Why does WordPress say 'The link you followed has expired' when I upload a theme or plugin?

The file is larger than the upload limits your host sets for PHP (upload_max_filesize and post_max_size). The server discards the upload before WordPress reads it, and WordPress reports the empty form as an expired link. Media, Add New shows the current maximum upload size.

How do I fix 'The link you followed has expired' in WordPress?

Raise upload_max_filesize and post_max_size above your file's size, and max_execution_time and max_input_time to around 300, in the host's control panel (cPanel MultiPHP INI Editor or Select PHP Version) or in a .user.ini file next to wp-config.php. If the host will not allow it, unzip the theme or plugin and copy its folder into wp-content by file manager or SFTP.

Can I raise the WordPress upload limit in .htaccess?

Only on hosts that run PHP as an Apache module and say so in their help pages. On most hosts php_value lines in .htaccess cause a 500 Internal Server Error for the whole site; remove them and use the control panel or .user.ini instead.

More fixes

WordPress says "The link you followed has expired" when you upload something

You pick a theme or plugin zip, a video or a big PDF, press Install or Upload, and instead of a progress bar you get a white page: "The link you followed has expired. Please try again." Nothing expired. The file is bigger than your host lets one upload be, so the server throws the upload away before WordPress sees it, and WordPress, finding the form arrived empty, falls back to its generic "expired link" message. Raise the host's limit or put the file on the server another way. Below is a rebuilt example (not a real client), then the safe order of steps.

What the owner sees after pressing Install Now

harborstreetbakery.example/wp-admin/update.php?action=upload-theme

What the checks found

First: is it the size, or a page left open too long?

Different things produce the same message, and one look tells them apart.

It happens every time you upload one particular file (a theme or plugin zip, a video, a large PDF or image) and smaller files upload fine: it is the size limit. Go to Media, Add New and read the line under the upload box, "Maximum upload file size: 2 MB" (or 8, 32, 64). If your file is bigger than that number, that is the whole problem.
It happened once, on a settings or editor page you had left open for hours, and the form had nothing large in it: the page's one-time security code really did run out (WordPress's codes last about a day). Reload the page, make the change again and save. Nothing needs fixing.
A visitor sees it on your contact or order form: a caching plugin or host cache is serving an old copy of that page with an old security code inside it. Exclude that page from the cache (every caching plugin has an "exclude these URLs" box) and purge the cache.

The safe order of steps

Back up the files and the database (host's backup tool, or the file manager plus phpMyAdmin export) before changing server settings. Also download a copy of .htaccess and of any php.ini or .user.ini next to wp-config.php.
Raise the limits in the host's control panel first. Four PHP settings decide it, and the first two must both be larger than your file:
```
upload_max_filesize = 64M
post_max_size       = 64M
max_execution_time  = 300
max_input_time      = 300
```
On cPanel hosts this is "MultiPHP INI Editor" or "Select PHP Version", then Options. Many managed hosts have a "PHP settings" page instead. Pick a number a little above your biggest file rather than the largest the box allows. Then reload Media, Add New: the "Maximum upload file size" line should show the new number.
If the panel has no such setting, create a file named .user.ini (or php.ini, whichever your host's help pages name) next to wp-config.php containing the four lines above. These files are re-read on a timer, so allow 5 minutes before testing.
Only on hosts whose help pages say so, the same values can go in .htaccess as php_value upload_max_filesize 64M and so on. On most modern hosts that line is not allowed and the whole site answers "500 Internal Server Error". If that happens, delete exactly the lines you added and the site comes straight back.
If you cannot raise the limit at all (some cheap plans cap it), skip the upload form. Unzip the theme or plugin on your computer and copy its folder into wp-content/themes/ or wp-content/plugins/ with the host's file manager or SFTP, then activate it from the dashboard. For video, upload it to YouTube or Vimeo and paste the link into the page: a big video served from your own site is slow for every visitor anyway.
Test the upload that failed, then the home page, the contact or order form and the login in a private window.

Common causes and what each one needs

What you find	What it means	Usual fix
Theme or plugin zip bigger than "Maximum upload file size"	The upload is over `upload_max_filesize` / `post_max_size`	Raise both in the control panel, or copy the unzipped folder by file manager
Limit already raised, big uploads still fail partway	The upload takes longer than the time limits	Raise `max_execution_time` and `max_input_time`
"413 Request Entity Too Large" instead of the expired message	The web server (often nginx) refuses before PHP is asked	Host raises `client_max_body_size`
Whole site shows "500 Internal Server Error" after an edit	`php_value` lines in `.htaccess` are not allowed on this host	Remove the added lines; use the panel or `.user.ini` instead
Once, after a page sat open for hours	The page's security code expired	Reload and save again
Visitors see it on a front-end form	A cache is serving a stale copy of the form page	Exclude that page from caching, purge

What not to do

Do not install an "increase upload size" plugin from an unknown author. A plugin cannot lift a ceiling the server sets, and abandoned plugins are a common way sites get hacked.
Do not set the limits to huge numbers (2G, unlimited time). It lets one request tie up the server, and on shared hosting the host may suspend the account.
Do not edit .htaccess or wp-config.php without a copy you can put back. One wrong line takes the whole site down, not just the upload.
Do not upload a bought theme's whole download bundle. Marketplace downloads often hold documentation and child themes too; the installable theme zip is usually inside it.

If you can reach the control panel, the steps above are usually enough. If the site broke while you were trying, or you need the new theme or plugin in today, that is what the box below is for. Related: a "critical error on this website" after the upload finally works means the new theme or plugin itself is the problem, and a blank white page is the same thing with the message hidden.