Raise WordPress upload limits and prevent false-positive upload 403s by Copilot · Pull Request #33 · MaximillianGroupInc/system-core

Copilot · 2026-06-13T21:33:33Z

Uploading large plugins (e.g. Gutenberg at ~35 MB) returned 413 Request Entity Too Large from nginx because /wp-admin/update.php inherited the global 10m default. PHP-FPM's upload_max_filesize defaulted to 2M, silently blocking media uploads that nginx would otherwise pass. Upload handlers were also returning 403 in some valid cases due to $block_reason UA/geo checks.

nginx (`nginx/snippets/spx-upload-limits.conf`)

Per-route client_max_body_size overrides, included by the HTTPS vhost:

Route	Limit
`/wp-admin/update.php`	`64m` — plugin/theme ZIPs
`/wp-admin/async-upload.php`	`100m` — media library uploader
`/wp-json/wp/v2/media`	`100m` — REST API media endpoint

All values stay at or below Cloudflare's 100 MB per-request cap. Global default remains 10m.

Upload routes now bypass soft UA/geo $block_reason false-positive checks but still enforce hard malicious-signature blocks via $hard_block_reason (from nginx/conf.d/spx-bot-mitigation-logic.conf). Method restrictions and rate limiting remain in place, and upload authorization is still enforced by WordPress.

PHP-FPM (`var/www/html/.user.ini`) — new file

PHP-FPM scans .user.ini from the document root for every request. upload_max_filesize / post_max_size are PHP_INI_PERDIR and cannot be set via ini_set() at runtime.

upload_max_filesize = 100M
post_max_size       = 105M   ; 5M headroom for multipart overhead

Direct web access is blocked by perimeter dotfile deny rules.

…x_size=105M

Copilot

Pull request overview

Raises WordPress upload limits end-to-end by aligning PHP-FPM per-directory upload caps with the (per-route) Nginx request body limits, addressing 413s and PHP’s default 2M upload ceiling.

Changes:

Add PHP-FPM per-directory overrides via a new var/www/html/.user.ini.
Set upload_max_filesize/post_max_size to support larger plugin and media uploads.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

MaximillianGroup · 2026-06-19T16:16:59Z

@copilot - this solution will not solve the 403 error. The user upload limits is 120M already. This is not a solution

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Copilot · 2026-06-19T16:24:43Z

@copilot - this solution will not solve the 403 error. The user upload limits is 120M already. This is not a solution

Updated in 176d534: I removed $block_reason 403 enforcement from the WordPress upload endpoints (/wp-admin/update.php, /wp-admin/async-upload.php, /wp-json/wp/v2/media) so legitimate uploads are not blocked by UA/geo false positives, while keeping per-route method limits and rate limiting in place.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

…hs only

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

+upload_max_filesize = 95M
+post_max_size       = 100M


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

+upload_max_filesize = 95M
+post_max_size       = 100M


Add var/www/html/.user.ini: set PHP upload_max_filesize=100M, post_ma…

75bb349

…x_size=105M

Copilot AI assigned Copilot and MaximillianGroup Jun 13, 2026

Copilot AI requested review from Copilot and removed request for Copilot June 13, 2026 21:33

Copilot AI changed the title ~~Raise nginx upload body-size limits for WordPress plugins and media~~ Raise WordPress upload limits: nginx body-size + PHP-FPM per-directory overrides Jun 13, 2026

Copilot created this pull request from a session on behalf of MaximillianGroup June 13, 2026 21:33 View session

Copilot AI requested a review from MaximillianGroup June 13, 2026 21:33

Copilot finished work on behalf of MaximillianGroup June 13, 2026 21:33

MaximillianGroup approved these changes Jun 19, 2026

View reviewed changes

MaximillianGroup requested a review from Copilot June 19, 2026 16:14

Copilot started reviewing on behalf of MaximillianGroup June 19, 2026 16:14 View session

Copilot AI reviewed Jun 19, 2026

View reviewed changes

Comment thread var/www/html/.user.ini Outdated

Comment thread var/www/html/.user.ini Outdated

Potential fix for pull request finding

5993429

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 19, 2026 16:16

Potential fix for pull request finding

51002d5

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot started reviewing on behalf of MaximillianGroup June 19, 2026 16:17 View session

Copilot AI reviewed Jun 19, 2026

View reviewed changes

Comment thread var/www/html/.user.ini Outdated

Copilot started work on behalf of MaximillianGroup June 19, 2026 16:20 View session

Copilot AI added 2 commits June 19, 2026 16:23

Exempt WordPress upload routes from UA/geo 403 blocking

b837792

Clarify upload-route security note in nginx snippet

176d534

Copilot AI requested review from Copilot and removed request for Copilot June 19, 2026 16:24

Copilot AI changed the title ~~Raise WordPress upload limits: nginx body-size + PHP-FPM per-directory overrides~~ Raise WordPress upload limits and prevent false-positive upload 403s Jun 19, 2026

Copilot finished work on behalf of MaximillianGroup June 19, 2026 16:25

Copilot AI requested a review from MaximillianGroup June 19, 2026 16:25

Potential fix for pull request finding

1b18287

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 19, 2026 17:26

Split upload route blocking into hard and soft reasons

728c04d

Copilot AI requested review from Copilot and removed request for Copilot June 19, 2026 17:37

Copilot finished work on behalf of MaximillianGroup June 19, 2026 17:38

MaximillianGroup approved these changes Jun 19, 2026

View reviewed changes

Potential fix for pull request finding

cee6f6a

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 19, 2026 17:49

Copilot started reviewing on behalf of MaximillianGroup June 19, 2026 17:50 View session

Copilot started work on behalf of MaximillianGroup June 19, 2026 17:51 View session

Copilot AI reviewed Jun 19, 2026

View reviewed changes

Comment thread var/www/html/.user.ini Outdated

Comment thread nginx/snippets/spx-upload-limits.conf Outdated

Comment thread nginx/conf.d/spx-bot-mitigation-logic.conf Outdated

Tighten WP REST media location regex to collection and numeric-ID pat…

1eede20

…hs only

Copilot finished work on behalf of MaximillianGroup June 19, 2026 17:54

Copilot AI requested a review from MaximillianGroup June 19, 2026 17:54

MaximillianGroup approved these changes Jun 19, 2026

View reviewed changes

Copilot started work on behalf of MaximillianGroup June 19, 2026 18:14 View session

Potential fix for pull request finding

e9305a9

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 19, 2026 18:15

MaximillianGroup and others added 2 commits June 19, 2026 11:15

Potential fix for pull request finding

5b43a43

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Potential fix for pull request finding

f0879e3

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot started reviewing on behalf of MaximillianGroup June 19, 2026 18:15 View session

MaximillianGroup marked this pull request as ready for review June 19, 2026 18:16

Copilot finished work on behalf of MaximillianGroup June 19, 2026 18:17

Copilot AI requested a review from MaximillianGroup June 19, 2026 18:17

Copilot AI reviewed Jun 19, 2026

View reviewed changes

Comment thread nginx/conf.d/spx-bot-mitigation-logic.conf

Comment thread var/www/html/.user.ini

Comment on lines +32 to +33

upload_max_filesize = 95M

post_max_size = 100M

Potential fix for pull request finding

4360393

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Max Barrett <34328348+MaximillianGroup@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 19, 2026 22:08

Copilot started reviewing on behalf of MaximillianGroup June 19, 2026 22:08 View session

MaximillianGroup approved these changes Jun 19, 2026

View reviewed changes

MaximillianGroup merged commit e51d867 into main Jun 19, 2026
6 checks passed

Copilot AI reviewed Jun 19, 2026

View reviewed changes

Comment thread var/www/html/.user.ini

Comment on lines +32 to +33

upload_max_filesize = 95M

post_max_size = 100M

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Raise WordPress upload limits and prevent false-positive upload 403s#33

Raise WordPress upload limits and prevent false-positive upload 403s#33
MaximillianGroup merged 15 commits into
mainfrom
copilot/increase-upload-size-limits

Copilot AI commented Jun 13, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

MaximillianGroup commented Jun 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI commented Jun 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

nginx (nginx/snippets/spx-upload-limits.conf)

PHP-FPM (var/www/html/.user.ini) — new file

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

MaximillianGroup commented Jun 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI commented Jun 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jun 13, 2026 •

edited

Loading

nginx (`nginx/snippets/spx-upload-limits.conf`)

PHP-FPM (`var/www/html/.user.ini`) — new file