“The Link You Followed Has Expired” in WordPress: How to Fix It

You pick a theme ZIP, click Install Now, wait for the progress bar, and WordPress hands you a blank page with one sentence on it: “The link you followed has expired. Please try again.” There was no link. You just uploaded a file. The “link you followed has expired” error in WordPress is confusing because the message describes a symptom, not the cause, and the real cause is usually a PHP size limit on your server.

The good news: this is one of the easier WordPress errors to fix once you know what it actually means. This guide covers why it happens, how to confirm the cause in two minutes, and the fixes that work, including the one popular “fix” that usually does nothing at all.

What Does “The Link You Followed Has Expired” Mean in WordPress?

“The link you followed has expired” means a WordPress security check called a nonce failed. WordPress attaches a nonce (a short-lived security token) to admin forms like theme uploads, plugin uploads, and settings pages. When the form arrives at the server without a valid nonce, WordPress refuses the action and shows this message instead.

A nonce can be missing or invalid for two very different reasons. Either the token truly expired because the admin page sat open too long, or the token never reached WordPress at all because PHP threw the whole form away. The second reason is far more common, and it’s why this error shows up so often during theme and plugin uploads.

According to the official WordPress Developer Handbook, a nonce has a default lifetime of one day. The WordPress Developer Blog explains that nonces work in 12-hour “ticks,” so the real validity window falls somewhere between 12 and 24 hours depending on when the token was created. That detail matters for one of the fixes below.

Why Does WordPress Say the Link Expired When Uploading a Theme?

WordPress says the link expired during a theme upload because the uploaded file is larger than the PHP post_max_size limit. When a request body exceeds post_max_size, PHP discards the entire form, including the file and the nonce. WordPress then receives an empty form, can’t find the security token, and reports it as an expired link.

This is the part most tutorials gloss over. The error isn’t really about upload size in general. It’s specifically about post_max_size, the PHP setting that caps the size of the entire submitted request. If a file is bigger than upload_max_filesize but still fits inside post_max_size, the nonce survives, and WordPress shows a different, more honest error: “The uploaded file exceeds the upload_max_filesize directive in php.ini.”

Premium themes are the usual trigger. A theme bundle with demo content, bundled plugins, and image assets can easily run 20 MB to 60 MB, while plenty of shared hosting plans still ship with an 8 MB or 16 MB post_max_size default.

The 4 Causes at a Glance

Four causes account for nearly every “link you followed has expired” error in WordPress: an oversized upload, a stale admin page, a cached admin or login page, and a plugin conflict. The table below matches each cause to its tell-tale symptom and the fix to try first.

Cause	Typical symptom	Fix to try first
File larger than post_max_size	Error appears right after uploading a theme or plugin ZIP	Raise post_max_size and upload_max_filesize, or upload via FTP
Expired nonce (stale tab)	Error after submitting a page left open for many hours	Reload the page and submit again
Cached admin or login page	Error on login or forms, often for every user, after adding caching or a CDN	Exclude /wp-admin/ and wp-login.php from cache
Plugin conflict	Error on one specific settings page or action	Deactivate plugins one by one to find the culprit

Step 1: Check Your Current PHP Upload Limits

Checking your current PHP limits takes about two minutes and confirms whether file size is the cause. Go to Tools > Site Health > Info in the WordPress dashboard, open the Server section, and note the values for PHP post max size, upload max filesize, and PHP time limit. Compare post max size with the size of the ZIP you tried to upload.

A quicker partial check: Media > Add New shows “Maximum upload file size” under the uploader. That number is the smaller of the two limits, so it’s a useful sanity check, but the Site Health screen gives the full picture.

If the ZIP is bigger than the post max size value, you’ve found the cause. Move on to Step 2 or Step 3. If the ZIP is comfortably smaller, skip ahead to the stale-tab and caching fixes.

Step 2: The Fastest Workaround, Upload the Theme via FTP

Uploading a theme through FTP or your hosting File Manager bypasses PHP upload limits completely, so the “link you followed has expired” error can’t happen. This is the right move when you need the theme installed now and can’t change server settings yet.

1. Unzip the theme on your computer. Make sure you get the installable theme folder, not the full download package that contains documentation and licensing files.
2. Connect with an FTP client like FileZilla, or open File Manager in cPanel or your host’s dashboard.
3. Upload the theme folder to /wp-content/themes/. For a plugin, use /wp-content/plugins/.
4. Go to Appearance > Themes (or Plugins) in WordPress and activate it.

The FTP workaround fixes today’s upload, but it doesn’t fix the underlying limit. The next large media file or plugin update can still hit the same wall, so it’s worth raising the limits properly as well.

Step 3: Increase post_max_size in WordPress (The Right Way)

To increase post_max_size in WordPress, change it at the server level: in your hosting control panel, in a php.ini or .user.ini file, or in .htaccess on Apache servers that run PHP as a module. Set post_max_size slightly larger than upload_max_filesize, because the full request includes the file plus the rest of the form data.

Sensible values for most sites:

upload_max_filesize = 64M
post_max_size = 128M
max_execution_time = 300
memory_limit = 256M

The PHP manual recommends that memory_limit generally be larger than post_max_size, which is why memory_limit sits at 256M in this example. Raising max_execution_time doesn’t fix the expired-link error by itself, but it prevents large uploads from timing out on slower connections.

Option A: Hosting control panel (best choice)

The hosting control panel is the cleanest place to change PHP limits because the host’s own tooling writes the setting where PHP will actually read it. In cPanel, open MultiPHP INI Editor, select your domain, and edit post_max_size and upload_max_filesize. On CloudLinux hosts, look for Select PHP Version > Options. Managed WordPress hosts usually have a PHP settings screen or will change it through a support ticket.

Option B: php.ini or .user.ini

A php.ini or .user.ini file in the WordPress root folder (the same folder as wp-config.php) works on many shared hosts that run PHP through CGI or PHP-FPM. Add the values from the code block above to the file, save it, and wait a few minutes: .user.ini changes are cached and can take up to five minutes to apply by default.

Option C: .htaccess (Apache with mod_php or LiteSpeed only)

The .htaccess method only works when PHP runs as an Apache module or on LiteSpeed. On servers running PHP-FPM, php_value lines in .htaccess can trigger a WordPress 500 internal server error, so back up the file first and remove the lines immediately if the site breaks.

php_value upload_max_filesize 64M
php_value post_max_size 128M
php_value max_execution_time 300
php_value memory_limit 256M

Why the functions.php fix usually doesn’t work

The functions.php fix usually fails because post_max_size and upload_max_filesize can’t be changed at runtime. Many tutorials suggest adding @ini_set( 'post_max_size', '128M' ); to the theme’s functions.php, but PHP classifies both settings as PHP_INI_PERDIR, which means they can only be set in php.ini, .user.ini, .htaccess, or the server configuration. By the time functions.php runs, PHP has already parsed the request body and thrown it away.

The @ symbol in those snippets also suppresses the warning, so the code fails silently and makes it look like something is happening. Skip it and change the limit where PHP actually reads it. The same logic applies to the broader topic of increasing the WordPress max upload size, which covers each server type in more detail.

After changing the limits, reload Tools > Site Health > Info > Server and confirm the new values appear. If they don’t, the change went into a file PHP isn’t reading, and the hosting support team can tell you which method your server supports.

Step 4: Fix an Expired Nonce From a Stale Admin Tab

If the error appears after submitting a form on an admin page that was open for many hours, the nonce genuinely expired. Reload the page to get a fresh token, then submit again. Because WordPress nonces are only valid for 12 to 24 hours, an admin tab left open overnight will almost always fail this check.

Don’t “fix” stale-tab errors by extending the nonce lifetime with the nonce_life filter. Longer-lived tokens weaken a security feature to save a single page refresh, and the WordPress Developer Blog warns that misusing that filter can break a site. A reload is the correct fix.

Step 5: Stop Caching Admin and Login Pages

A caching plugin or CDN that stores admin or login pages will serve old nonces to every visitor, which causes the “link you followed has expired” error even on fresh page loads. The fix is to exclude /wp-admin/, wp-login.php, and any front-end form pages that use nonces from page caching.

Mainstream caching plugins exclude wp-admin by default, so this problem usually comes from custom rules: a Cloudflare “Cache Everything” rule without a bypass for admin paths, a server-level cache configured by hand, or a custom login URL that the caching plugin doesn’t recognize. If the site uses Cloudflare, check the rules covered in the Cloudflare for WordPress setup guide and make sure admin and login URLs bypass the cache.

Step 6: Rule Out a Plugin Conflict

If the upload limits are fine, the page isn’t stale, and caching is ruled out, a plugin is probably interfering with the form. Security plugins, login customizers, and plugins that modify admin forms are the usual suspects, because they can strip, rename, or re-validate form fields before WordPress checks the nonce.

Test it by deactivating plugins one at a time (or using the Health Check plugin’s troubleshooting mode, which only affects your own session) and repeating the action that failed. The full process is in the guide on finding which WordPress plugin is causing a problem.

What If You See “413 Request Entity Too Large” Instead?

A “413 Request Entity Too Large” error means the web server rejected the upload before PHP ever saw it, so raising PHP limits alone won’t fix it. On Nginx, the setting responsible is client_max_body_size, which defaults to 1 MB and has to be raised in the server configuration, usually by the host.

Both limits need to agree. If client_max_body_size is 64M but post_max_size is 8M, you’ll get the expired-link error. If PHP allows 128M but Nginx allows 1M, you’ll get the 413. Uploads to the Media Library that fail with a vaguer message are covered separately in the guide to the WordPress HTTP error when uploading images.

The Bottom Line

“The link you followed has expired” is almost never about a link. In most cases, a file was bigger than PHP’s post_max_size, PHP dropped the form, and WordPress couldn’t find its security token. Check Site Health first, upload via FTP if you’re in a hurry, then raise post_max_size and upload_max_filesize at the server level, not in functions.php. If file size isn’t the problem, reload the page, check your caching rules, and test for plugin conflicts, in that order.

Frequently Asked Questions