WordPress Are You Sure You Want to Do This
What Is This Error?
When you try to save a post, activate a plugin, or change a setting inside WordPress and you get a dead-end page that just says “Are you sure you want to do this?” — with no button to confirm — WordPress has blocked your action because a security check failed.
WordPress protects every admin action using something called a nonce (short for “number used once”). It’s a short-lived token that gets attached to forms and action links to prove the request is legitimate and came from you. When that token is expired, missing, or doesn’t match what WordPress expects on the server side, you hit this wall.
The reassuring part: this error almost never means your site is hacked or broken. It’s usually a caching issue, a URL mismatch, or a plugin stepping on the nonce system. Most fixes take under five minutes.
Get free WordPress & AI tips
Join 500+ readers. No spam, unsubscribe anytime.
Why Does This Happen?
- Stale nonce served from cache: Caching plugins snapshot pages — including the nonces embedded in them. WordPress nonces expire after 24 hours, so a cached page served later will carry a dead token that fails verification.
- WordPress URL misconfiguration: Nonces are generated using your site’s URL. If your WordPress Address and Site Address don’t match exactly — especially after a domain change or migration — every nonce check can fail.
- Plugin or theme conflict: A plugin may be hooking into WordPress’s nonce or authentication functions incorrectly, causing verification to return false even when the token itself is valid.
- Security plugin blocking the request: Firewall-style security plugins sometimes intercept nonce-related requests and kill them before WordPress can process them, treating them as suspicious traffic.
- Blocked or missing cookies: Nonces are tied to the current user session via cookies. If the browser, a privacy extension, or your server config is blocking cookies, the session can’t be verified and nonce checks fail.
How to Fix It — Step by Step
- Clear all caches immediately. Go to your caching plugin dashboard (WP Super Cache, W3 Total Cache, LiteSpeed Cache, etc.) and flush the entire cache. Then clear your browser cache with Ctrl+Shift+Delete (Windows) or Cmd+Shift+Delete (Mac). If you’re on managed hosting, also flush the server-level cache from your hosting panel. Retry the action that triggered the error.
You should see: The action completes successfully without the error page appearing.
- Deactivate your caching plugin temporarily. If clearing didn’t help, go to Plugins → Installed Plugins and deactivate your caching plugin entirely. Try your action again to rule out the cache as the ongoing problem.
You should see: The error disappears, confirming the cache plugin needs reconfiguring to exclude admin URLs.
- Verify your WordPress URL settings. Go to Settings → General. Make sure WordPress Address (URL) and Site Address (URL) are both set to the same URL — same protocol (http vs https), same www or no-www. Fix any inconsistency and click Save Changes.
You should see: Both fields display the same URL, such as https://yourdomain.com, and nonce errors stop.
- If you’re locked out of Settings, fix it via wp-config.php. Connect to your server via FTP or your hosting file manager, open wp-config.php, and add these two lines just above the line that says
/* That's all, stop editing! */:define( 'WP_HOME', 'https://yourdomain.com' ); define( 'WP_SITEURL', 'https://yourdomain.com' );You should see: Admin access is restored and the nonce error no longer appears on those actions.
- Find a plugin conflict by deactivating all plugins. Go to Plugins → Installed Plugins, select all, and bulk-deactivate. Retry the failing action. If it works, reactivate plugins one at a time, testing after each until the error returns — that last plugin you activated is your culprit.
You should see: The action succeeds with everything off, then fails again only when the conflicting plugin is re-enabled.
- Regenerate your .htaccess file. Via FTP, rename your root .htaccess file to .htaccess_old. Then in WordPress go to Settings → Permalinks and click Save Changes — WordPress will write a clean, fresh .htaccess automatically.
You should see: A new .htaccess file in your root folder, and the error resolves if a corrupted file was the cause.
Common Mistakes When Fixing This
- Retrying the action without clearing cache first: Clicking the back button and trying again just re-submits the same stale nonce. The error will loop. Always clear caches before retrying — you need a fresh token, not the same expired one.
- Turning off the security plugin and leaving it off: Users disable their firewall plugin to stop the interference and forget to turn it back on. Instead, configure the plugin to whitelist WordPress admin nonce requests — don’t leave your site unprotected as a permanent fix.
- Editing wp-config.php without a backup: A single typo — wrong quote character, missing semicolon — can make your entire site return a fatal error. Download the file before editing so you can restore it in seconds if something goes wrong.
- Assuming this is a sign of a hack: The phrasing sounds ominous, but this error is WordPress’s own security system doing its job. It’s blocking an unverifiable request, not reporting an intrusion. Chasing a security threat wastes time when the real fix is usually a cache clear.
Frequently Asked Questions
Is this error a sign my site has been hacked?
Almost certainly not. This error means WordPress’s built-in nonce verification couldn’t confirm the legitimacy of your own request — usually because a token expired in cache or a URL changed. It’s the security system working correctly, not evidence of an external attack.
Why did this start happening right after I migrated my site?
Migrations commonly change the domain, protocol (http to https), or URL structure. Because nonces are generated using your site URL and validated against the active user’s session cookies, any URL mismatch introduced during the move will break nonce checks. Updating your WordPress Address and Site Address in Settings → General — or defining them in wp-config.php — is the fastest fix.
Can this error appear on my site’s front end, not just the admin area?
Yes. If you have front-end forms that use WordPress nonces — WooCommerce checkout pages, membership login forms, AJAX-powered contact forms — and those pages are being served from a full-page cache, visitors will hit the same expired-nonce problem. The fix is to configure your caching plugin to never cache those specific pages.
Do I need a developer to resolve this?
In the vast majority of cases, no. Clearing caches, correcting URL settings, and identifying a plugin conflict are all tasks any site owner can handle without writing code. You’d only need developer help for unusual situations like custom authentication setups, server-level caching configurations, or deeply nested plugin conflicts that require reading source code to untangle.