A failed upload can stop a site update cold. You pick a new theme, add a product image, or import a backup, then WordPress throws a message that looks far more serious than it is.

A WordPress 413 error means the server rejected a request because the file or data package was too large. The fix is usually straightforward, but it has to happen at the layer that set the limit.

Start by finding where the upload is blocked, then raise only the limit you need.

What a 413 error means on a WordPress site

HTTP status code 413 is now commonly called “Content Too Large.” You may still see the older wording, “Request Entity Too Large,” in hosting dashboards, server logs, and WordPress alerts. Both messages point to the same issue.

As MDN’s explanation of HTTP 413 puts it, the request body exceeded a size limit set by the server. That request may be a media file, ZIP file, database import, form submission, or a plugin sending data through the WordPress REST API.

The error is usually not inside WordPress

WordPress is often where you see the failure. It usually isn’t where the restriction began.

Your request may pass through several gates before it reaches WordPress:

  • A CDN or proxy, such as Cloudflare
  • Your web server, often Nginx or Apache
  • PHP’s upload and POST limits
  • A WordPress plugin, security tool, or import tool

Think of it like shipping a package through several checkpoints. The first checkpoint with a smaller box slot sends it back. Raising a limit later in the path won’t change that.

Common moments when it appears

A WordPress 413 error often shows up when you upload a large image, install a plugin ZIP, restore a backup, import WooCommerce products, or submit a form with hefty attachments.

The file size matters, but the total request size matters too. A 40 MB file can become a larger POST request once form data and upload details are added.

If a 25 MB upload fails but a 2 MB upload works, you have a size limit problem. If every upload fails, check permissions, storage space, and server errors too.

Diagnose the WordPress 413 error in the right order

Don’t start changing random settings. That approach can turn one clear issue into five unclear ones.

First, write down the failed action and the file size. Then try a smaller file. A test file just below the suspected limit, followed by one just above it, can reveal the actual ceiling fast.

What failsLikely place to check first
Media Library image or video uploadNginx, PHP, hosting panel
Theme or plugin ZIP uploadNginx, PHP, WordPress file limits
Backup restoration or site migrationHost limits, PHP, migration plugin
Form attachment uploadForm plugin, PHP, web server
API request or headless uploadCDN, proxy, Nginx location rules

The browser’s developer tools and your hosting error logs can help, but you don’t need to become a server detective. Check your hosting stack first. If your site uses Cloudflare, inspect that layer before editing WordPress or PHP settings.

Look for clues in the error page

An Nginx-branded error page is a strong sign that Nginx stopped the request. A generic Cloudflare error can mean the request never reached your host. A WordPress dashboard notice that mentions maximum upload size often points toward PHP or a host-level setting.

If you’re on managed hosting, check the knowledge base or ask support which web server sits in front of PHP. One clear question saves a lot of trial and error: “What request-body limit applies to this domain, and where can it be changed?”

Confirm the current WordPress upload limit

In the WordPress dashboard, go to Media > Add New. WordPress normally displays the maximum upload file size near the uploader.

That number is useful, but it isn’t the whole story. It may show PHP’s limit while Nginx or a proxy has a lower cap. A WordPress setting can’t overrule a smaller server-level limit.

Raise the Nginx request size limit

Nginx is one of the most common sources of this problem. Its client_max_body_size directive controls the largest request body Nginx accepts. Nginx documents a default of 1m, which is far too small for many modern photos, plugin archives, and backups.

The official Nginx directive reference confirms that requests above this setting return a 413 response.

Add a sensible client_max_body_size value

For many small business WordPress sites, 64m is a practical starting point. If you routinely upload large galleries, WooCommerce imports, or backup archives, 128m may make more sense.

Add this directive in the right Nginx configuration scope:

  • client_max_body_size 64m; for a 64 MB request limit
  • client_max_body_size 128m; for a 128 MB request limit

Place it in the http, server, or relevant location block. A more narrowly scoped location rule can override a broader setting. That detail catches people out all the time.

Avoid setting client_max_body_size 0; on a production site. It removes Nginx’s body-size check entirely, which gives oversized requests an open door.

Reload Nginx after saving changes

A changed config file does nothing until Nginx reloads. On a self-managed VPS, test the configuration first, then reload the service. Your hosting provider may handle this through a dashboard or support request.

If you have SSH access but don’t manage servers often, pause before editing a live config file. A misplaced character can take down a site. Our VPS and managed hosting customers can ask for help before a server setting becomes a late-night repair job.

Set PHP upload limits high enough

Once Nginx allows the request through, PHP still has its own rules. The two settings that matter most are upload_max_filesize and post_max_size.

PHP’s core configuration documentation states that post_max_size affects file uploads and must be larger than upload_max_filesize for larger uploads to work.

Use values that work together

If you want to allow 64 MB files, don’t set both values to 64 MB. The POST request includes more than the file itself.

A sensible example looks like this:

  • Set upload_max_filesize to 64M
  • Set post_max_size to 80M or 96M
  • Set memory_limit high enough for image processing and imports
  • Raise max_execution_time if big imports time out

For 128 MB uploads, upload_max_filesize at 128M and post_max_size at 160M or 192M gives the request breathing room. More isn’t always better. Set limits around the largest legitimate file your site needs.

Don’t rely on a theme’s functions.php file for this. Theme changes can wipe out that adjustment, and many hosts block PHP values set this way.

Change PHP limits through cPanel or your host

Many shared hosting accounts let you edit these values in cPanel through MultiPHP INI Editor, Select PHP Version, or a PHP Options screen. Menu names vary by host.

Hosting teams that manage servers through WHM can use cPanel’s MultiPHP INI Editor documentation to check the available directives. If the field is locked, that setting belongs to the hosting provider.

Look for a per-site php.ini or .user.ini file only when your host supports it. Then allow time for PHP to read the change. Some configurations cache .user.ini values for several minutes.

Check Cloudflare, Apache, and managed-host limits

A larger PHP limit won’t help when another service rejects the request first. This is where many WordPress 413 error fixes go in circles.

Check the proxy before the origin server

If your domain is proxied through Cloudflare, test whether the request reaches the host. Cloudflare product limits vary. For example, Cloudflare Pages limits set a 25 MiB maximum for an individual site asset.

That doesn’t automatically mean your WordPress Media Library is limited to 25 MiB. It does show why product-specific limits matter. The service handling the upload path sets the rule.

Temporarily pausing the proxy for a controlled test can help isolate the cause. Don’t leave security or caching services disabled longer than needed. If the upload works with the proxy off, contact the provider or adjust the relevant proxy rule.

Check Apache and host-level controls

Apache-hosted sites can have virtual-host rules, .htaccess controls, reverse proxies, or security modules that apply their own request caps. Your host may also use Nginx in front of Apache, so both layers can matter.

Managed WordPress platforms often hide raw server files for good reason. That doesn’t mean you’re stuck. Use the host panel if it exposes upload limits. Otherwise, ask support to increase the domain’s request-body limit and PHP upload settings together.

Reliable hosting should remove this kind of friction, not make it your weekend project. Our WordPress hosting, Web Hosting Plus, and VPS options give you room to grow, with support when a server setting needs a human touch.

Rule out WordPress plugins and file issues

The server is usually the culprit, but not always. Security plugins, form builders, backup tools, and migration plugins can set their own upload limits.

Test with a focused plugin check

If the server and PHP limits look right, deactivate only the plugin involved in the failing action. Then test again. For example, test a form attachment without the form plugin’s upload restriction, or check a migration tool’s documented import cap.

Don’t deactivate everything at once on a live business site. Make one change, run one test, and keep a note of the result. Calm troubleshooting wins here.

Also check available disk space. A host can allow a 128 MB upload, but WordPress may still fail while creating thumbnails or unpacking a plugin archive if the account is nearly full.

Keep security limits practical

Large request limits have a purpose. They can increase memory use, upload time, and exposure to abusive requests. Pick a ceiling that matches your real work.

A photographer may need 64 MB or 128 MB image uploads. A brochure site that only accepts logo files might need far less. Set the limit, test it, and leave the rest of your defenses in place.

Retest the upload and protect future updates

After changing any limit, clear relevant caches and retry the original action. Test the exact file that failed, then test a slightly larger file only if you need to confirm the new ceiling.

If the upload still fails, review the order again: proxy first, web server second, PHP third, WordPress tools last. The smallest active limit always wins.

Before importing a large backup or product catalog, confirm available storage, PHP memory, and timeout settings. Upload size is only one part of a successful big job.

Final Thoughts

A WordPress 413 error isn’t a mystery inside WordPress. It’s a request-size limit, and the fix is finding the first layer that says no.

Set practical Nginx and PHP limits, check any proxy in front of your site, and test one change at a time. Once the limits match the work your site needs to do, uploads stop being a roadblock and go back to being routine.

We use cookies so you can have a great experience on our website. View more
Cookies settings
Accept
Decline
Privacy & Cookie policy
Privacy & Cookies policy
Cookie name Active

Who we are

Our website address is: https://zadic.net.

Comments

When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection. An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Cookies

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year. If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser. When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select "Remember Me", your login will persist for two weeks. If you log out of your account, the login cookies will be removed. If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue. For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where your data is sent

Visitor comments may be checked through an automated spam detection service.
Save settings
Cookies settings