PHP looks for it in the directory of the script and in the directories above it, up to the document root. The result is cached and rechecked every five minutes by default, so a change can take that long to show. Under Apache with mod_php PHP ignores the file. Shared hosting customers use it because it is often the only settings file they control.
It has two weaknesses. A lower-level file can override a higher-level one, and anyone who can write a file into the site, such as a plugin, can change it. In Vincent Schmalbach's test a .user.ini that set session.upload_progress.enabled to On beat the php.ini drop-in and switched the feature back on. It is also applied after PHP has already parsed the request, which is too late for settings that PHP reads during parsing.
In October 2026, early guidance written before PHP published its advisory listed .user.ini as a place to turn off session upload progress. PHP's advisory then said not to rely on ini_set() or FPM .user.ini, and one scanner reports a .user.ini value as too late. One guide kept it as a fallback for shared hosting, where it may be the only file a customer controls.
Use php.ini or the pool for security settings. On shared hosting, ask the host to set the value at server level. Search your sites for .user.ini files that mention upload_progress, and treat a .user.ini setting as a stop-gap, not a fix.