Fix “Are You Sure You Want to Do This?” in WordPress

← Back to all WordPress fixes

Introduction

You click a button in wp-admin — save a setting, delete something, install a plugin — and instead of it working, WordPress stops you with a plain, unstyled page that just says: “Are you sure you want to do this?” with a single link to try again. No real explanation, no error code. Here’s what’s actually happening and how to get past it.

What This Message Actually Means

This isn’t a bug — it’s WordPress’s security system doing its job. Every sensitive action in wp-admin (deleting a post, activating a plugin, saving settings) is protected by a nonce — a one-time security token embedded in the page when it loads. If the token attached to your click doesn’t match what WordPress expects, it refuses the action and shows this message instead of silently failing or, worse, letting a forged request through.

Why It Happens

• The page sat open too long. Nonces expire — typically after 12–24 hours. If you left a wp-admin tab open overnight and click something the next day, the token is stale.
• You used the browser’s back button. Going back to a previous page can load a cached version with an old, already-used or expired nonce.
• You have multiple tabs open to the same wp-admin screen, and logged in/out or switched users in one of them.
• A caching plugin cached an admin page that should never be cached, serving everyone the same stale nonce.
• Your session expired in the background while the page was still open.

The Fix: Reload and Try Again

In the vast majority of cases, the fix is simply:

1. Refresh the page (a full reload, not the back button) to get a fresh nonce.
2. Log back in if you’re asked to.
3. Try the action again.

If it happens repeatedly on the same action, try these next:

• Close extra tabs of the same wp-admin screen and work from a single tab.
• Clear your browser cache for the site, in case a stale cached admin page is being served locally.
• Exclude wp-admin from caching if you use a caching plugin — wp-admin pages should never be cached. Most caching plugins do this automatically, but it’s worth checking if you’ve customized the rules.

If It Happens on Every Single Action

If this error appears constantly, even right after logging in, the cause is usually more specific:

• Server time is wrong. Nonces are time-based; if your server’s clock is significantly off, tokens can appear expired the moment they’re generated. Check with your host if this seems likely.
• A security or optimization plugin is stripping cookies or altering headers. Nonces rely on your logged-in cookie matching correctly — deactivate plugins via FTP to isolate the culprit if needed.
• You’re behind a proxy or CDN caching logged-in pages incorrectly — check your CDN’s rules for excluding cookies-based/logged-in traffic from cache.

Frequently Asked Questions

Did I lose any data?
No. This error happens before WordPress processes the action, so nothing was saved, deleted, or changed. It’s safe to just retry.

Is this related to the REST API “Updating Failed” error?
No — that one is about a broken REST API request in the block editor. This one is a nonce (security token) mismatch, a different mechanism, though both can superficially feel similar (“something failed with no clear reason”).

Why does WordPress use nonces at all?
They prevent cross-site request forgery (CSRF) — a malicious site tricking your browser into performing an action on your WordPress site without your knowledge. The trade-off for that protection is the occasional expired-token message.

Can I extend how long nonces last?
Technically yes, via the nonce_life filter, but shortening the security window isn’t something to do lightly — the default lifetime is chosen as a security/convenience balance. For most sites, simply refreshing the page when this happens is a better solution than weakening the protection.

Conclusion

“Are you sure you want to do this?” almost always means one thing: your security token expired because the page sat open too long or was reloaded oddly. A simple refresh and retry fixes it in seconds — and if it keeps happening, the usual suspects are stale caching on wp-admin or a plugin interfering with cookies.