---
title: 12.07 File Upload Size Limits
description: A file attached to SimpleRisk has to get past three separate size limits, one in PHP, one in SimpleRisk and one in MySQL. Here is where each is set, how…
---
[Skip to content](https://support.simplerisk.com/kb/12-07-file-upload-size-limits#main-content)
English
Show submenu for translations
[Customer portal](https://support.simplerisk.com/tickets?hsLang=en)
[](https://www.simplerisk.com/)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Customer portal](https://support.simplerisk.com/tickets)
- [Contact us](https://www.simplerisk.com/about-us/contact-us)
[Contact us](https://www.simplerisk.com/about-us/contact-us)
How can we help you?
- There are no suggestions because the search field is empty.
1. [SimpleRisk Knowledge Base](https://support.simplerisk.com/kb?hsLang=en)
2. [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en)
3. [12 Operations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#12-operations)
# 12.07 File Upload Size Limits
## A file attached to SimpleRisk has to get past three separate size limits, one in PHP, one in SimpleRisk and one in MySQL. Here is where each is set, how they relate, and what to change when an attachment is refused.
## Why this matters
Every attachment in SimpleRisk, whether on a risk, a mitigation, a document, a compliance test, an incident or an assessment questionnaire, has to clear three size limits before it is stored. Each limit lives in a different place, nobody sets all three at once, and they do not announce themselves until someone tries to attach a file that is bigger than the smallest of them.
The three limits are:
#### **PHP**
- **Set in:** `php.ini`: `upload_max_filesize`, `post_max_size` and `memory_limit`
- **Out-of-the-box value:** `upload_max_filesize` is 2M on a stock PHP install. Packaged images and many hosting guides raise it.
#### **SimpleRisk**
- **Set in:** Settings Hub \> System \> **File Upload**, the *Maximum Upload File Size* field
- **Out-of-the-box value:** 5,120,000 bytes (about 5 MB)
#### **MySQL**
- **Set in:** `my.cnf`: `max_allowed_packet` and `innodb_log_file_size`
- **Out-of-the-box value:** `max_allowed_packet` is 64M on current MySQL 8, 16M on current MariaDB, and 1M to 4M on older installs. The default `innodb_log_file_size` of 48M only allows files of about 4.8 MB, because the database refuses a single stored file larger than a tenth of that log.
The effective limit is the smallest of the three, and it is the number SimpleRisk uses everywhere: the "Max" label next to each attachment field, the size check the browser makes before a file is sent, and the check the server makes when it arrives. A fresh install can therefore show a lower maximum than the 5,120,000 bytes in the Maximum Upload File Size field, because the PHP default is 2M and, on a stock MySQL install, the database cannot store more than about 4.8 MB. The field can not be raised past the other two limits; raising PHP and MySQL is what lifts the effective limit.
## Before you start
Have these in hand:
- Administrator access to the Settings Hub.
- Access to `php.ini` and `my.cnf` (or the equivalent environment settings if you run in Docker or on a hosted platform where someone else owns them).
- The size of the file that was refused, if you know it.
## Step-by-step
1. **Open the limit that SimpleRisk controls.** Open the Settings Hub from the Settings cog at the top right of any page, then choose **File Upload** under the System category. The *Maximum Upload File Size* field holds the value in bytes. The same page lists the allowed file types, and a file whose type and extension are not on that list is refused no matter how small it is.
2. **Read what the page says is in effect.** If the saved value is higher than PHP or MySQL allow (an older install, or a server whose limits were lowered after the value was saved), the page says so and shows the largest file currently accepted, in bytes. A red line also names which limit is the smaller one. *Warning: the current file size limit is larger than PHP allows to be uploaded* means PHP is the smallest limit, so check `upload_max_filesize`, `post_max_size` and `memory_limit`. *Warning: the current file size limit is larger than MySQL is configured for uploads* means check `max_allowed_packet` and `innodb_log_file_size`. Nothing is lost by a value that is too high: it is capped when it is used.
3. **Raise PHP's limit if it is the smallest.** Set `upload_max_filesize` and `post_max_size` to at least the size you want, with `post_max_size` slightly larger than `upload_max_filesize` because the request carries more than the file. `memory_limit` should be larger than both. Restart the web server or PHP-FPM so the change takes effect.
4. **Raise MySQL's limit if it is the smallest.** Set `max_allowed_packet` to at least the size you want, plus a little headroom, and set `innodb_log_file_size` to ten times the largest file you intend to allow. Restart the database. `innodb_log_file_size` is the one that surprises people, because the default is small enough to cap uploads below the SimpleRisk default.
5. **Set the SimpleRisk value last.** Enter the size you want in bytes and select **Update**. A value above what PHP or MySQL can take is refused with the matching warning and is not saved, so raise those two first.
6. **Check it with a real file.** Attach one a little under the new limit somewhere low-stakes, such as a draft risk. Do not assume the warnings caught everything.
## What the person attaching the file sees
It depends on where they were working.
- On most forms, the page checks the size in the browser and refuses the file before sending it, using the effective limit, so the number it quotes is the real one.
- When a file clears the browser and is refused on the server, the rest of what they entered is still saved wherever the form allows it. On an assessment questionnaire, the respondent sees that their answers were saved but one or more attachments were not stored. The specific cause, which limit was exceeded, is written to the debug log and not shown to the respondent, because they cannot act on it.
## Common pitfalls
- **Raising only the SimpleRisk field.** It is the only one of the three that shows up in the UI, so it is the one people change, and it cannot be set above the other two. If the maximum shown is still lower than you want, the problem is one of the other two.
- **Changing `upload_max_filesize` but not `post_max_size`.** The whole request, not just the file, has to fit in `post_max_size`. A file just under the first number can still fail on the second.
- **Forgetting `innodb_log_file_size`.** On MySQL, a stored file larger than a tenth of the log file size is refused even when `max_allowed_packet` is huge. If the SimpleRisk warning mentions MySQL and `max_allowed_packet` looks fine, look here.
- **Hosted and containerized installs.** In a Docker image or a managed database, the PHP and MySQL values belong to whoever runs those layers. Raise the request with them. The SimpleRisk field is the only one you can change from the UI.
- **A refused file is reported, not silently dropped.** The attachment forms catch a file that is too large for PHP or MySQL and show a message, and assessment questionnaires tell the respondent that the answers were saved but an attachment was not stored. The File Upload page warnings remain the way to find a mismatch before anyone hits it.
## Related
- [Performance tuning](https://support.simplerisk.com/kb/12-02-performance-tuning?hsLang=en)
- [Troubleshooting common issues](https://support.simplerisk.com/kb/12-04-troubleshooting-common-issues?hsLang=en)
- [Data integrity review and repair](https://support.simplerisk.com/kb/12-06-data-integrity-review-and-repair?hsLang=en)
- [FAQs](https://support.simplerisk.com/kb/faqs?hsLang=en)
- [SimpleRisk Extras](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#main-content)
- [Vulnerability Management Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#vulnerability-management-extra)
- [Team Separation Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#team-separation-extra)
- [Import-Export Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#import-export-extra)
- [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#main-content)
- [00 About This Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#00-about-this-guide)
- [01 Installation and Deployment](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#01-installation-and-deployment)
- [02 Upgrades and Maintenance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#02-upgrades-and-maintenance)
- [03 Users and Permissions](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#03-users-and-permissions)
- [04 Authentication](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#04-authentication)
- [05 Customization](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#05-customization)
- [06 Configuring Risk and Compliance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#06-configuring-risk-and-compliance)
- [07 Integrations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#07-integrations)
- [08 The API](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#08-the-api)
- [09 Encryption and Data Security](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#09-encryption-and-data-security)
- [10 Workflows and Automation](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#10-workflows-and-automation)
- [11 Reporting and Auditing](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#11-reporting-and-auditing)
- [12 Operations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#12-operations)
- [13 Reference](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#13-reference)
- [User Guide](https://support.simplerisk.com/kb/user-guide?hsLang=en#main-content)
- [00 Foundations of GRC](https://support.simplerisk.com/kb/user-guide?hsLang=en#00-foundations-of-grc)
- [01 Risk Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#01-risk-management)
- [02 Compliance Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#02-compliance-management)
- [03 Governance](https://support.simplerisk.com/kb/user-guide?hsLang=en#03-governance)
- [04 Asset and Data Inventory](https://support.simplerisk.com/kb/user-guide?hsLang=en#04-asset-and-data-inventory)
- [05 Threat and Vulnerability Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#05-threat-and-vulnerability-management)
- [06 Assessments](https://support.simplerisk.com/kb/user-guide?hsLang=en#06-assessments)
- [07 Incident Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#07-incident-management)
- [08 Audit and Reporting](https://support.simplerisk.com/kb/user-guide?hsLang=en#08-audit-and-reporting)
- [09 Day-to-Day SimpleRisk](https://support.simplerisk.com/kb/user-guide?hsLang=en#09-day-to-day-simplerisk)
- [10 Continuous Improvement](https://support.simplerisk.com/kb/user-guide?hsLang=en#10-continuous-improvement)
- [SimpleRisk User Guides](https://support.simplerisk.com/kb/simplerisk-user-guides?hsLang=en)
- [Troubleshooting](https://support.simplerisk.com/kb/troubleshooting?hsLang=en)
- [SimpleRisk Hosted](https://support.simplerisk.com/kb/simplerisk-hosted?hsLang=en)
- [How To videos](https://support.simplerisk.com/kb/how-to-videos?hsLang=en)
[](https://www.simplerisk.com)
Copyright © 2026, SimpleRisk, Inc.