How to Fix “The Link You Followed Has Expired” in WordPress

This error shows up during uploads, saving large menus, or admin actions. It's a general protection message, not proof a link is actually old. What you were doing when it appeared tells you where to look.

1. If It Happens During a ZIP Upload

Your theme or plugin ZIP is bigger than the server allows. Check the limit under Media → Add New or Tools → Site Health → Info → Server.

Ask your host to raise these in php.ini:

upload_max_filesize = 64M
post_max_size = 64M

post_max_size must be equal to or larger than upload_max_filesize. If it's smaller, uploads fail silently and throw this error.

If the ZIP contains another ZIP or a large documentation folder, extract it locally first. Upload only the installable file.

2. If It Happens While Saving Settings or Menus

Your security token (nonce) expired. This usually means:

• The page sat open too long in a stale tab
• Your session expired
• Browser cookies are corrupted

Log out. Clear cookies for the site. Log back in and retry from a fresh admin page. Don't reuse old tabs.

3. If It Happens on a Cached Site

The dashboard, login page, previews, and logged-in REST requests must never be served from a public page cache. If they are, the form you submit carries an old nonce.

Exclude these from your caching plugin, host cache, and CDN:

/wp-admin/
/wp-login.php
/?preview=true

Purge caches after fixing the exclusions.

4. If It Happens Saving a Large Menu or Form

PHP has an input-variable limit. Large menus and complex forms exceed it, and the request gets truncated before WordPress sees it.

Ask your host to raise:

max_input_vars = 5000

The default is often 1000. Don't raise it higher than the site actually needs.

You can also reduce the number of fields in the menu or form, or split it into smaller sections.

If None of These Work

On staging, disable all plugins. Retry the action. If it works, reactivate plugins one at a time. Security and role-management plugins are the usual suspects.

Check their logs for blocked requests before adding an exception.

Test the Fix

Repeat the exact action that failed. Then test a normal post update. If both work, the error is fixed.

Don't raise every PHP limit without evidence. That hides the real cause — usually an oversized package, a broken form, or a stale session.