The manual gives every setting a mode. PHP_INI_USER settings can be changed anywhere, including from a script. PHP_INI_SYSTEM settings can be set only in php.ini or the server configuration. PHP_INI_PERDIR sits in between: it can be set in php.ini, in Apache configuration and .htaccess, or in .user.ini, and it is fixed once the request starts.
Being allowed in a place does not mean the setting works there in time. PHP reads some settings while it parses the request, so a value that arrives later, from a per-directory file, can be too late to matter. Settings such as post_max_size and session.upload_progress.enabled are in this mode, which is why they cannot be changed with ini_set().
In October 2026, guidance for CVE-2026-109619 pointed out that ini_set() cannot help with session.upload_progress.enabled because it is an INI_PERDIR setting. PHP also told administrators not to rely on .user.ini for it, even though that file is among the places an INI_PERDIR value may be written.
Look up the mode of a setting in the manual before you decide where to set it. For security settings, choose the place with the highest precedence that the application and the site owner cannot change, and confirm the value that a real web request sees.