PHP Settings Cheat Sheet: memory_limit, Upload Limits, max_input_vars and Where to Set Them

Half of all “WordPress is broken” tickets end with a PHP setting: memory too low, a time limit too short, an upload cap too small, or too few input variables for a big menu. This sheet gathers the PHP directives that matter for WordPress, what each one does, PHP’s own default, where each one can and cannot be changed, and how to set them in cPanel, Plesk, DirectAdmin, Enhance, .user.ini and .htaccess. For the WordPress constants that sit on top of these (such as WP_MEMORY_LIMIT), see the wp-config constants reference.

Read this first: defaults below are PHP’s built-in values and the values in the php.ini-production file that ships with PHP. Your host almost certainly changed some of them. Always check the live value (see “How to check” below) before and after a change. Panel labels change between versions; the hosting control panel cheat sheet maps where things live.

The directives that matter for WordPress

Directive	What it controls	PHP default	Common WordPress value	Symptom when too low
memory_limit	Most memory one request may use. -1 means no limit.	128M	256M (512M for heavy admin work)	Allowed memory size of ... bytes exhausted, critical error, white screen, builder will not load
max_execution_time	Seconds one request may run. On Linux this normally counts CPU time, not time spent waiting on the database or remote APIs.	30 (always 0, meaning unlimited, on the command line)	60 to 120 for web requests	Maximum execution time of 30 seconds exceeded, imports and backups stop part way
max_input_time	Seconds PHP may spend receiving and parsing request data, including uploads	-1 built in (use max_execution_time); 60 in php.ini-production	60 to 300 on sites that take big uploads	Large uploads fail on slow connections
upload_max_filesize	Largest single uploaded file	2M	64M to 256M	The uploaded file exceeds the upload_max_filesize directive in php.ini.
post_max_size	Largest whole request body (all fields and files). Must be at least upload_max_filesize.	8M	Equal to or a little above upload_max_filesize	Upload or form silently does nothing; PHP empties $_POST and $_FILES when the request is too big
max_file_uploads	Files allowed in one request	20	20 is usually fine	Bulk uploads drop files beyond the limit
max_input_vars	Form fields accepted per request, counted separately for GET, POST and cookies	1000	3000 to 5000 for big menus, builders, WooCommerce variations	Menu items vanish on save, builder or plugin settings do not save; PHP logs a warning
display_errors	Whether errors are printed into pages	On built in; Off in php.ini-production	Off on live sites	When On: warnings break layouts, AJAX and JSON responses, and reveal file paths
log_errors and error_log	Whether errors are written to a log, and which file	log_errors On in php.ini-production	On, with a path outside the web root where possible	No record of fatal errors to diagnose
error_reporting	Which error levels are reported	E_ALL & ~E_DEPRECATED in php.ini-production	Leave at the host default; WordPress changes it when WP_DEBUG is on	Logs full of deprecation notices, or missing real errors
output_buffering	Buffers output before sending headers	Off built in; 4096 in php.ini-production	Host default	Cannot modify header information - headers already sent appears more readily when off
date.timezone	PHP’s default time zone	UTC	Host default; WordPress uses its own time zone setting	Rarely matters to WordPress itself; can confuse custom code and logs
allow_url_fopen	Whether PHP file functions can open URLs	On	Host default	Some plugins fail to fetch remote files when Off
disable_functions	PHP functions switched off for security	Empty	Host decides	Plugins that need exec, proc_open and similar report errors

Sizes use PHP shorthand: K, M and G, with no space and no B (write 256M, not 256MB, which PHP does not read as you expect). In error messages PHP shows bytes: 134217728 is 128M, 268435456 is 256M and 536870912 is 512M.

Where each directive can be set

Every directive has a mode that decides where it may be changed. This is the most common reason a change “does nothing”.

PHP mode	Can be set in	Directives above with this mode
PHP_INI_ALL	Anywhere: php.ini, .user.ini, .htaccess (Apache module PHP only), or in code with ini_set()	memory_limit, max_execution_time, display_errors, log_errors, error_log, error_reporting, date.timezone
PHP_INI_PERDIR	php.ini, .user.ini, .htaccess or the server configuration, but not ini_set(), because PHP has already read the request by the time your code runs	upload_max_filesize, post_max_size, max_input_time, max_input_vars, max_file_uploads, output_buffering
PHP_INI_SYSTEM	Only php.ini or the server configuration. Not .user.ini, not .htaccess, not ini_set()	allow_url_fopen, disable_functions, upload_tmp_dir, user_ini.cache_ttl

On top of the modes, a host can lock any value with php_admin_value or php_admin_flag in the server or PHP-FPM pool configuration. A locked value cannot be overridden by .htaccess, .user.ini or ini_set(). That is how plan limits are enforced.

How to change them, by panel

Where	Path	Notes
cPanel	Software, MultiPHP INI Editor, choose the domain. Basic Mode shows common directives as fields; Editor Mode lets you type others.	Writes ini files into the site folder for you. On CloudLinux hosts, Select PHP Version has an Options tab that some hosts use instead; use the one your host documents, not both.
Plesk	Websites & Domains, the domain, PHP Settings (shown as PHP on newer dashboards)	Groups memory_limit, max_execution_time, max_input_time, post_max_size and upload_max_filesize under performance settings; others under common settings or as additional directives. The host can restrict which ones you may change.
DirectAdmin	Domain Setup, the domain, PHP Settings (where the host enabled it)	Under PHP-FPM, one pool serves the whole user, so set values on the account’s main domain. The list of editable directives is chosen by the host.
Enhance	Websites, the website, Advanced, Developer tools, php.ini editor	Add the directive and value. Then restart PHP for the website; Enhance’s documentation says the restart reloads the site’s php.ini and the site is briefly offline while it happens.
Server you manage	The PHP-FPM pool file for the site (php_value[...] or php_admin_value[...]) or the main php.ini	Reload PHP-FPM after changing pool files. php --ini lists which ini files the command line loads, which may not be the ones the web server uses.

Without a panel: .user.ini and .htaccess

Method	Works when PHP runs as	Syntax	Gotchas
.user.ini in the site folder	PHP-FPM or FastCGI (CGI) (most modern hosting)	memory_limit = 256M	PHP looks for it in the script’s folder and each parent up to the document root. Changes are picked up after user_ini.cache_ttl, 300 seconds by default. Only ALL, PERDIR and USER mode directives are read. Ignored when PHP runs as an Apache module.
.htaccess	Apache with mod_php only	php_value memory_limit 256M and php_flag display_errors Off	On any other setup (PHP-FPM, LiteSpeed without PHP directive support, Nginx) these lines cause a 500 Internal Server Error or are ignored. Use php_flag for On and Off values, php_value for the rest.
ini_set() in code	Any	@ini_set( 'display_errors', 0 );	Only PHP_INI_ALL directives, and only if the host has not locked them. It cannot change upload or input limits.
WordPress constants	Any	define( 'WP_MEMORY_LIMIT', '256M' );	WordPress only raises memory_limit to WP_MEMORY_LIMIT (front end) and WP_MAX_MEMORY_LIMIT (admin and image work), never lowers it, and cannot raise it past a locked value. Defaults: 40M (64M on multisite) and 256M.

A starting .user.ini for a typical WordPress site

memory_limit = 256M
max_execution_time = 120
max_input_time = 120
upload_max_filesize = 64M
post_max_size = 64M
max_input_vars = 3000
display_errors = Off
log_errors = On

Put it in the folder that contains wp-config.php, wait five minutes, and check the live values. Adjust to what your plan allows; higher is not automatically better.

How to check the live value

Method	Where	Notes
Tools, Site Health, Info, Server	WordPress admin	Shows the values the website really uses, including a separate admin memory line when WordPress raised it. The best single check.
wp eval 'echo ini_get("memory_limit"), PHP_EOL;'	SSH, site folder	Loads WordPress, so it includes WordPress’s raise. Replace the directive name to check another. The command line may load different ini files from the web.
php -i | grep -E "memory_limit|upload_max_filesize|post_max_size"	SSH	Command line PHP only. Useful for Loaded Configuration File and Scan this dir lines, misleading for web values.
A temporary file with <?php echo ini_get('memory_limit');	Browser	Name it something unguessable, load it once, then delete it. Never leave a phpinfo() file on a live site.

Limits outside PHP that look like PHP limits

What you see	Real limit	Where it is set
413 Request Entity Too Large	Web server body size limit (Nginx client_max_body_size, Apache LimitRequestBody, LiteSpeed request body limits)	Server configuration; ask your host
502 or 504 before PHP’s time limit	PHP-FPM request_terminate_timeout, proxy or web server timeouts	Server configuration; see 502 and 504 errors
Cloudflare 524 after a long request	Cloudflare’s timeout waiting for your server	Not changeable with PHP settings; see Cloudflare 52x
Uploads above a fixed size fail only behind Cloudflare	Cloudflare’s maximum upload size per plan (documented as 100 MB on Free and Pro)	Upload large files with the proxy off or by SFTP
Out of memory (allocated ...), 503 or 508 errors	The hosting account’s total memory or process limit	Your plan; see 503 and 508

Gotchas

• Changing PHP version resets your view. Each version can have its own settings. Recheck limits after switching; see upgrading PHP safely.
• Two tools, one setting. Editing ini files by hand and through a panel tool at the same time leads to one overwriting the other. Pick one.
• Folder scope. A .user.ini in a subfolder only affects scripts in that folder and below. wp-admin scripts read the one in the site folder because PHP walks up to the document root.
• Bigger is not safer. memory_limit = -1 or huge time limits let one runaway request consume the whole account. Find the cause of repeated limit errors instead; see memory exhausted and maximum execution time.
• display_errors stays Off in production. Log errors instead and read the log.

See also

• Allowed memory size exhausted and maximum execution time exceeded
• upload_max_filesize and 413 Request Entity Too Large
• Menu items not saving (max_input_vars)
• There has been a critical error
• Large database import fails