PHP-FPM normally needs a PHP-FPM reload or restart; Apache with an embedded PHP module needs an Apache reload or restart; IIS requires the corresponding application-pool or web-service action.
  5. Verify the values from a web request, not only with a shell command.

On managed or shared hosting, the global file may be read-only. Ask the host which PHP version and SAPI serve the domain and whether site-level overrides are permitted.

Option 2: Use a permitted .user.ini file

Some CGI and PHP-FPM configurations allow per-directory settings in a file named .user.ini. Place it in the site directory covered by the request and add the same directives. Changes can be cached for the interval controlled by PHP’s user_ini.cache_ttl, so a value may not appear immediately. This method is site-specific and does not change other virtual hosts.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Also popular on Amazon
Sale
SANDISK 128GB Ultra Flair, USB-A Flash Drive, Up to 150MB/s Read Speeds | USB Flash Drive, Up to 15x Faster than standard 2.0, Password Protection, Durable, Sleek Metal Casing, USB 3.0, Silver/Black
  • High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
  • Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
  • Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
  • Sleek, durable metal casing
  • Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]

Option 3: Use .htaccess with Apache’s PHP module

When Apache runs PHP through mod_php, the host may permit directives in .htaccess, such as:

php_value upload_max_filesize 64M
php_value post_max_size 80M
php_value max_input_time 300

This syntax is not valid for every PHP SAPI. On PHP-FPM, it can produce an “Internal Server Error” instead of changing the limit. If that happens, remove the lines and use the PHP-FPM pool, a permitted .user.ini, or the hosting panel.

Do I need to restart PHP or the web server?

Usually, yes. A global php.ini change is read when the PHP process starts, so reload or restart the PHP handler and, where required, the web server. Per-directory files may be reread without a service restart, although caching can delay the change. Use the reload mechanism supplied by your host; on a server you administer, the service name depends on the installed PHP version (for example, a PHP-FPM service for that version).

Do not assume a successful restart proves the setting is active. Check from the same virtual host and URL path that handles uploads. A CLI command such as php --ini or php -i can show a different configuration from the web SAPI.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How can I verify the effective upload limits?

Verification should confirm both the values and the configuration source.

  1. Use a temporary, access-controlled PHP information page or your application’s diagnostics to read upload_max_filesize, post_max_size, max_input_time, memory_limit, and max_file_uploads.
  2. Check the reported “Loaded Configuration File” and any additional parsed files. Confirm they belong to the website’s PHP version and virtual host.
  3. Upload a file comfortably below the new limit first, then test a file near the intended boundary. Keep test files non-sensitive.
  4. Delete the diagnostic page and clear any application or configuration cache that stores the old value.

If an application displays a lower number than PHP, treat that as a second application-level limit rather than proof that PHP ignored the change.

Also popular on Amazon
2 Pack 64GB USB Flash Drive USB 2.0 Thumb Drives Jump Drive Fold Storage Memory Stick Swivel Design - Black
  • What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
  • Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
  • Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
  • Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
  • Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers

Can the web server block the upload before PHP receives it?

Yes. A front-end server can reject the request body before PHP parses it. Set its request-size limit at least as high as the desired post_max_size, then reload that server.

Front end Relevant request-size setting Typical symptom
Apache LimitRequestBody The request is refused before PHP handles the form.
Nginx client_max_body_size Often an HTTP 413 “Request Entity Too Large” response.
Lighttpd server.max-request-size The server rejects an oversized body at the connection layer.
Proxy or load balancer Its own body-size and timeout policy A gateway error even though the origin server’s PHP values are high enough.

For Nginx, a server or location block might contain a value such as client_max_body_size 80M;. The exact configuration scope matters: a more specific location block can override a broader server setting. After editing, validate the configuration and reload Nginx. Apache administrators should check for a LimitRequestBody directive at the virtual-host, directory, or location scope.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

There can be several hops between a browser and PHP. If the response is an HTTP 413, inspect the first proxy or web server that generated it; PHP logs may contain no entry because PHP never received the request.

How do I raise the maximum upload size in WordPress?

WordPress relies on PHP for dashboard media uploads, but it reports the smaller of upload_max_filesize and post_max_size. Its wp_max_upload_size() function converts both values to bytes and returns the smaller value, subject to the upload_size_limit filter.

  1. Raise upload_max_filesize to the largest file you want WordPress to accept.
  2. Raise post_max_size above it, with room for the complete multipart request.
  3. Reload the PHP handler if the change was made in a global configuration file.
  4. Open the WordPress media-upload screen and confirm that its “Maximum upload file size” text reflects the new effective value.
  5. If WordPress still shows the old limit, inspect the web SAPI configuration and any plugin or theme using the upload_size_limit filter.

Changing only upload_max_filesize cannot raise WordPress’s displayed limit when post_max_size remains lower. Conversely, raising only post_max_size leaves the per-file ceiling unchanged.

Why are $_POST and $_FILES empty?

PHP documents empty $_POST and $_FILES as a possible result when the request exceeds post_max_size. In that case, the application may show a generic “no file selected” message instead of a clear size error.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Also popular on Amazon
SIMMAX 32GB Memory Stick USB 2.0 Flash Drives Swivel Thumb Drive Pen Drive (32GB Purple)
  • GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
  • BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
  • EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
  • TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
  • WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
  • Compare the file size plus form overhead with post_max_size, not just with upload_max_filesize.
  • Confirm that the request is reaching the intended virtual host and PHP version.
  • Check PHP and web-server error logs for a discarded request.
  • Retry with a small file to separate a size problem from an HTML form or permissions problem.

What does an HTTP 413 error mean?

An HTTP 413 generally means a web server, proxy, or load balancer rejected the request body as too large. PHP settings cannot override a rejection that occurs earlier in the request path.

  1. Identify which server returned the response from its headers and access logs.
  2. Raise that server’s body-size directive—such as Nginx’s client_max_body_size or Apache’s LimitRequestBody—to at least the intended request size.
  3. Check any upstream CDN, ingress controller, or hosting gateway for a separate cap.
  4. Reload the component and repeat a controlled upload.

How do I fix a timeout during a slow upload?

max_input_time includes the time PHP spends receiving and parsing an upload. A fast connection may complete within the default, while a slower connection can exceed it even when the file-size limits are correct.

Raise max_input_time to a number of seconds appropriate for the slowest users you support, such as 300. The special value -1 makes PHP use max_execution_time, while 0 permits unlimited input time. Also inspect web-server, reverse-proxy, and load-balancer request timeouts; the shortest timeout still wins.

What if the upload fails with a memory or file-count error?

Memory exhaustion

Large uploads can trigger memory or post-processing failures even after the transfer succeeds. Check memory_limit, application image-processing settings, and logs. Increase memory deliberately and account for other work performed in the same request; a higher upload limit does not require making every PHP request consume that much memory.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Too many files

The PHP manual lists max_file_uploads with a default of 20. A form that sends more files than this can lose files or fail despite each file being small. Raise the directive to the maximum batch size your application needs and verify that the application itself accepts that many fields.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Which configuration approach is right for my hosting?

Situation Best starting point Scope and trade-off
Shared hosting with a PHP settings panel Use the panel or a permitted .user.ini. Site-level and low risk, but the host may cap values or delay changes.
Apache with mod_php and server access Edit the active php.ini or permitted .htaccess. Global settings affect more sites; .htaccess is narrower but SAPI-specific.
Nginx with PHP-FPM Edit the PHP-FPM configuration or pool, plus Nginx’s request-size setting. Requires access to both layers and separate reloads.
Managed WordPress hosting Use the host’s PHP-version or upload-limit controls, then verify in WordPress. The provider may prohibit direct file edits and impose a hard platform maximum.
IIS or another managed front end Ask the administrator to change the web-SAPI PHP configuration and request-body limit. Restart and permissions are controlled by the hosting stack.

What are the security and performance trade-offs?

A larger limit increases the amount of data a request can send and the time a worker may spend receiving it. Set the smallest limit that meets the business requirement, restrict upload permissions to authenticated users where possible, validate MIME type and file contents in the application, store uploads outside executable web paths, and enforce quotas. Do not rely on a PHP size setting as a security control: web-server limits, application validation, authentication, and malware scanning address different risks.

Also popular on Amazon
IMEASON Swivel Design 16GB USB Flash Drive with Keychain, USB 2.0 Portable Thumb Drive Memory Stick, FAT32 Format Flashdrive for Data Storage, Photos, Music, Files (Black, 16 GB)
  • 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
  • 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
  • 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
  • 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
  • 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.

Long input timeouts can tie up workers during very slow connections. If users regularly send large media, consider resumable or direct-to-storage uploads so the web application does not hold a PHP request open for the entire transfer. That is an architectural change, not a substitute for correcting the limits on an existing form.

Final verification checklist

  • upload_max_filesize covers one file.
  • post_max_size is higher than it and covers the complete request.
  • max_input_time accommodates the slowest expected transfer.
  • memory_limit supports the application’s post-upload processing.
  • max_file_uploads covers the largest batch.
  • The Apache, Nginx, Lighttpd, proxy, or gateway body-size limit is not lower.
  • The values were changed in the web SAPI configuration, not only in CLI PHP.
  • The relevant PHP and web services were reloaded where required.
  • The effective values were verified from the actual site, and WordPress displays the intended maximum if applicable.

Frequently Asked Questions

Can I increase PHP’s upload limit from a PHP script?

Only directives permitted for runtime changes can be set with ini_set(), and the key upload-size directives are commonly system- or per-directory settings. If a runtime call has no effect, change the active configuration file or hosting-panel setting instead.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why does a 64 MB setting reject a file that is exactly 64 MB?

The file’s reported size can reach or slightly exceed the nominal boundary, and the complete multipart request is larger than the file itself. Set upload_max_filesize above the largest expected byte size and keep additional room in post_max_size.

Does changing the PHP limit change an existing upload already in progress?

No. PHP reads the applicable limits when handling the request, and a service reload affects new worker processes. An upload that already received a rejection must be started again after the configuration is active.

Why is the limit different for two websites on the same server?

Each virtual host can use a different PHP version, FPM pool, .user.ini, or application filter. Verify the loaded configuration from each site’s web request rather than assuming the command-line or another domain’s values apply.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.