It lives in two places. In Apache configuration with mod_php it is written php_admin_flag session.upload_progress.enabled off. In a PHP-FPM pool it is written php_admin_flag[session.upload_progress.enabled] = off. Its companion php_admin_value does the same for numbers and strings. The setting is locked, so ini_set() and .user.ini cannot override it, and it is not allowed in .htaccess.
Some care is needed. The pool file is what the website gets, and it can disagree with php.ini. The two syntaxes differ, and a change needs a restart or a full reload of PHP-FPM before it applies.
In October 2026, Vincent Schmalbach tested that with php_admin_flag[session.upload_progress.enabled] = off in the pool the feature stayed off even when a .user.ini turned it on. Mattias Geniar recommended the pool form so that applications cannot change the value, and used php_admin_flag[fatal_error_backtraces] = off for PHP 8.5. cPanel's own PHP-FPM pool defaults already use php_admin_flag entries, for example for allow_url_fopen and log_errors.
Put the setting in every pool or in a shared include, restart PHP-FPM, check the effective value from a real web request, and use the admin form for any security setting that an application should not be able to reverse.