Where PHP Settings Are Stored

PHP parameters can be set in several places. Priority (highest to lowest): ini_set() in code → .user.ini → .htaccess → php.ini. Changes to php.ini require a PHP-FPM restart.

Key PHP Parameters

Parameter	Default	Recommended	Description
`memory_limit`	128M	256–512M	Memory limit per PHP process
`upload_max_filesize`	2M	64–256M	Maximum uploaded file size
`post_max_size`	8M	Greater than upload_max_filesize	Maximum POST request size
`max_execution_time`	30	60–300	Maximum script execution time (sec)
`max_input_time`	60	120–300	Time allowed to receive input data
`max_input_vars`	1000	3000–5000	Maximum number of variables in POST/GET/COOKIE

Changing It via php.ini

# Find the active php.ini
php --ini

# Edit it (for PHP-FPM)
sudo nano /etc/php/8.2/fpm/php.ini

memory_limit = 512M
upload_max_filesize = 128M
post_max_size = 130M
max_execution_time = 300
max_input_time = 300
max_input_vars = 5000

post_max_size must be greater than upload_max_filesize, otherwise large files will not upload. Rule of thumb: post_max_size = upload_max_filesize + 2–10 MB.

Changing It via .user.ini (for shared hosting)

Create a .user.ini file in the site root:

memory_limit = 256M
upload_max_filesize = 64M
post_max_size = 68M
max_execution_time = 120

Changing It via .htaccess (for Apache)

php_value memory_limit 256M
php_value upload_max_filesize 64M
php_value post_max_size 68M
php_value max_execution_time 120

Changing It in PHP Code (temporarily)

<?php
ini_set('memory_limit', '512M');
ini_set('max_execution_time', '300');
set_time_limit(300);

Applying php.ini Changes

sudo systemctl reload php8.2-fpm

# Check the values that took effect
php -r "echo ini_get('memory_limit');"

For WordPress, add to wp-config.php: define('WP_MEMORY_LIMIT', '256M'); — this sets the memory limit for WordPress, but it cannot exceed the system-wide memory_limit in php.ini.

Real Errors and What They Mean

Allowed memory size exhausted

PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 20480 bytes) in /var/www/html/index.php on line 42

134217728 bytes is 128 MB — the default memory_limit. The script asked for one more block of memory (20480 bytes in this example) and hit the ceiling. Typical causes: loading a huge file into a single variable, processing an array with thousands of rows without generators, a memory leak inside a loop. Raising memory_limit treats the symptom, but if consumption keeps growing with every run, look for the leak instead of raising the limit forever.

Maximum execution time exceeded

Fatal error: Maximum execution time of 30 seconds exceeded in /var/www/html/import.php on line 15

The script ran longer than max_execution_time allows. This is PHP's own processing time, not time spent waiting on the client. For long-running imports, it is better not to raise the limit site-wide, but to move the task into a queue — for example through a dedicated PHP-FPM pool with its own timeouts — where max_execution_time can safely be set to 0.

POST Content-Length exceeds the limit

PHP Warning:  POST Content-Length of 15728640 bytes exceeds the limit of 8388608 bytes in Unknown on line 0

The in Unknown on line 0 part is not a bug, it is a quirk: PHP rejects the request body before handing control to your code, so there is no file or line number to report. With this error the entire $_POST array comes back empty, not just the file — which often confuses debugging of plain text forms.

When Editing php.ini Does Not Help

The site runs behind Nginx — the request body is capped at the web server level by client_max_body_size before it ever reaches PHP-FPM. Check that directive too.
The host runs PHP as CGI under suPHP/suexec — there, .htaccess with php_value is usually ignored, and only .user.ini works.
.user.ini is not picked up instantly: the re-read interval is set by user_ini.cache_ttl (300 seconds by default). Right after an edit, the old value may still be in effect.
The directive is flagged as PHP_INI_SYSTEM (for example, disable_functions) — such parameters cannot be changed through .htaccess, .user.ini, or ini_set(), only through php.ini plus an FPM restart.

Verifying the Result

Create a temporary info.php file with phpinfo() and open it in a browser — every directive there has two columns:

Column	What it means
Local Value	The value for the current script — what actually takes effect
Master Value	The value from php.ini — the baseline, before overrides in .htaccess, .user.ini, or code

If the Local Value does not match what you expect, the edit never landed: check whether you edited the right php.ini (php --ini on the console and phpinfo() in the browser can point to different files for CLI and FPM), and whether you forgot to reload FPM.

# Quick check without a browser
php -i | grep -E "memory_limit|upload_max_filesize|post_max_size"

# Check the web-facing value via curl against the test info.php
curl -s https://example.com/info.php | grep -A1 "upload_max_filesize"

Delete info.php right after checking it — phpinfo() exposes software versions, paths, and environment variables, making reconnaissance easier for an attacker.