WordPress’s generic “HTTP error” can represent upload-size rejection, timeout, permission failure, disk/inode exhaustion, image-library memory failure, firewall block or invalid REST/AJAX response. The actual request status and PHP log distinguish them.
Preserve one safe test file and its dimensions before changing every limit.
Build a controlled file matrix
Test a small JPEG/PNG created by you, then the failing file. Record filename extension, byte size, pixel dimensions and colour mode.
Compare:
small image vs failing
JPEG/PNG/WebP as supported
browser uploader vs Media > Add New
same user/another authorised roleDo not upload confidential customer documents during diagnosis.
Inspect the upload request
Open Network and record endpoint, status, response and duration. WordPress may use async-upload.php or REST depending on context.
A 413 indicates request too large at proxy/web server; 403 firewall/permission; 500 PHP; timeout processing. A 200 response with invalid HTML can still make the UI report HTTP error.
Redact cookies/nonces and never publish uploaded private file URLs.
Compare effective PHP/server limits
Check upload_max_filesize, post_max_size, memory, execution time and web/CDN body limit in the active web PHP context.
post_max_size must accommodate the whole request and should exceed upload size. Raising PHP alone cannot override Nginx/Cloudflare limits.
Use cPanel/Plesk/host-supported configuration and keep justified limits.
Check disk, inodes and temp directory
PHP first writes uploads to a temporary location, then WordPress moves them to uploads. Both need free space/inodes and correct permissions.
Inspect exact “failed to write” or “open_basedir” log lines. Do not use recursive 777.
Backups/cache can fill the quota even when the uploads directory itself is small.
Inspect image processing
After upload, WordPress creates intermediate sizes using GD/Imagick. A high-resolution compressed image can require hundreds of megabytes when decoded.
Check memory fatals and image-library errors. Optimise dimensions before upload and reduce unnecessary registered image sizes through maintained code.
Do not disable MIME/imagetype validation to accept a problematic file.
Check file type and security
Confirm extension, MIME and actual bytes agree. WordPress restricts allowed types by role.
Custom MIME filters should be narrowly reviewed:
add_filter( 'upload_mimes', function ( $mimes ) {
// Add only a business-required, safely handled type.
return $mimes;
} );Never permit executable PHP or risky formats merely to remove the message.
Correlate firewall and REST/AJAX
ModSecurity may flag filenames/metadata, while security plugins can block upload endpoints. Search by timestamp/request ID.
Create a narrow correction, retaining file scanning and size/rate protections. Test block-editor media insertion if REST is involved.
Exclude authenticated upload responses from public cache.
Check metadata and EXIF handling
WordPress may read EXIF/IPTC to generate title/caption and rotate images. Malformed metadata can make one file fail after bytes upload successfully.
Create a privacy-safe copy with metadata removed and compare. Do not strip all production media blindly; copyright fields may be intentional. Photos can contain GPS coordinates, so define whether metadata should be retained and who can access originals.
Inspect multisite and role quotas
WordPress multisite can limit permitted file types, maximum upload size and per-site storage independently of PHP. Network administrators and site users may therefore see different results.
Check network settings and current site quota using approved tools. Increase limits only for a business need and confirm backups/storage capacity. Do not grant unfiltered_upload broadly; it bypasses protections beyond simple image size.
Verify media lifecycle
Upload representative images, confirm attachment metadata, thumbnails, editor insertion and public/private access. Test deletion and regenerate only needed sizes.
Monitor disk/inodes, PHP fatals and upload errors. Recurring care should set practical media guidance and capacity alerts; a successful small file is not proof that normal editorial assets can be processed safely.