You just clicked a link in your WordPress dashboard, probably a password reset or a plugin install, and boom: «The link you followed has expired.» No explanation, no button, no way forward. If that sounds familiar, you’re not alone.
This error shows up when WordPress thinks the nonce, the security token attached to that URL, is no longer valid. Either too much time passed, or something in your setup is breaking the token.
The fix for the WordPress «The link you followed has expired» error isn’t one-size-fits-all. I’ve seen it triggered by a 10-minute login session, a broken cookie, a cheap hosting plan with PHP cron jobs killing tokens, and even a Safari privacy feature.
So let’s go through what actually works, in order of how likely it is to be the culprit.
Why WordPress Throws the Expired Link Error
Every sensitive action in WordPress, like resetting your password, installing a theme, or saving settings, generates a one-time token called a nonce. That token is tied to a time window (default is 24 hours, but many hosts shorten it) and to your user session.
If the token expires before you use it, WordPress kicks you out with that generic message.
So the expired link error in WordPress is really a session and token problem. That’s why sometimes it goes away on its own after you log in again, and other times it keeps coming back every time you try the same action.
The difference matters: if it’s recurring, something on your site is actively invalidating tokens.
Solution 1: Extend the WordPress Login Session Timeout
If you get the error when trying to log in or reset your password, the session timeout is probably too short. Some hosts set it to 15 minutes, which is ridiculous if you’re doing anything beyond checking the dashboard.
Open your wp-config.php file via FTP (FileZilla works fine) or your hosting file manager, and add this line at the end, before the «That’s all, stop editing» comment:
define(‘WP_SESSION_EXPIRATION’, 7200);
That gives you 2 hours. You can push it to 14400 (4 hours) if you’re working on a long migration. Just don’t go crazy: longer sessions mean a stolen laptop becomes a stolen WordPress admin.
If your site handles payments or user data, keep it under 2 hours.
What if the constant doesn’t work?
Some managed hosts (WP Engine, Kinsta, SiteGround) override this value at the server level. In that case, check your hosting panel for a session timeout setting, or contact support.
Don’t waste hours editing files that the host will ignore.
A corrupted WordPress auth cookie is one of the most common triggers of the «link you followed has expired» error. It usually happens after a WordPress core update, a domain change, or a switch from HTTP to HTTPS.
Go to your browser settings, find «Clear browsing data,» and select cookies plus cached files. In Chrome it’s the three dots menu, then More Tools, then Clear Browsing Data. In Firefox it’s Settings, Privacy, Cookies and Site Data.
Do this specifically for your WordPress domain, not the whole browser, if you don’t want to lose every login you have. Then close all tabs and try the link again in a fresh window.
Solution 3: Deactivate Plugins and Themes to Isolate the Culprit
If clearing cookies didn’t fix the WordPress expired link problem, a plugin is messing with WordPress nonces. Security plugins, caching plugins, and anything that modifies the login page are the usual suspects. Wordfence, iThemes Security, and even some SEO plugins have caused this.
Deactivate all plugins from the WordPress admin (Plugins > Installed Plugins > select all > Bulk Actions > Deactivate). Then try the action that was failing. If it works, reactivate them one at a time until the error comes back. That plugin is your problem.
Same logic applies to themes. Switch to Twenty Twenty-Five for a minute. If the error vanishes, your theme is generating bad nonces or breaking the admin-ajax call.
The sneaky one: caching plugins
Object caching and full-page caching can serve stale nonces. If you’re using Redis or Memcached on your host, flush the cache from the hosting panel. This fixes more expired-link cases than people admit.
Solution 4: Check Browser Settings and Extensions
Some browsers ship with features that block links they consider «expired» for security. Safari’s Intelligent Tracking Prevention and Firefox’s Enhanced Tracking Protection can interfere with WordPress nonces. Try disabling them for your site, or just open the link in a private window.
Also, browser extensions like ad blockers, privacy tools, or script blockers can strip query parameters from URLs. That’s what happens: the nonce is in the URL, the extension removes it, WordPress says the link expired.
Disable extensions one by one or test in an incognito window with extensions off.
Solution 5: Increase the PHP Memory Limit
Weird as it sounds, low memory kills WordPress processes mid-execution, and that can leave nonces half-generated. If your site is throwing 500 errors alongside the expired link message, memory is likely the issue.
Add this to wp-config.php:
define(‘WP_MEMORY_LIMIT’, ‘256M’);
And if your host allows it, also set define(‘WP_MAX_MEMORY_LIMIT’, ‘512M’); for admin tasks like plugin updates. Don’t go above 512M on shared hosting; you’ll hit a hard cap and get a blank screen instead.
Quick Checklist Before You Panic
- Log out completely, clear cookies for the domain, log back in.
- Try the link in an incognito window with no extensions.
- Check if the action works from a different browser or device.
- Deactivate all plugins and switch to a default theme.
- Flush any server-side cache (Redis, Memcached, Varnish).
- Increase session timeout and memory limit in wp-config.php.
- Contact your host if nothing works: they might have a server-side cron or session handler misconfigured.
One more thing nobody mentions: if you’re getting this error on a multisite network, check the wp-config.php for correct COOKIE_DOMAIN and SITECOOKIEPATH values. A mismatch there breaks nonces across the whole network, and it’s a pain to debug if you don’t know where to look.
And honestly, if your host is the kind that limits MySQL queries per hour and kills long processes, no amount of code tweaking will save you. Moving to a decent host fixes the «The link you followed has expired» WordPress error more often than any plugin.
That’s my take, and I’ll defend it: cheap hosting is the root cause of half the nonce headaches people blame on WordPress itself.
