Increasing the Maximum File Upload Size in PHP

A file upload rejected as "too large" in a PHP application is often blocked by php.ini configuration, not application code — and there are three separate directives involved, all of which need to be raised together, since the request is capped by whichever one is lowest.

1. The three relevant directives

upload_max_filesize = 20M   ; max size of a single uploaded file
post_max_size = 25M         ; max size of the entire POST request (must be >= upload_max_filesize)
memory_limit = 128M         ; PHP's overall memory ceiling per request (must be >= post_max_size)

post_max_size covers the whole request body, not just the file — if a form uploads a 20MB file alongside other fields, post_max_size needs to be somewhat larger than upload_max_filesize to leave room for the rest of the payload. If post_max_size is smaller than the actual request, PHP doesn't just reject the file — $_POST and $_FILES both end up empty, with no clear error, which is a confusing failure mode if you don't know to check this setting specifically.

2. Finding the active php.ini

php --ini

This shows which php.ini file is actually loaded — a server can have multiple PHP installations or SAPI-specific config files (CLI vs. FPM vs. Apache module), and editing the wrong one produces no visible change at all.

3. Editing php.ini directly

sudo nano /etc/php/8.3/fpm/php.ini
; find and update:
upload_max_filesize = 20M
post_max_size = 25M
memory_limit = 128M

sudo systemctl restart php8.3-fpm
sudo systemctl restart nginx   # or apache2

PHP-FPM (and the web server in front of it) needs an explicit restart to pick up php.ini changes — editing the file alone doesn't take effect on already-running processes.

4. Overriding per-project without touching the global php.ini

Shared hosting environments often don't allow editing the global php.ini — an .htaccess override (on Apache with mod_php) or a project-level .user.ini file (works with PHP-FPM) can raise these limits for one specific project without root access:

# .user.ini, placed in the project's public directory
upload_max_filesize = 20M
post_max_size = 25M

5. The web server has its own limit too

Nginx specifically enforces its own request body size cap, independent of PHP's settings entirely:

# nginx.conf or a site config block
client_max_body_size 25M;

Without this, Nginx rejects an oversized request with a 413 error before it ever reaches PHP — raising php.ini's limits alone doesn't fix the upload if Nginx is sitting in front of PHP-FPM with a lower cap of its own.

6. Set the limit to what the app actually needs, not the maximum possible

A very high upload limit on a public-facing form is also a resource-exhaustion risk — a much larger allowed size than the app genuinely needs gives more room for abuse (many large concurrent uploads) without much practical benefit. Match the limit to the largest legitimate file the feature is meant to accept.