How to Fix “The Link You Followed Has Expired” in WordPress

Quick fix: note where the message appears. During Plugins/Themes → Add New → Upload, it usually means the ZIP exceeded a PHP request limit. After clicking an admin link such as delete, activate or save, reload the original admin screen and try again—the action’s security token may have expired.

Do not increase every PHP limit blindly. Diagnose upload limits and admin-action nonces separately.

Case 1: The error appears while uploading a ZIP

Check the ZIP size, then find the server’s effective values for:

upload_max_filesize
post_max_size
memory_limit
max_execution_time
max_input_time

Use Tools → Site Health → Info → Server or the hosting PHP settings page. post_max_size must be larger than the complete HTTP request, so set it above upload_max_filesize, not equal to a ZIP’s exact size.

Example for a 32 MB theme package:

upload_max_filesize = 64M
post_max_size = 80M
memory_limit = 256M
max_execution_time = 120
max_input_time = 120

These are examples, not universal recommendations. Choose the smallest values that support the legitimate upload and workload.

Change limits at the effective server layer

Use the method supported by your host:

• hosting control panel PHP options;
• php.ini for a server you administer;
• .user.ini on supported PHP-FPM setups;
• host support on managed plans.

Restart or reload PHP-FPM when your server requires it. Then recheck Site Health; editing a file is not proof that PHP loaded the new values.

Avoid adding ini_set() calls to the active theme’s functions.php. The upload can be rejected before theme code runs, and the change disappears when themes switch.

PHP documents upload_max_filesize and post_max_size as separate request limits. A reverse proxy or web server can impose an additional body-size limit, so a correct PHP configuration may still reject the request before it reaches WordPress.

Use SFTP or WP-CLI as a controlled alternative

For a trusted plugin ZIP, extract it locally and upload the plugin directory to:

wp-content/plugins/plugin-slug

Then activate it in wp-admin. For a theme, use:

wp-content/themes/theme-slug

With WP-CLI:

wp plugin install /path/to/plugin.zip --activate
wp theme install /path/to/theme.zip

Confirm file ownership after upload. Never use an unofficial mirror to work around a vendor download problem.

Case 2: The error appears after an admin action

WordPress protects state-changing actions with a time-limited nonce. If a tab remained open, a cached admin page supplied an old action URL, or authentication changed, WordPress can reject it.

Try:

1. return to the original wp-admin list/editor;
2. reload the page to generate a fresh action URL;
3. save or click the action once;
4. sign out and back in if the session is old;
5. clear cookies for the site if authentication is inconsistent.

Do not bookmark or email nonce-bearing admin action URLs.

Stop caching wp-admin and logged-in actions

Page caches and CDNs should bypass:

/wp-admin/*
/wp-login.php

and avoid caching authenticated responses. Purge the offending cache after correcting its rules. A cache plugin can also optimize/minify admin requests incorrectly; test its safe mode or disable only that feature on staging.

If the message affects logins or returns you to the login screen, use the WordPress login redirect loop guide.

Check server time and plugin conflicts

Large time drift can invalidate time-based security checks. Ask the server administrator to verify time synchronization rather than changing the WordPress timezone to compensate.

If one plugin action always fails with a fresh page, inspect its logs and temporarily test without security/cache integrations on staging. The plugin may be generating or verifying the nonce incorrectly.

Verify the fix

Repeat the original action with a fresh session. For uploads, confirm the plugin/theme installed completely and review logs for timeouts or partial extraction. For admin actions, verify that caches no longer store authenticated pages.

Return temporary PHP limits to policy-compliant values if they were raised only for one import. If the log shows memory exhaustion rather than request size, continue with How to Increase the WordPress Memory Limit.