---
title: "How to fix \"Are you sure you want to do this?\" in WordPress"
url: https://wpministry.co/errors/are-you-sure-you-want-to-do-this/
description: "WordPress shows this when a request lacks a valid security token: a page left open too long, an upload larger than the server accepts, or a plugin in the way."
lang: en-US
---

Skip to content

# How to fix "Are you sure you want to do this?" in WordPress

WordPress shows this when a request arrives without a valid security token. Current versions word it "The link you followed has expired." The usual causes are a page left open too long, an upload larger than the server accepts, and a plugin that interferes with the tokens.

By

WP Ministry

Published

October 6, 2026

Tested on

WordPress 7.1.4, PHP 8.3.36

## In short

- It is a safety check, not damage. WordPress refused one request and changed nothing.
- Current WordPress words the same check "The link you followed has expired."
- If it happened once, go back, reload the page and try again.
- If it happens when you upload a plugin or theme, the file is larger than the server accepts.

"Are you sure you want to do this?" is what older versions of WordPress said when a request reached the dashboard without a valid security token. Current versions run the same check and word it differently: a plain page that says "The link you followed has expired.", usually with a link that says "Please try again."

Every form and action link in the dashboard carries a token, which WordPress calls a nonce. It shows that the request came from a page WordPress built for you, in the session you are logged in to, and not from a link someone tricked you into opening. When the token is missing, out of date or made for another session, WordPress stops and shows this message.

Nothing has been changed or deleted. The one thing that did not happen is the action you asked for.

## Find out which cause you have

- It happened once, on a page that had been open for hours, or after you logged in again in another tab. The token ran out: use the first fix.
- It happens when you upload a plugin, a theme or an import file. The file is too large: use the second fix.
- It happens on many screens, whenever you save or follow an action link. A plugin or the theme is interfering: use the last fix.

## Where it goes wrong

A page request passes through each of these in turn. This one comes from **WordPress itself**.

1. Browser
2. DNS
3. HTTPS
4. CDN or firewall
5. Web server
6. PHP
7. WordPress (this error comes from here)
8. Database and files

## What causes it

- ### The page was open too long, or you logged in again somewhere else
  Common
  Each form and action link carries a token that lasts between 12 and 24 hours and belongs to one login session. A tab left open overnight, or opened before you logged out and in again, holds tokens WordPress no longer accepts.
  Fix: Go back, reload the page and try again
- ### The upload is larger than the server accepts
  Common
  When a form sends more data than PHP's post_max_size setting allows, PHP discards the whole form, token included. WordPress sees a request with no token.
  Fix: Raise PHP's upload limits in .htaccess, or Raise the limits through your host
- ### A plugin or the theme interferes with the tokens
  Sometimes
  Code that changes how long tokens last, or how a form is put together, makes WordPress refuse requests on screens that have nothing to do with that plugin.
  Fix: Find the plugin that interferes

## How to fix it

### Go back, reload the page and try again

- Easy
- No risk
- About 2 minutes
1. #### Step 1: Go back to the page you came from
   Use the "Please try again." link, or your browser's Back button. If you had typed something into a form and can still see it, copy it somewhere safe before the next step.
2. #### Step 2: Reload that page
   Reloading makes WordPress build the page again with fresh tokens. If it sends you to the login screen instead, log in.
3. #### Step 3: Repeat the action
   Paste your text back if you need to, and save.

If the message returns on a page you have only just reloaded, the token's age is not the problem. Go on to the fixes below.

### Raise PHP's upload limits in .htaccess

- Takes care
- Back up first
- About 10 minutes
- Steps tested on WordPress 7.1.4

PHP has two limits that matter here. `upload_max_filesize` is the largest single file it accepts. `post_max_size` is the largest form it accepts, files included. A file over the first limit but under the second gets a clear answer: "The uploaded file exceeds the upload_max_filesize directive in php.ini." A file over the second does not. PHP discards the whole form, and WordPress reports a missing token.

This fix applies to sites on Apache where PHP runs as part of the web server. Where PHP runs another way, the lines below are skipped and nothing changes: the next fix is the one to use.

1. #### Step 1: Check the limit
   Go to Media, then Add Media File. Under the upload box WordPress shows "Maximum upload file size:" and a figure, which is the smaller of the two limits. If your file is larger than that, the limits are your cause.
2. #### Step 2: Download a copy of .htaccess
   It is in the site's main folder, beside `wp-config.php`. Its name begins with a dot, so turn on "Show hidden files" in your file manager if you cannot see it.
3. #### Step 3: Add these lines at the top of the file
   Put them above the line `# BEGIN WordPress`. Choose a figure larger than the file you need to upload, and never set `post_max_size` lower than `upload_max_filesize`.
   The first and last lines tell a server that runs PHP another way to skip the settings instead of failing on them.
   .htaccess Copy

   ```
   <IfModule mod_php.c>
   php_value upload_max_filesize 64M
   php_value post_max_size 64M
   </IfModule>
   ```

4. #### Step 4: Reload Media, then Add Media File
   If the figure has gone up, upload your file again.

If the figure has not changed, your server does not take PHP settings from `.htaccess`. Remove the lines and use the next fix. If the site shows a 500 error (https://wpministry.co/errors/500-internal-server-error/) after you save, your host does not allow these settings in `.htaccess`: put your copy of the file back.

**To undo it:** Remove the four lines from .htaccess.

### Raise the limits through your host

- Easy
- Low risk
- About 15 minutes
1. #### Step 1: Look for PHP settings in your hosting panel
   Many panels have a page where you can change PHP's settings for a site. Set `upload_max_filesize` and `post_max_size` to a figure larger than your file.
2. #### Step 2: Or add a .user.ini file
   Where PHP runs as FastCGI, it reads settings from a file named `.user.ini` in the site's main folder. Create the file with these two lines. By default PHP looks at the file again every five minutes, so allow that long before you check the figure under Media, then Add Media File.
   .user.ini Copy

   ```
   upload_max_filesize = 64M
   post_max_size = 64M
   ```

3. #### Step 3: Or ask your host's support
   Tell them the size of the file, and ask them to raise both limits above it.
4. #### Step 4: Or leave the upload form out of it
   Unzip the plugin or theme on your computer and upload its folder over SFTP, into `wp-content/plugins/` or `wp-content/themes/`. It then appears in the dashboard, ready to activate. PHP's limits do not apply to files that arrive this way.

### Find the plugin that interferes

- Takes care
- Low risk
- About 20 minutes
- Steps tested on WordPress 7.1.4

First, tell two cases apart. If the message appears on one plugin's own screen and nowhere else, that plugin sent a form WordPress could not accept. Update it. If that changes nothing, report it to its developer, because no setting of yours will fix it.

If the message appears across the dashboard, something is interfering with every token. The way to find it is to switch plugins off.

1. #### Step 1: Switch every plugin off
   Go to Plugins, then Installed Plugins. Tick the box at the top of the list, choose Deactivate from the "Bulk actions" menu and press Apply. Plugins keep their settings while they are off.
2. #### Step 2: If that shows the message too
   Switching plugins off is itself a request that needs a token. In your host's file manager or over SFTP, open `wp-content/plugins/` and rename a plugin's folder, for example by adding `-off` to its name. WordPress can no longer find that plugin and stops running it. Begin with the one you installed or updated most recently.
3. #### Step 3: Reload the page and repeat the action that failed
   If it works now, a plugin was the cause.
4. #### Step 4: Switch the plugins back on one at a time
   Repeat the action after each one. The plugin that brings the message back is the one at fault. Leave it off, and look for an update or a replacement.

With WP-CLI, switch every plugin off:

bash

```
wp plugin deactivate --all
```

Then bring them back one at a time by folder name, repeating the action after each:

bash

```
wp plugin activate plugin-folder-name
```

If the message is still there with every plugin off, the theme is next. Switch to a default theme, as described for the white screen of death (https://wpministry.co/errors/white-screen-of-death/).

**To undo it:** Switch the plugins back on.

## When to get help

If the message appears across the dashboard with every plugin off and a default theme active, something outside WordPress is changing requests before they arrive, such as a cache or a firewall on the server or in front of it. Finding it takes access to the server's configuration.

## Common questions

Has my site been hacked?

No. The message is WordPress refusing a request it could not vouch for, which is the check doing its job. It exists so that a link on another website cannot make your browser delete a post or change a setting while you are logged in.

Why does WordPress ask "Do you really want to log out?"

It is the same check. A log-out link carries a token too. If you follow one without a valid token, such as a bookmarked link or one typed into a menu by hand, WordPress shows "You are attempting to log out of" with your site's name, and asks "Do you really want to log out?" Follow the link in that question and you are logged out.

Visitors see the message on a form on my site. Why?

A page cache can keep a copy of a page for longer than its tokens last. Every visitor then receives a form whose token has run out. Keep pages that hold forms out of the cache, or have the cache refresh them more often than every 12 hours.

Is this the same as a 403 Forbidden error?

Not quite. WordPress sends this page with the status 403, but the page is WordPress's own and the fixes are the ones above. A "Forbidden" page that comes from the web server is a different problem: see how to fix 403 Forbidden (https://wpministry.co/errors/403-forbidden/).

## More on this subject

- WordPress errors and troubleshooting: https://wpministry.co/topics/wordpress-troubleshooting/
- Guide How to update the PHP version of a WordPress site: https://wpministry.co/blog/update-php-version-wordpress/
- Guide WordPress uptime monitoring: what a check sees and what it misses: https://wpministry.co/blog/wordpress-uptime-monitoring/
- Glossary term .htaccess: https://wpministry.co/glossary/htaccess/
- Guide Locked out of WordPress admin: find which lockout you have and get back in: https://wpministry.co/blog/locked-out-of-wordpress-admin/
- Glossary term Must-use plugin (mu-plugin): https://wpministry.co/glossary/must-use-plugin/
- Glossary term Permalink: https://wpministry.co/glossary/permalink/

## Would you rather we fixed it?

Quick Fix is $49. One issue, one site, up to about an hour. No fix, no fee. 30-day warranty.

More about this work: One-time WordPress fix (https://wpministry.co/services/one-time-fix/)

May we measure how this site is used?

A yes notes the pages of this visit and loads Google Analytics. A no keeps and loads nothing. See the cookies page (https://wpministry.co/legal/cookies/).

If you say yes, we note the pages you look at during this visit and load Google Analytics. If you say no, nothing is kept and nothing is loaded. The site works the same either way. The cookies page (https://wpministry.co/legal/cookies/) has the details.

## Structured data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Organization",
      "@id": "https://wpministry.co/#organization",
      "name": "WP Ministry",
      "url": "https://wpministry.co/",
      "logo": "https://wpministry.co/brand/logo.png",
      "address": {
        "@type": "PostalAddress",
        "streetAddress": "1309 Coffeen Ave STE 1200",
        "addressLocality": "Sheridan",
        "addressRegion": "WY",
        "postalCode": "82801",
        "addressCountry": "US"
      },
      "sameAs": [
        "https://www.linkedin.com/company/wp-ministry/",
        "https://x.com/wpministryco",
        "https://www.instagram.com/wpministryco/",
        "https://www.facebook.com/wpministryco",
        "https://www.tiktok.com/@wpministryco",
        "https://www.pinterest.com/wpministryco/",
        "https://www.youtube.com/channel/UCOZRuAukk5QSTRPG6BaHl3Q"
      ]
    },
    {
      "@type": "WebSite",
      "@id": "https://wpministry.co/#website",
      "name": "WP Ministry",
      "url": "https://wpministry.co/",
      "inLanguage": "en-US",
      "publisher": {
        "@id": "https://wpministry.co/#organization"
      }
    },
    {
      "@type": "TechArticle",
      "@id": "https://wpministry.co/errors/are-you-sure-you-want-to-do-this/#article",
      "headline": "How to fix \"Are you sure you want to do this?\" in WordPress",
      "description": "WordPress shows this when a request lacks a valid security token: a page left open too long, an upload larger than the server accepts, or a plugin in the way.",
      "url": "https://wpministry.co/errors/are-you-sure-you-want-to-do-this/",
      "mainEntityOfPage": "https://wpministry.co/errors/are-you-sure-you-want-to-do-this/",
      "inLanguage": "en-US",
      "image": "https://wpministry.co/og/errors/are-you-sure-you-want-to-do-this.png",
      "author": {
        "@id": "https://wpministry.co/#organization"
      },
      "publisher": {
        "@id": "https://wpministry.co/#organization"
      },
      "datePublished": "2026-10-06T00:00:00.000Z",
      "dateModified": "2026-10-06T00:00:00.000Z"
    },
    {
      "@type": "BreadcrumbList",
      "itemListElement": [
        {
          "@type": "ListItem",
          "position": 1,
          "name": "Home",
          "item": "https://wpministry.co/"
        },
        {
          "@type": "ListItem",
          "position": 2,
          "name": "Error fixes",
          "item": "https://wpministry.co/errors/"
        },
        {
          "@type": "ListItem",
          "position": 3,
          "name": "How to fix \"Are you sure you want to do this?\" in WordPress"
        }
      ]
    }
  ]
}
```