EDIT: I have completely rewritten this question because it has been closed as off-topic. In my opinion, it has two very relevant points that could help other developers but, in its original form, these points are not too clear. Therefore, I have cut out all of the background information that I now know to be irrelevant to the solution. I have also edited my answer so it is complete (previously, some of the answer was in an update to the question).

I am developing a plugin that creates a custom post type (CPT). My CPT uses a meta box for custom metadata. I create a nonce in the function that displays the meta box. The function that saves the custom metadata and checks the nonce (via check_admin_referer) is invoked by the save_post hook. When I try to add a post of my CPT I am getting "The link you followed has expired" whenever I click on Add New.

  • sorry, but there is no such thing as expired links or child post types in wordpress. You should revert your changes from a backup and ask for guidance from the authors of the plugins and theme you use. – Mark Kaplun Apr 28 '18 at 6:40
  • @MarkKaplun, please reread my question. I said nothing about child post types. I mentioned a "child post" (i.e. one that has a parent) which is a thing in WordPress for hierarchical post types. I also said that I am developing the plugin, so I cannot ask the author. I also said I am using a standard theme with only minor amendments and adding a post of my CPT worked with those amendments in place. Please also search for ""The link you followed has expired" WordPress". When I do I see 656 results. I am not the only to have this problem. Most suggest deactivating all other plugins, which I tried – GeeC Apr 29 '18 at 11:14
  • oh I knew they changed that text, didn't imagine it was changed so badly :(. Anyway, if your issue is with nonce verfification, maybe it will be a good idea to ask about that and remove all the non relevant verbage – Mark Kaplun Apr 29 '18 at 14:19
  • @MarkKaplun, I have rewritten the question and answer. Please reconsider the relevance of this question. – GeeC Jul 24 '18 at 2:21

The "The link you followed has expired" message is in the function wp_nonce_ays on line 2607 of wp-includes/functions.php. Apparently, the message was changed from "Are you sure you want to do this?" in 4.9.5. The wp_nonce_ays function is called by check_admin_referer if the nonce check fails. This is the only place in the Wordpress code where this message is used. Therefore, if you ever see this message, you know that a nonce check is failing somewhere in your code.

When saving custom metadata, use the post_updated hook , rather than the save_post hook. For some reason, the save_post hook is invoked when a create post page is shown (i.e. before anything is saved). At this point the nonce has not been created, so the nonce check fails.

Not the answer you're looking for? Browse other questions tagged or ask your own question.