Fixing "The link you followed has expired" in WordPress

"The link you followed has expired. Please try again." is one of WordPress's more confusing error messages, because usually nothing has really expired. You'll typically see it after trying to upload a theme, a plugin or a large media file, and it appears instantly or after a long wait with no explanation.

What's actually happening is that the file you uploaded is bigger than your server allows. When a submission exceeds PHP's post_max_size limit, PHP throws away the whole thing, leaving WordPress with an empty form.¹ That includes the security token (called a nonce) that WordPress attaches to every admin form. WordPress sees a request with no valid token and shows its standard "this link has expired" message.²

Once you know that, the fix is straightforward: raise the limits or get the file onto the server another way.

Rule out a genuinely expired page

Occasionally the message means what it says. WordPress security tokens are valid for between 12 and 24 hours,³ so if you left an admin page open overnight and then submitted it, the token really has expired.

Reload the page and try again. If the problem persists, especially when uploading a theme or plugin, it's a size limit.

Check your current limits

There are four PHP settings involved:

• upload_max_filesize is the maximum size of a single uploaded file. PHP's own default is 2MB.¹
• post_max_size is the maximum size of the whole form submission, including the file. It needs to be larger than upload_max_filesize. PHP's default is 8MB.¹
• max_execution_time is how many seconds a PHP script can run before it's stopped.
• max_input_time is how many seconds PHP will spend receiving the submission. A large file on a slow connection can exceed this.

To see your current values, go to Tools → Site Health → Info and expand the Server section, which lists "Upload max filesize", "PHP post max size", "PHP time limit" and "Max input time". The Media Handling section also shows the effective upload size, and Media → Add New shows "Maximum upload file size" below the upload box.

Compare these with the size of the file you're uploading. Premium themes packaged with demo content can easily be 20MB to 50MB, while many hosts leave the PHP defaults in place.

Raise the limits through your hosting control panel

This is the easiest and safest option, so try it first. Most hosts let you change PHP settings without touching any files.

• cPanel: look for MultiPHP INI Editor or Select PHP Version → Options.
• Plesk: go to your domain and open PHP Settings.
• Managed WordPress hosts often have a PHP settings page in their own dashboard, or will change limits for you if you ask support.

Before you change anything, make a note of the current values so you can set them back. Sensible values for most sites are:

upload_max_filesize = 64M
post_max_size = 64M
max_execution_time = 300
max_input_time = 300

Save, wait a minute, then check Site Health → Info again to confirm the new values have taken effect.

Use php.ini or .user.ini

If your host doesn't offer a control panel option, you can often set the values in a file in your site's root folder (the same folder as wp-config.php).

On most modern hosting, where PHP runs through FastCGI or PHP-FPM, the file is called .user.ini.⁴ Create it if it doesn't exist and add the values above. If it already exists, download a copy before editing it. On some older setups the file is php.ini instead. Your host's documentation will say which one they support.

Changes to .user.ini aren't always picked up straight away. PHP only re-reads these files every five minutes by default,⁴ so wait before deciding it hasn't worked.

Be careful with .htaccess

You'll find plenty of guides suggesting you add lines like php_value upload_max_filesize 64M to .htaccess. This only works when PHP runs as an Apache module,⁵ which is increasingly rare. On servers using PHP-FPM, LiteSpeed or FastCGI, these lines typically cause an immediate 500 internal server error.

That's why it's worth downloading a copy of .htaccess before you touch it. If the site goes down after adding these lines, upload your saved copy (or remove the lines you added) and the site will come straight back. Then use one of the other methods instead.

Don't bother with WP_MEMORY_LIMIT for this

Increasing WP_MEMORY_LIMIT in wp-config.php is a common suggestion, but memory isn't the problem here. It won't change your upload or post size limits, and it won't fix this error.

Other layers with their own limits

If you've raised the PHP limits and uploads still fail, something in front of PHP may have its own limit. These usually give a different error, often "413 Request Entity Too Large", but WordPress sometimes reports them as a generic HTTP error.

• Nginx has a client_max_body_size setting that defaults to 1MB and returns a 413 when a request is larger.⁶ Only your host can change it on shared hosting.
• Cloudflare limits uploads to 100MB on its Free and Pro plans.⁷ Anything larger needs uploading another way.
• Security plugins and firewalls sometimes restrict the size or type of uploaded files.

Our guide to fixing WordPress media upload errors covers permissions, firewalls and other upload problems in more detail.

Upload themes and plugins via SFTP instead

If you can't raise the limits, or you just need to get a large theme installed now, skip the browser upload entirely.

1. Take a backup, especially if you're replacing an existing version of the theme or plugin.
2. Unzip the theme or plugin on your computer.
3. Connect to your site with an SFTP client or your host's file manager.
4. Upload the unzipped folder to wp-content/themes/ for a theme or wp-content/plugins/ for a plugin.
5. Go to Appearance → Themes or Plugins in WordPress and activate it.

If you have WP-CLI access, wp plugin install /path/to/plugin.zip --activate or wp theme install /path/to/theme.zip does the same job from the command line.⁸

Uploading over an existing plugin or theme replaces it without the safety checks WordPress normally runs, so if anything breaks afterwards, our guide to recovering a site broken by an update will help.

For large media files such as videos, consider hosting them on a video platform and embedding them. Large videos served from a WordPress site use a lot of bandwidth and rarely play as smoothly as they would from a dedicated service.

Still seeing the error?

If the limits in Site Health look right but the error persists, your host may be applying a limit you can't see, or a firewall may be rejecting the upload. Send your host the file size and the time you tried, and ask them to check their logs. If you'd rather hand it over, my WordPress development service and emergency WordPress support cover upload problems, server configuration and theme installation.