; speedtest_worker.js defaults xhr_ul_blob_megabytes to 20.
; PHP's stock post_max_size = 8M rejects those upload chunks before
; empty.php can send its headers. 32M leaves modest headroom.

post_max_size = 32M

; LibreSpeed does not use the session upload progress feature, and PHP's advisory
; for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) names it as a way to reach the
; vulnerable code path, recommending it be off if it is not needed. Updating PHP is
; the real fix; this only removes a feature nobody here uses.
session.upload_progress.enabled = 0