How to Fix “Are You Sure You Want to Do This?” in WordPress

By ErrorFix · Updated October 22, 2026 · 5 min read

What Are you sure you want to do this means

You clicked Publish, Update, Install, or Save somewhere in the WordPress dashboard, and instead of completing the action you landed on a stark screen asking “Are you sure you want to do this?” with a link to go back. Nothing actually broke yet — WordPress stopped before doing anything. That is by design: it is the same kind of guard that makes your bank ask for confirmation before a transfer.

Behind the scenes, WordPress attaches a hidden, one-time security token — developers call it a nonce — to nearly every action in the admin area: publishing a post, updating a plugin, changing a setting. When your browser sends the request, WordPress checks that the token matches what it issued. If the token is missing, expired, or has been altered in transit, WordPress refuses the request rather than execute something it cannot verify came from you. This screen is simply the refusal notice.

The good news is that in practice the failure is almost always mundane: your login session quietly expired while the editor sat open, your browser's stored cookies for the site went stale or corrupt, or a plugin interfered with the request. True security breaches presenting this way are vanishingly rare. Work through the steps below in order — the first two solve it for the overwhelming majority of people, and each later step is progressively more targeted.

Common causes

• Expired login session: you left the editor or settings page open for a long time, and the security tokens issued when the page loaded have quietly expired. The request then fails verification.
• Corrupt or mismatched browser cookies: WordPress trusts your browser's login cookies to validate the request. Stale or damaged cookies — often after a cookie-clearing tool or browser update — break that trust.
• Overzealous security plugin or firewall: plugins like Wordfence, Sucuri, or iThemes Security sometimes block or strip parts of legitimate admin requests, which makes the security check fail from WordPress's point of view.
• Corrupt .htaccess rules: leftover or malformed rules in the root .htaccess file (often from long-removed plugins) can interfere with how admin form submissions are handled.
• PHP memory or timeout exhaustion: heavier actions such as installing plugins or publishing large posts can run out of PHP memory mid-request, and WordPress reports the aborted request as a failed verification.
• Plugin conflict: a buggy or outdated plugin can hook into admin requests and mangle the security tokens — the classic cause when everything else checks out.

How to fix Are you sure you want to do this — step by step

The whole fix takes about twenty minutes and starts with the two-minute fixes most people never get past — no coding required.

1. Log out of WordPress and log back in. Click your profile menu in the top-right of the admin bar and choose Log Out, then log back in with your username and password. WordPress generates fresh security tokens (called nonces) for every session, and a stale or partially expired session is the single most common reason this message appears. Test the action that failed right after logging back in — for many people this one step ends the problem.
2. Clear your browser cookies and cache for the site. Open your browser settings and delete cookies and cached data for your domain only, then reload the dashboard and try again. Corrupt or mismatched login cookies make WordPress distrust your session, which trips the same security check. As a quick diagnostic, open the site in an incognito or private window and log in there: if the error is gone, your regular browser profile's stored cookies were the culprit.
3. Check your security plugin or firewall. If you run a security plugin such as Wordfence, Sucuri, or iThemes Security, temporarily deactivate it (or switch it to learning mode if it offers one) and test again. Over-aggressive firewall rules and login-hardening features sometimes block legitimate admin requests or strip the tokens WordPress needs, which triggers this exact message. If the error disappears, whitelist your site's admin area in the plugin's settings before turning protection back on.
4. Restore the default .htaccess file. Using FTP or your host's file manager, rename the .htaccess file in the site root to .htaccess-backup, then go to Settings, then Permalinks in the dashboard and click Save Changes — WordPress will generate a fresh default .htaccess. Corrupted or conflicting rules left behind by old plugins can break admin form submissions. If regenerating fixes the error, compare the backup with the new file before restoring anything.
5. Raise the PHP memory limit. Open wp-config.php in the site root and add define('WP_MEMORY_LIMIT', '256M'); just above the line that says ‘That's all, stop editing!’. Operations like publishing large posts, updating plugins, or uploading media can starve PHP of memory, and the request dies mid-flight in a way WordPress reports as a failed security check. Save the file and retry the action that was failing.
6. Deactivate all plugins and reactivate them one by one. If the error survives every step above, connect by FTP, rename the wp-content/plugins folder to plugins-disabled, and create an empty plugins folder — this deactivates everything at once. Try the failing action; if it works, a plugin is guilty. Rename the folder back, then go to Plugins in the dashboard and reactivate each plugin one at a time, testing after each, until the error returns. Replace or leave deactivated the last plugin you turned on.

Did this fix it? Quick checklist

• You can publish, update, and install without the verification screen appearing
• The action completes and the change is visible (post published, plugin installed, setting saved)
• No new warnings appeared in the dashboard after clearing cookies or editing files
• You restored your security plugin to full protection (with the admin area whitelisted if needed) once testing was done

A word of caution before you edit server files: download a copy of .htaccess and wp-config.php to your computer first. A single typo in either file can white-screen your entire site, and having the originals on hand turns a disaster into a two-minute restore. Also, if your site is on managed WordPress hosting, check the host's dashboard first — many managed hosts offer staging, PHP settings, and file managers built in, which is far safer than hand-editing files over FTP.