413 Request Entity Too Large: what it means and how to fix it

A 413 error means an upload or request body is larger than the server allows. How to raise the limit in nginx, Apache, PHP, Express, Next.js or Cloudflare.

1. The short answer

A 413 Request Entity Too Large error means the data you sent, usually a file upload, is bigger than the server allows. Every layer between the browser and the app can have its own limit: a CDN, nginx or Apache, PHP, and the app itself. To fix it, find the smallest limit in that chain and raise it, or send big files straight to storage instead.

RFC 9110 renamed the code 413 Content Too Large, but servers still show the old name. If the limit is only temporary, the server may send Retry-After.

2. What you'll see

"413 Request Entity Too Large" (nginx), "Request Entity Too Large" (Apache), PayloadTooLargeError: request entity too large in an Express log, or an upload that fails partway. WordPress often shows "The uploaded file exceeds the upload_max_filesize directive in php.ini." instead, because PHP's limits don't produce a 413 at all.

3. Common causes

• nginx's `client_max_body_size`, which is 1 MB by default.
• Apache's `LimitRequestBody`, 1 GB by default since Apache 2.4.53 (unlimited before), but often set lower by hosts.
• PHP's `upload_max_filesize` (2 MB by default) and `post_max_size` (8 MB). Going over them empties the upload rather than sending 413, so the app sees no file.
• ModSecurity's request body limit, on hosts that use it.
• The app's own parser. Express's express.json() accepts 100 KB by default.
• A CDN or proxy in front, such as Cloudflare's per-plan limit.
• Base64 inside JSON, which makes a file about a third bigger than it is on disk.

4. How to fix a 413 as a visitor

1. Make the file smaller: compress an image, export a video at a lower resolution, or zip documents.
2. Upload files one at a time instead of all at once.
3. Look for the site's stated upload limit, and contact the owner if you need to send something bigger.

5. How to fix a 413 on your own site

Raise every layer, not just one. Then reload or restart each service you changed.

nginx. Set client_max_body_size in http, server or location. Setting it to 0 turns the check off; a real number is safer.

# nginx: allow uploads up to 50 MB on this site
server {
    client_max_body_size 50m;
}
# then: sudo nginx -t && sudo systemctl reload nginx

Apache. LimitRequestBody takes bytes and works in the server config, a virtual host, a <Directory> block or .htaccess.

# Apache: allow 50 MB (52,428,800 bytes)
LimitRequestBody 52428800

PHP and WordPress. Raise both upload_max_filesize and post_max_size, with post_max_size the larger, since it covers the whole form. Check the values took effect with phpinfo() or WordPress's Tools, Site Health, Info, Media Handling.

; php.ini (or your host's PHP settings)
upload_max_filesize = 64M
post_max_size = 64M

Node and Express. Set the parser's limit. Don't raise it for every route; only for the ones that need it. For file uploads, use a streaming parser (such as multer or busboy) with its own size limit rather than JSON.

// Express: allow bigger JSON on one route only
app.post("/api/import", express.json({ limit: "10mb" }), handleImport);

Next.js. Server Actions accept 1 MB by default; raise it with the serverActions.bodySizeLimit option in next.config (check the docs for your version). Pages Router API routes have their own bodyParser.sizeLimit, also 1 MB by default.

Cloudflare. Its body limit depends on the plan (100 MB on Free and Pro, 200 MB on Business, 500 MB by default on Enterprise). You can't raise it below Enterprise, so for bigger files upload straight to storage, or in chunks below the limit.

Big files, done well. Have your server create a short-lived signed upload address for S3, Supabase Storage or similar, and let the browser send the file straight there. Your app only stores the file's address, and no proxy limit applies.

6. On Cloudzyro

Every Sites & Apps site is behind Cloudflare, so Cloudflare's request size limit applies to uploads your site receives. Send large files from the browser straight to storage, such as Supabase Storage or S3. That's also where uploads belong anyway: files a site writes while it runs are reset on every deploy, so keep them in storage or a database.

This is separate from the size of a version you deploy: the console checks that before sending (100 MB and 20,000 files on Launch, 1 GB and 50,000 files on Boost). See Upload your site's files.

On Web Hosting, raise upload_max_filesize and post_max_size in cPanel's PHP settings for the site's PHP version.

7. How to check the status code

# Make a 20 MB test file and post it
head -c 20000000 /dev/zero > /tmp/test.bin
curl -s -o /dev/null -w "%{http_code}\n" -F "file=@/tmp/test.bin" https://www.example.com/upload

Try a few sizes to find the limit, then compare it with each layer's setting. The response's server: header shows which layer refused it. In the browser's Network tab, a 413 that arrives immediately usually comes from a proxy, before your app saw anything.

8. Related errors

• [400 Bad Request](/guides/400-bad-request): a malformed request, which some servers use for oversized headers.
• [504 Gateway Timeout](/guides/504-gateway-timeout): a big upload that's allowed, but takes too long to process.
• [502 Bad Gateway](/guides/what-is-a-502-error): the app crashed handling a big upload, for example by running out of memory.
• 414 URI Too Long: the address itself, not the body, is too long; send the data in the body with POST instead.

9. Sources

• RFC 9110, section 15.5.14: 413 Content Too Large
• MDN: 413 Content Too Large
• nginx: client_max_body_size
• Apache: LimitRequestBody
• PHP: Description of core php.ini directives
• Cloudflare: Connection limits