It sets defaults for memory limits, uploads, sessions, error handling and much more. Extra files in a scan directory such as conf.d are loaded after it, which is how distributions let you add a small drop-in file without editing the main one. Each way of running PHP, such as the command line, PHP-FPM and Apache, often has its own php.ini and conf.d, for example /etc/php/8.4/fpm/ and /etc/php/8.4/apache2/ on Debian and Ubuntu.
The catch is that the file you read may not be the file the website uses. The command-line php.ini is often not what the site runs with, and a server can hold several PHP versions, each with its own files. PHP reads the file at startup, so a change needs a restart, and pool or per-directory settings can override it.
In October 2026, the main mitigation line for CVE-2026-109619, session.upload_progress.enabled = 0, was written into a drop-in file in each SAPI's scan directory, for example /etc/php/8.4/fpm/conf.d/99-disable-upload-progress.ini. One guide looped over every fpm and apache2 conf.d directory on an Ubuntu 22.04 machine and found both trees, which shows how easily one of them gets missed.
List every PHP version and every SAPI on each server, write the setting for each, restart, and check the web value. Do not use the output of php -v on the command line to describe what your website runs.