You click “Install Now” on a theme you’ve just uploaded, or press Save on a settings screen, and instead of a success message WordPress shows a white page with a single sentence. On older WordPress versions it asked “Are you sure you want to do this?” with a “Please try again” link beneath. Current versions word it as “The link you followed has expired.”, again with “Please try again.” underneath.
Both are the same check failing. People still search for the older wording, partly because many plugins and tutorials quote it, so this post uses both. The good news: this is rarely a sign of damage. It’s WordPress declining to carry out an action because it couldn’t confirm the request was genuine.
What WordPress is checking: nonces
WordPress protects actions like deleting a post, installing a plugin or saving settings with a short security token called a nonce. When the form or link is created, WordPress attaches a token tied to your user account, your login session and that particular action. When you submit, WordPress checks the token. If it’s missing, too old, or belongs to a different session or action, WordPress refuses and shows the message, with a 403 status behind the scenes.
This protects you against a trick where another website makes your logged-in browser perform an action on your site without you knowing. It’s a good thing to have. The trouble is that a few ordinary situations make the token fail too.
A token is valid for a limited window, by default up to a day, and it’s tied to your current login. That explains most of the causes below.
Where it shows up is a strong hint
Before trying fixes, note the exact moment the message appears. Three patterns cover most cases:
- Only when uploading a ZIP through Appearance → Themes → Add New Theme → Upload Theme, or Plugins → Add New Plugin → Upload Plugin. That points strongly at the size limit.
- Only after a screen has been open a long time, or after you’ve been logging in and out. That points at an expired token or a changed session.
- On one particular button or link, every time, including for other admins. That points at a plugin, the theme, or a cached page.
Write down which one fits. It decides where in the list below you should begin.
Why it happens, most common first
1. The upload was larger than PHP allows
This is the cause behind most reports, especially when installing a theme or plugin from a ZIP file. PHP has two limits, upload_max_filesize and post_max_size. If the file you send is bigger than post_max_size, PHP throws away the whole form submission, nonce included. WordPress then receives a request with no token and answers with the expired-link message, even though the real problem is file size.
Premium themes bundled with demo content and plugins are often larger than a basic hosting plan allows. You can see your current limit under Media → Add New, where WordPress prints “Maximum upload file size” with a number. If your ZIP is bigger than that, you’ve likely found the cause. Our post on raising the WordPress upload size limit safely covers the methods in detail.
2. The page sat open too long
You opened an edit screen yesterday, left the tab open, and pressed Save today. The token has aged out. Reloading the page creates a fresh one.
3. You logged out, or logged in again elsewhere
Because the token is tied to your session, logging out in another tab, having your session end, or a security plugin forcing a fresh login makes the token on an already-open page invalid.
4. A cached page served an old token
Page caching is meant for public pages. If any cache layer, whether a plugin, the server or a CDN, saves a copy of a page that contains a nonce, such as a front-end form, a “delete my account” link or a custom checkout step, every visitor gets the same stale token. After a while they all start failing. This is a well-known source of front-end form problems, and it shows up in our guide to contact forms that stop working as well.
5. A plugin or theme bug
Some plugins create a nonce for one action name and check it against another, or forget to send it with a background request. The result is the message on one specific button, every time, for every user. It often appears right after a plugin update.
6. Cookie and address mismatches
If the site is reachable at both www and non-www, or at both http and https, you can end up logged in on one version while the form posts to another. The session cookie doesn’t match, so the token check fails. This usually goes along with odd login behaviour.
Fixes, from simplest to most involved
The first three fixes don’t change anything on the server. From step four onwards you’re changing settings or files, so before that point take a backup of the site and keep a note of any value you edit, so it can be put back exactly as it was.
Step 1: Go back, reload, try again
Use the browser’s back button, refresh the original screen so it gets a new token, and repeat the action. If it works, the token had simply expired. No further action needed.
Step 2: Log out fully and log back in
Close other admin tabs, log out, clear cookies for your domain, and log in again. Then try the action once, in a single tab.
Step 3: Compare the file size with the limit
If you were uploading a theme or plugin, check the ZIP’s size against the “Maximum upload file size” on the Media screen. If the file is bigger, don’t keep retrying; the result won’t change.
Step 4: Install the theme or plugin another way
You can avoid the upload limit entirely. Extract the ZIP locally first, then copy the extracted folder over FTP or your host’s file manager into wp-content/themes/ (for a theme) or wp-content/plugins/ (for a plugin). It then appears in the dashboard, ready to activate. Check first that a folder with the same name isn’t already there; if it is, you’ll meet the problem described in our post on “Destination folder already exists” and other install errors. Our older guide on installing a WordPress plugin covers the normal route too.
Step 5: Raise PHP’s upload limits
If you upload large files often, ask your host to raise upload_max_filesize and post_max_size, or change them in the hosting panel’s PHP settings if it has them. post_max_size should be at least as large as upload_max_filesize. Some hosts accept these settings in a .user.ini or php.ini file in the site root, but methods vary, so check with them first.
Step 6: Find a misbehaving plugin
If the message appears on the same button every time, regardless of file size, a plugin or the theme is the likely source. On a staging copy if you have one, deactivate plugins one at a time and repeat the action. Switching briefly to a default theme such as Twenty Twenty-Five tests whether the theme is involved. When the message stops, you’ve found it. Report the problem to that plugin’s developer with the exact steps, and look for an update.
Step 7: Exclude dynamic pages from caching
If the problem is on the front end, for visitors, look at your caching setup. Pages with forms that use nonces, account pages and checkout pages should normally be excluded from page caching. Most caching plugins have an exclusion list, and WooCommerce’s own pages are usually excluded automatically by well-known caching plugins. Purge the cache after changing the rules.
Step 8: Settle on one site address
Make sure both addresses under Settings → General match the version visitors use, and that the others redirect to it. This keeps cookies consistent and stops sessions splitting across versions.
When it might not be harmless
Occasionally the message appears because something is trying to make your browser perform admin actions without you, and the nonce check is doing its job. If you see the message after clicking a link in an unexpected email, or on actions you didn’t try to perform, don’t click “try again”. Check your users and recent changes. If you suspect more, our article on the signs that a website has been hacked is a sensible next read.
Preventing it
- Reload long-open admin screens before saving important changes.
- Know your upload limit before buying a large theme package, and ask the host to raise it in advance if needed.
- Keep pages with forms and account features out of page cache.
- Update plugins in small batches so that if a button starts failing, you know which update to look at.
When to ask for help
If the message keeps appearing on a single action and you’ve ruled out size and session, it is usually a code issue in a plugin or theme, and locating it on a live site can be slow and disruptive. Our WordPress errors overview covers the related upload and install problems.
When one plugin seems to be clashing with another or with your theme, our plugin conflict fix service is the right match. Tell us which button triggers the message and roughly when it started, and we’ll reproduce it on a copy before changing your live site.
Next in this series: WordPress HTTP Error When Uploading Images: How to Fix It
