Changing the Temporary Upload Directory in Shared Hosting Environments

When a visitor uploads a file through a PHP form, PHP first writes it to a temporary folder, then your script moves it somewhere permanent. The setting that picks that temporary folder is upload_tmp_dir. Older guides tell you to change it with a php.ini, a user.ini or an .htaccess line, but on shared hosting none of those can change it, and the .htaccess route can take your whole site down.

1. How PHP handles an uploaded file

Every upload goes through the same four steps:

So the temporary folder only holds a file for the length of one request. The folder that matters for security, disk space and backups is the permanent one your script chooses in step 3.

2. Why you can't change upload_tmp_dir on shared hosting

PHP settings have different permission levels. Settings such as memory_limit and upload_max_filesize can be changed per folder, which is why a .user.ini file works for them. upload_tmp_dir is a system-level setting (PHP_INI_SYSTEM in the PHP manual). PHP only reads it from the server's main configuration or the PHP-FPM pool that the host manages.

3. What our servers already do

We checked the PHP configuration on our cPanel and DirectAdmin servers on 23 September 2026. upload_tmp_dir is not set, so PHP uses the system temporary folder. Both servers run CloudLinux with CageFS, which gives every account its own private /tmp. Other accounts on the server cannot see or read your temporary upload files, which was the main reason older guides suggested moving them.

We have not measured the Webuzo server for this setting. If you host on Webuzo and need to know, ask support.

To see what your site uses, upload a small test file, open it in your browser once, then delete it:

<?php
// check-tmp.php: delete this file after you have read the output
echo 'upload_tmp_dir: ', var_export(ini_get('upload_tmp_dir'), true), "\n";
echo 'system temp dir: ', sys_get_temp_dir(), "\n";
echo 'file_uploads: ', ini_get('file_uploads'), "\n";
echo 'upload_max_filesize: ', ini_get('upload_max_filesize'), "\n";

An empty upload_tmp_dir means PHP is using the system temporary folder shown on the next line. On cPanel, a cache in front of the web server can show an old response, so add ?t=1 to the address if you check again after a change.

4. Store uploads in a safe permanent folder

This is the part you control, and it is the part that decides whether uploads are safe.

• Keep the folder outside public_html. For example /home/username/uploads. Files there cannot be opened directly from the web, so an uploaded script cannot be run by a visitor. Serve files to visitors through a PHP script that checks who is asking.
• Check the upload before you move it. Test the error code, the size and the real file type, and give the file a new name. Never trust the file name or type the browser sends.
• Use normal permissions. Folders 755, files 644. Never 777.

A minimal, safe pattern:

<?php
$dir = '/home/username/uploads';            // outside public_html
$allowed = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'application/pdf' => 'pdf'];

$f = $_FILES['document'] ?? null;
if (!$f || $f['error'] !== UPLOAD_ERR_OK) {
    exit('Upload failed, error code ' . ($f['error'] ?? 'none'));
}
if ($f['size'] > 10 * 1024 * 1024) {
    exit('File is larger than 10 MB');
}
$type = (new finfo(FILEINFO_MIME_TYPE))->file($f['tmp_name']);
if (!isset($allowed[$type])) {
    exit('File type not allowed');
}
$name = bin2hex(random_bytes(16)) . '.' . $allowed[$type];
if (!move_uploaded_file($f['tmp_name'], $dir . '/' . $name)) {
    exit('Could not save the file');
}
echo 'Saved';

Replace username with your hosting account username, which is shown in the client area on your hosting service's Manage › Access tab. Create the folder first with the File Manager.

5. Temporary folders in WordPress and frameworks

Applications often have their own temporary folder, separate from PHP's upload folder, and that one you usually can change.

• WordPress uses a temporary folder for plugin and theme updates and for downloads. You can set it in wp-config.php with define('WP_TEMP_DIR', '/home/username/tmp');. This does not change where PHP puts form uploads, and WordPress moves media uploads into wp-content/uploads itself.
• Laravel, Symfony and similar frameworks keep their own cache and temporary files inside the project, such as Laravel's storage folder, and receive uploads through PHP's normal temporary folder.
• Upload plugins and libraries that split large files into chunks usually have a setting for where the chunks are kept. Point it at a folder outside public_html.

6. Fixing upload errors

Most upload problems that look like a "temporary folder" problem are something else. PHP reports the cause in $_FILES['field']['error']:

On Domain India's cPanel server, PHP accepts uploads up to 256 MB by default, and 64 MB on DirectAdmin. The details and how to raise them are in how to change the PHP upload limit. To check disk and file usage, see check hosting resource usage.

7. When you really need a different temporary folder

Some setups genuinely need it, for example very large uploads on a separate disk. That requires changing the server's PHP configuration, which only the server's administrator can do. On shared hosting that is us, and the setting applies to the whole server, so it is not something we change for one account. You can open a ticket to describe your case.

On your own VPS you control PHP completely: set upload_tmp_dir in the main php.ini, or with php_admin_value[upload_tmp_dir] in your PHP-FPM pool, make sure the folder is writable by the PHP user and not inside the website's document root, then reload PHP-FPM.

8. Where Domain India fits

Domain India's cPanel and DirectAdmin shared hosting runs every account inside its own CloudLinux environment, and every shared plan, Webuzo included, offers a choice of PHP versions. Settings such as the upload size and memory limit can be changed per site; server-level settings such as upload_tmp_dir cannot. Prices on the cards below are Domain India list prices and exclude 18% GST.

If your application needs server-level PHP settings, a VPS gives you root access to configure PHP yourself. VPS plans are self-managed.

Frequently asked questions

Ready to set up uploads safely? Create a private folder with the File Manager, check your size limits in how to change the PHP upload limit, or compare cPanel hosting and VPS plans. If an upload still fails, open a support ticket with the error code and the page.