How to Change Maximum Upload File Size in PHP

By the end of this page, you will understand which PHP settings control file upload limits, why changing your form alone is not enough, and what your options are when you do not have access to server configuration files such as php.ini or .htaccess. You will also learn how to detect upload errors in PHP and build safer upload handling code.

PHP file uploads are controlled by server configuration, not just by your HTML form or PHP script.

When a user uploads a file, several limits may block it before your script can process it:

• upload_max_filesize — the maximum size allowed for a single uploaded file
• post_max_size — the maximum total size of the entire POST request
• max_file_uploads — how many files may be uploaded at once
• memory_limit — sometimes relevant if your script reads large files into memory
• web server limits — Apache, Nginx, or hosting panel settings may also impose limits

For a 30 MB upload to work, both of these must be large enough:

• upload_max_filesize must be at least 30M
• post_max_size must be larger than 30M, because the request includes file data plus form fields and request overhead

A common setup would be:

upload_max_filesize = 30M
post_max_size = 32M

or slightly higher.

Why this matters in real programming:

• File uploads are common in apps that accept images, audio, PDFs, and backups.
• Upload failures are often caused by infrastructure settings, not code bugs.
• If you do not know where the limit is enforced, you can waste time changing the wrong file.

In your situation, the key idea is this:

• If you cannot change server-level PHP settings, you usually cannot raise the upload limit yourself from application code alone.
• Your options are usually:
  • ask the hosting provider or server administrator to change the PHP settings
  • use a hosting control panel if one exists
  • move the upload target to a system you control
  • use direct-to-cloud uploads if architecture allows it

Some settings can sometimes be changed with ini_set(), but upload limits like upload_max_filesize and post_max_size are usually read before your script handles the request, so changing them inside the upload script is typically too late.

Think of a file upload like bringing a package into a building.

• Your HTML form is the delivery label.
• Your PHP script is the employee inside the office.
• PHP configuration and web server settings are the security desk at the entrance.

If security says, "No packages over 8 MB," the employee inside never even gets the package. That means your PHP code cannot fix the problem after the upload has already been rejected.

So if the package is blocked at the entrance, you must change the building rules—or ask the person who controls them to do it.

The HTML form can suggest a limit, but it does not override PHP server limits.

<form action="upload.php" method="post" enctype="multipart/form-data">
  <input type="hidden" name="MAX_FILE_SIZE" value="31457280">
  <input type="file" name="audio">
  <button type="submit">Upload</button>
</form>

MAX_FILE_SIZE is optional and only acts as a client-side hint. It does not bypass PHP configuration.

A basic PHP upload handler looks like this:

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!isset($_FILES['audio'])) {
        exit('No file was uploaded.');
    }

    if ($_FILES['audio']['error'] !== UPLOAD_ERR_OK) {
        exit('Upload failed with error code: ' . $_FILES['audio']['error']);
    }

    $maxSize = 30 * 1024 * 1024; // 30 MB

    if ($_FILES['audio']['size'] > $maxSize) {
        exit('File is larger than 30 MB.');
    }

    $destination = __DIR__ . '/uploads/' . basename($_FILES['audio']['name']);

    if (move_uploaded_file($_FILES['audio']['tmp_name'], $destination)) {
        echo 'Upload successful.';
    } else {
        echo 'Could not save uploaded file.';
    }
}

This script does two different kinds of checking:

• Server-level checking happens before the script gets the file.
• Application-level checking happens inside your PHP code.

Your code can reject files that are too large, but it cannot accept files larger than the server already allows.

You can inspect current PHP settings with:

<?php
phpinfo();

Or more safely for just the values you need:

<?php
echo 'upload_max_filesize: ' . ini_get('upload_max_filesize') . PHP_EOL;
echo 'post_max_size: ' . ini_get('post_max_size') . PHP_EOL;

This helps confirm whether the environment is blocking your upload.

Consider this PHP code:

<?php
echo 'upload_max_filesize: ' . ini_get('upload_max_filesize') . "\n";
echo 'post_max_size: ' . ini_get('post_max_size') . "\n";

if (!isset($_FILES['audio'])) {
    exit('No file received.');
}

if ($_FILES['audio']['error'] === UPLOAD_ERR_INI_SIZE) {
    exit('The uploaded file exceeds the server upload limit.');
}

echo 'File arrived at the script.';

Now trace what happens:

1. The browser sends the form and file to the server.
2. Before your main PHP upload logic runs, PHP checks request limits.
3. If the file is larger than upload_max_filesize or the full request exceeds post_max_size, PHP marks the upload as failed.
4. Your script starts running.
5. ini_get() prints the configured limits.
6. $_FILES['audio'] may exist, but its error value can indicate a size failure.
7. If the error is UPLOAD_ERR_INI_SIZE, the script prints: The uploaded file exceeds the server upload limit.
8. The file is never fully available for saving because PHP rejected it earlier.

Important lesson: the script can detect the failure, but it usually cannot remove the server’s upload cap during that same request.

File upload limits matter in many real applications:

• Music platforms: uploading MP3, WAV, or demo tracks
• Image galleries: large photos from phones or cameras
• Document systems: PDFs, resumes, invoices, contracts
• Admin dashboards: importing CSV exports or backup files
• APIs: receiving media from mobile apps

Typical practical needs:

• Limit avatars to 2 MB
• Allow product images up to 10 MB
• Allow audio uploads up to 30 MB
• Allow video uploads up to 100 MB or more

In all these cases, developers must align:

• frontend expectations
• PHP settings
• web server settings
• disk space and storage strategy
• validation and security rules

A common mistake is setting a 30 MB limit in the form or script, while the server still allows only 2 MB.

In real projects, developers usually treat upload size handling as part of a broader upload pipeline.

Common patterns include:

Validation before storage

Check:

• upload error codes
• MIME type
• extension
• file size
• destination path

<?php
if ($_FILES['audio']['error'] !== UPLOAD_ERR_OK) {
    throw new RuntimeException('Upload failed.');
}

$allowedTypes = ['audio/mpeg'];
if (!in_array($_FILES['audio']['type'], $allowedTypes, true)) {
    throw new RuntimeException('Invalid file type.');
}

Guard clauses

Developers often return early when upload conditions fail.

<?php
if (!isset($_FILES['audio'])) {
    exit('Missing file.');
}

if ($_FILES['audio']['error'] !== UPLOAD_ERR_OK) {
    exit('Upload error.');
}

This keeps code simple and readable.

Centralized configuration

Apps often define app-level limits in one place:

<?php
const MAX_AUDIO_SIZE = 30 * 1024 * 1024;

That value should still stay below or equal to the server’s real limit.

Error handling for hosting restrictions

In shared hosting or managed servers, developers often add diagnostic logging:

<?php
error_log('upload_max_filesize=' . ini_get('upload_max_filesize'));
error_log('post_max_size=' . ini_get('post_max_size'));

This helps confirm whether the problem is app code or infrastructure.

Alternative architecture

If app servers have strict limits, teams may upload directly to cloud storage such as S3 using pre-signed URLs. That avoids pushing large files through the PHP app server at all.

Here are common beginner mistakes when dealing with PHP upload limits.

1. Assuming the HTML form controls the real limit

Broken assumption:

<input type="hidden" name="MAX_FILE_SIZE" value="31457280">

Why it fails:

• This does not override upload_max_filesize.
• Users can change or remove it.
• The server still decides what is allowed.

How to avoid it:

• Treat form limits as helpful hints only.
• Always validate on the server.

2. Setting only upload_max_filesize

Broken configuration:

upload_max_filesize = 30M
post_max_size = 8M

Why it fails:

• The entire request must fit inside post_max_size.
• If post_max_size is smaller, the upload still fails.

How to avoid it:

• Make post_max_size larger than the largest expected upload.

3. Trying to change the limit too late with ini_set()

Often ineffective:

<?php
ini_set('upload_max_filesize', '30M');
ini_set('post_max_size', '32M');

Why it fails:

• The upload has already been processed before your script runs.
• Many hosts do not allow changing these directives at runtime.

How to avoid it:

• Change the server configuration before the request is handled.
• If you cannot, ask the host or admin.

4. Ignoring upload error codes

Broken code:

<?php
move_uploaded_file($_FILES['audio']['tmp_name'], 'uploads/file.mp3');

Why it fails:

• If the upload already failed, tmp_name may be invalid or empty.

How to avoid it:

<?php
if ($_FILES['audio']['error'] !== UPLOAD_ERR_OK) {
    exit('Upload failed.');
}

5. Trusting the file extension only

Broken code:

<?php
if (str_ends_with($_FILES['audio']['name'], '.mp3')) {
    // accept
}

Why it fails:

• File names can be misleading.
• A dangerous file can be renamed.

How to avoid it:

• Check MIME type and store files safely.

6. Not realizing the web server may also have limits

Even if PHP is configured correctly, Apache or Nginx may still reject large requests.

How to avoid it:

• Verify all layers: PHP, web server, hosting panel, proxy, CDN, and application code.

Another useful comparison:

If you cannot edit php.ini, .htaccess, or a hosting panel, then the practical answer is usually: you need the server administrator to change the limit.

// Check current settings
echo ini_get('upload_max_filesize');
echo ini_get('post_max_size');

// Check for upload errors
if ($_FILES['file']['error'] !== UPLOAD_ERR_OK) {
    // handle error
}

Common PHP upload-related settings:

• upload_max_filesize = max size of one file
• post_max_size = max size of total POST request
• max_file_uploads = max number of uploaded files
• memory_limit = script memory limit

Important rules:

• post_max_size should be larger than upload_max_filesize
• HTML MAX_FILE_SIZE does not override server settings
• ini_set() usually cannot solve upload size limits for the current upload request
• If server config is locked down, ask the host or administrator

Useful upload error constants:

• UPLOAD_ERR_OK = no error
• UPLOAD_ERR_INI_SIZE = exceeded upload_max_filesize
• UPLOAD_ERR_FORM_SIZE = exceeded form MAX_FILE_SIZE
• UPLOAD_ERR_PARTIAL = partially uploaded
• UPLOAD_ERR_NO_FILE = no file sent

Minimal safe upload flow:

1. Check $_FILES exists
2. Check error
3. Check size
4. Check type
5. Move with move_uploaded_file()
6. Store outside public risk where possible

Can I increase PHP upload size from inside my PHP script?

Usually no. Upload limits such as upload_max_filesize and post_max_size are applied before your script can fully process the request.

Why is my upload still failing after changing upload_max_filesize?

Because post_max_size may still be too small, or the web server itself may have a lower limit.

Does MAX_FILE_SIZE in the HTML form enforce the real limit?

No. It is only a browser-side hint and can be bypassed. The server configuration is the real limit.

How do I know which limit is blocking my upload?

Check ini_get('upload_max_filesize'), ini_get('post_max_size'), and inspect $_FILES['your_field']['error'] for values like UPLOAD_ERR_INI_SIZE.

What should I do if I cannot access php.ini or .htaccess?

Ask your hosting provider or server administrator to raise the upload limits, or use a hosting control panel if one is available.

Do I need to set both upload_max_filesize and post_max_size for a 30 MB file?

Yes. upload_max_filesize must allow the file, and post_max_size must be slightly larger than the full request.

Can Apache or Nginx also block large uploads?

Yes. Even if PHP allows the upload, the web server or reverse proxy may enforce its own request size limit.

• PHP file uploads — the broader feature this question belongs to
• php.ini configuration — where PHP runtime limits are commonly set
• .htaccess — sometimes used on Apache to override configuration
• ini_set() — runtime configuration changes and their limitations
• $_FILES array — how uploaded files are represented in PHP
• move_uploaded_file() — the safe function for saving uploaded files
• PHP error handling — useful for diagnosing upload failures
• Server configuration — web server and hosting settings that affect PHP apps
• Form enctype — required for file uploads to work correctly
• Input validation — important for checking size, type, and safety of uploaded files