EDIT: I have completely rewritten this question because it has been closed as off-topic. In my opinion, it has two very relevant points that could help other developers but, in its original form, these points are not too clear. Therefore, I have cut out all of the background information that I now know to be irrelevant to the solution. I have also edited my answer so it is complete (previously, some of the answer was in an update to the question).
I am developing a plugin that creates a custom post type (CPT). My CPT uses a meta box for custom metadata. I create a nonce in the function that displays the meta box. The function that saves the custom metadata and checks the nonce (via check_admin_referer) is invoked by the save_post hook. When I try to add a post of my CPT I am getting “The link you followed has expired” whenever I click on Add New.
1 Answer
The “The link you followed has expired” message is in the function wp_nonce_ays on line 2607 of wp-includes/functions.php. Apparently, the message was changed from “Are you sure you want to do this?” in 4.9.5. The wp_nonce_ays function is called by check_admin_referer if the nonce check fails. This is the only place in the WordPress code where this message is used. Therefore, if you ever see this message, you know that a nonce check is failing somewhere in your code.
When saving custom metadata, use the post_updated hook , rather than the save_post hook. For some reason, the save_post hook is invoked when a create post page is shown (i.e. before anything is saved). At this point the nonce has not been created, so the nonce check fails.
