Auf dieser Seite: [ausblenden]
Laden Sie eine hoch 12 MB-Theme zu einer Standard-PHP-Installation hinzufügen und WordPress teilt Ihnen mit, dass der Link, dem Sie gefolgt sind, abgelaufen ist. Nichts ist abgelaufen. Die Zip-Datei war größer als die von PHP 8 MB-Standard für eine Formularübermittlung. PHP threw the whole request away before WordPress saw it, and WordPress printed the only error it had left. That mismatch between the message and the cause is why theme uploads eat whole afternoons.
Schnelle Antwort: Read the second sentence of the error, nicht der erste. “The link you followed has expired” is a size limit in disguise. “The package could not be installed” is a headline with five different causes behind it, and the most common one is uploading the ThemeForest “All files & Dokumentation” download instead of the smaller theme zip inside it. If you can’t raise your server limits, copy the theme folder into wp-content / themen over SFTP. The uploader is optional. The folder is not.
Zuletzt überprüft: September 2026. Error strings were read from the WordPress core source on 8 September 2026, and checked against WordPress 7.1.
Where These Answers Came From
Every error message quoted here was read out of the WordPress source rather than copied from another guide. The files are wp-admin/update.php, wp-admin/includes/class-theme-upgrader.php, class-wp-upgrader.php und class-file-upload-upgrader.php, Plus wp-includes/capabilities.php for the permission rules and wp-includes/default-constants.php for the memory defaults. Reading the source matters here. Several of these messages are printed by code that runs before WordPress knows anything about your file. The wording describes the check that failed, not the problem you have.
PHP’s own defaults and the scope of each setting came from the PHP manual. That’s also where the rule about .user.ini files running only under CGI and FastCGI is documented. The nginx request-size default came from the nginx directive reference, and the per-plan upload ceilings from Cloudflare’s cache documentation. Host limits came from each host’s own support pages, not from roundups. Plugin version and install data came from the WordPress.org plugin API. The WordPress.com plan history came from archived copies of Automattic’s own support page.
Two limits on all this are worth stating plainly. We did not reproduce each failure on each host, so the host ceilings below are the published numbers rather than numbers we measured. And a WAF block depends on which rule set your host runs. That section shows you how to identify the block rather than promising a specific rule ID.
Read the Second Sentence First
WordPress runs your zip through a chain of checks. Each link in the chain prints its own message, and the messages are more precise than they look once you know which check produced them. Here’s the map.
- “The link you followed has expired.” Your zip is bigger than post_max_size. Nothing to do with sessions or cookies.
- “The uploaded file exceeds the upload_max_filesize directive in php.ini.” Exactly what it says, and the one honest message in the set.
- “Only .zip archives may be uploaded.” The filename doesn’t end in .zip. WordPress checks the name, not the contents.
- “Incompatible Archive.” The name ends in .zip but the file isn’t a working zip. Usually a truncated download.
- “The package could not be installed. The theme is missing the style.css stylesheet.” The zip’s contents aren’t laid out the way WordPress expects.
- “The package could not be installed. The style.css stylesheet does not contain a valid theme header.” There’s a style.css, but no Theme Name line in it.
- “Template is missing. Standalone themes need to have a templates/index.html or index.php template file.” A child theme with no Template header, or a partial theme.
- “The PHP version on your server is 8.1, however the uploaded theme requires 8.2.” Your own numbers will differ. Your PHP is too old for this theme.
- “Destination folder already exists.” That theme folder is already there.
- “Could not access filesystem.” or a form asking for FTP details. A file ownership mismatch, not a permissions problem.
- “Could not create directory.” WordPress reached the themes folder but couldn’t make a new one. Check your disk quota first.
- 413 Request Entity Too Large in the browser. Something in front of PHP rejected the upload.
- 403 verboten with no WordPress styling. A firewall rule killed the request.
- No Upload Theme button at all. A capability rule, not an error.
Work down that list and you skip most of the guesswork. The rest of this guide takes each one in turn.
“The Link You Followed Has Expired” Is a Size Limit Wearing a Costume
This one reads like a session problem, so that’s where people go looking. They clear cookies, log out and back in, disable caching plugins, and none of it helps. The chain that produces it is short and worth knowing.
PHP’s post_max_size directive caps the size of an entire form submission, and the shipped default is 8 MB. When a submission goes over that cap, PHP does not truncate it or raise an upload error. The PHP manual is blunt about what happens instead: das $_POST und $_FILES superglobals are empty. Your file is gone before any PHP code runs.
WordPress then does what it always does on the theme upload route. It checks your permission, then calls check_admin_referer to validate the security token that the upload form put in the POST body. That token was in the body PHP just discarded. The check fails, and WordPress prints what it prints for every failed token: the link you followed has expired. The upload code a few lines further down never runs at all.
Which of the two size errors you get depends on where your file lands between the two limits. On stock PHP settings, a theme between 2 MB and 8 MB trips upload_max_filesize and gets you the honest message that names it. Go above 8 MB and you blow past post_max_size, which produces the expired-link message instead. The clearer error shows up on the smaller files, which is exactly backwards from what you’d want.
So the diagnostic is simple. Check your theme zip’s size on disk. If it’s above 8 MB and you haven’t changed your PHP settings, that’s your answer, and no amount of cookie clearing will move it. Raise the two size limits oder skip the uploader entirely.
One wrinkle catches people who already raised upload_max_filesize and got the same error again. WordPress calculates the number it shows you as the untere von upload_max_filesize und post_max_size, but the failure above is triggered by post_max_size allein. Raise only one and you can end up with a dashboard that advertises a 64 MB limit while PHP still bins anything over 8 MB. Raise both, and keep post_max_size the larger of the two.
“The Package Could Not Be Installed” Is Five Failures Sharing One Headline
Here’s the part most guides get wrong. They treat this as a single error with a single fix. Das ist es nicht. WordPress uses that sentence as a generic label, then appends the real reason. The second sentence is the one that tells you what to do. Five separate checks can produce it, and they run in this order.
1. No style.css in the right place
After unpacking, WordPress looks at the top level of your zip. If there’s exactly one item there and it’s a folder, WordPress treats that folder’s contents as the theme. It then requires a style.css directly inside it. If the top level holds several items instead, WordPress uses the zip root as the theme folder, finds no style.css there, und stoppt.
That’s the mechanism behind the ThemeForest version of this error, which Envato documents on a help page of its own. Envato spells out the trigger. ThemeForest offers two downloads: “All files & Dokumentation” und “Installable WordPress file only”. Envato’s instruction is to upload only the installable theme zip, the one named after the theme. The full download carries documentation, license certificates, demo content and often a child theme alongside the theme. Its root holds many items, and none of them is style.css. Unzip the big download, find the theme zip inside it, upload that.
The same error hits people who build their own zip by selecting the files inside a theme folder and compressing those. That puts style.css at the zip root with a dozen siblings. Compress the folder itself, not what’s in it.
2. style.css exists but has no theme header
Here the message changes to say the stylesheet does not contain a valid theme header. WordPress reads style.css looking for a Themenname: line in the comment block at the top, and refuses the package if it’s absent. This shows up two ways. A tool stripped the header comment when someone saved the file, or the zip holds a stylesheet from something that was never a theme.
3. No template file
The message says Template is missing. A standalone theme has to contain either index.php (Klassiker) oder templates/index.html (Block). A child theme is exempt, but only if its style.css carries a Vorlage: line naming its parent. Child themes distributed without that line fail here, and so do incomplete uploads where the archive lost files.
4. PHP too old
You get the current version and the required one in the same sentence, which makes this the easiest of the five to act on. WordPress reads the theme’s Erfordert PHP header and compares it to what your server runs. The fix is on your host’s side, nicht in WordPress, and it takes about a minute in most control panels. Unser Leitfaden zu Fixierung der “WordPress requires a new PHP version” Warnung shows where that dropdown lives on each panel, and what to check first.
5. WordPress too old
Same shape, different header. The theme declares Requires at least and your install is below it. WordPress aktualisieren, then upload again.
There’s a sixth variant that reads “The package contains no files.” That means the archive unpacked to nothing, which in practice means a corrupt download.
“Only .zip Archives” und “Incompatible Archive.” Are Different Problems
These two look interchangeable and aren’t. The first is a filename check, and it’s stricter than people expect. WordPress lowercases your filename and tests whether it ends in .zip. That’s the whole test. A .rar or .tar.gz gets rejected here, and so does a file your operating system helpfully renamed to theme.zip.download. Nothing has been examined at this point except the name.
The second message means the name passed and the contents didn’t. Schon seit WordPress 6.4.4, freigegeben 9 April 2024, core validates the archive before unpacking it. A file that isn’t a working zip gets caught early and cleanly. The usual cause is an interrupted download. Redownload the theme, compare the file size against what the vendor lists, and try again.
One word on renaming, because that advice circulates and it doesn’t work. Changing a .rar extension to .zip gets you past the first check and straight into the second. RAR and ZIP are different formats. You need the actual zip, or an archive tool to repackage the contents.
“Destination Folder Already Exists” Usually Means You’re Updating
WordPress won’t overwrite a theme folder without asking. Wenn wp-content/themes/yourtheme is already there, the install stops with this message. In current versions you don’t just get the error, obwohl. WordPress shows a screen headed “This theme is already installed”, comparing the installed and uploaded copies side by side. It lists theme name, Ausführung, Autor, required WordPress version, required PHP version and parent theme, then offers to replace the current copy.
Take that comparison seriously before clicking through. If the uploaded version is untere than the installed one, WordPress warns you and tells you to back up first. That’s the screen that catches people who grabbed an old zip out of their downloads folder instead of the current release.
If you see the bare error with no comparison screen, the folder exists but WordPress couldn’t read enough of your upload to compare. Delete the old theme folder over SFTP first, then upload again. Don’t delete the theme you’re currently running while it’s active, obwohl. Switch to a default theme first. Unser Leitfaden zum Thema changing a WordPress theme safely covers what breaks when you do that.
There’s No Upload Theme Button At All
This isn’t an error, so there’s nothing to search for, which is why it wastes so much time. Three rules can hide the button, only one of them negotiable, and a fourth thing hides it that isn’t a rule at all.
Multisite. On a network install, core denies the theme upload capability to anyone who isn’t a Super Admin. Nicht “hides it by default”, nicht “your host turned it off”. A regular site administrator on a multisite network cannot upload a theme, and no plugin or role editor changes that cleanly. Themes get installed once at the network level and then enabled per site. If you’re a site admin, your network admin has to do it.
DISALLOW_FILE_MODS. One line in wp-config.php switches off all plugin and theme installing and updating from the admin. It removes the button rather than showing a message. Managed hosts set it routinely, and so do agencies locking down client sites. Search wp-config.php for it. If you own the server, removing the line restores the button. If you’re on managed hosting, that constant is usually there on purpose and your host will want to know why you’re changing it.
Your user role. Only administrators get the capability. If you’re an editor, that’s the answer.
There’s a fourth case that looks identical and isn’t. Core marks the Upload Theme button as JavaScript-only, and the upload form behind it is hidden in CSS until JavaScript reveals it. So when your admin JavaScript breaks, both vanish together and nothing on the screen mentions permissions. The tell is a notice reading “The Theme Installer screen requires JavaScript”, which WordPress shows only when JavaScript isn’t running. See that and your permissions are fine. Track down the plugin conflict or the blocked script, oder nur install the theme by hand and deal with the JavaScript later.
WordPress.com is its own case, and the rule changed recently enough that most guides still have it wrong. WordPress.com opened custom theme uploads to its Personal and Premium plans between 15 November and 12 Dezember 2025. Archived copies of its support page bracket the change. Auf 15 November the page still said “Business and Commerce plans, and the legacy Pro plan”. Durch 12 December it listed all four paid plans. If someone told you the Business plan is the minimum for a theme zip, that advice is roughly a year stale. Acting on it is expensive. Personal costs USD 4/month against Business at USD 25/month, so the wrong advice bills you US Dollar 252 extra per year. Free sites still can’t upload themes. There’s also a hard 50 MB cap on the theme zip there, separate from anything PHP does.
WordPress Asks for FTP Credentials Instead of Installing
You click install and WordPress asks for a hostname, Benutzername und Passwort. This is the symptom most likely to attract genuinely dangerous advice, so here’s what’s actually happening.
Before touching anything, WordPress writes a temporary file into wp-Inhalt. It then compares two owners: the owner of that new file, and the owner of the WordPress PHP files already on disk. If they match, WordPress concludes it can safely write files itself and gets on with it. If they don’t match, or the write fails outright, WordPress asks you for FTP or SSH details instead. It wants to act as a user it trusts.
Lesen Sie das noch einmal, because the consequence matters. The default trigger is an ownership mismatch, not a permissions problem. Making the folder world-writable does not make the owners match. It only makes your theme directory writable by every other account on the server. On shared hosting that’s a real exposure, and on any server it’s a bad trade. Never chmod 777 a WordPress directory to get past this prompt.
Three fixes work, in this order of preference.
- Ask your host to fix ownership so the web server user owns the files. It’s a two-minute job for them and the right answer on a properly configured server.
- Hinzufügen definieren(‘FS_METHOD’, ‘direct’); to wp-config.php. That tells WordPress to write directly and skip the ownership test. It only helps if the directory is actually writable.
- Enter the FTP credentials. Inelegant, but the prompt does work.
If none of those appeal, install the theme by hand and the question disappears.
Raising the Limits Yourself, and What You Can’t Raise
PHP ships with upload_max_filesize at 2M, post_max_size at 8M und memory_limit at 128M. Most hosts raise these, but plenty of budget shared plans don’t raise them much. Four settings matter for theme uploads, and where you can change them depends on how PHP runs on your server.
The method that works on most modern hosting is a .user.ini file in your WordPress root, next to wp-config.php. PHP reads it when it runs under CGI or FastCGI, and that includes PHP-FPM (FastCGI-Prozessmanager, the way most control panels run PHP now). If your host uses PHP-FPM, this is your file. Four lines:
- upload_max_filesize = 64M
- post_max_size = 64M
- memory_limit = 256M
- max_execution_time = 300
That last line matters on slow connections. A large upload that takes longer than PHP allows gets killed mid-transfer, and you get a blank page rather than a message. Now the part that makes people give up on the file and go edit something else. PHP caches these files, und the default cache is 300 Sekunden. Speicher die Datei, wait five minutes, then reload the theme upload screen. WordPress shows the current maximum on the media library upload page if you want to confirm the new number took effect.
The alternative is .htaccess mit php_value upload_max_filesize 64M and friends. This works when PHP runs as an Apache module, and it works on LiteSpeed, which is what a lot of cPanel hosts run. It does not work on Apache with PHP-FPM, and the failure there is nasty. Apache doesn’t recognize php_value without mod_php, the older module that ran PHP inside Apache itself. An unrecognized directive in .htaccess makes Apache return a 500, so you’ve taken down every page on the site, not just the upload. If you try this route, keep the original .htaccess open in another tab so you can put it back.
Some settings you cannot change from your account at all, whatever any tutorial says. PHP classifies file_uploads und upload_tmp_dir as system-level, so they’re settable only in the main php.ini. If uploads are switched off server-wide, or the temp directory is broken and you’re seeing “Missing a temporary folder”, that is a support ticket. upload_max_filesize und post_max_size are per-directory settings, which is exactly why the .user.ini and .htaccess methods reach them.
Memory has a similar catch. Hinzufügen definieren(‘WP_MEMORY_LIMIT’, '256M'); to wp-config.php is standard advice, and it does nothing if your host locked the memory limit at server level. WordPress raises memory by calling PHP’s own function, and PHP refuses. WordPress checks whether the value is changeable before it tries. Wenn nicht, your define is ignored silently.
Published ceilings differ more than people expect, and knowing your host’s number tells you whether to bother. WP Engine sets 50 MB standardmäßig und 1 MB on multisite. It will raise that to 256 MB on request, and wants SFTP or SSH beyond it. Kinsta launches sites at 128 MB. SiteGround sets 256 MB and doesn’t move it on shared plans. Hostinger exposes the value directly in hPanel under PHP Configuration. If your plan’s ceiling is too low for the themes you work with and support won’t budge, that’s a hosting problem, kein WordPress. Unser Shared-Hosting-Vergleich lists what the cheaper plans actually allow.
When the Upload Never Reaches PHP
Every fix above assumes your file gets to PHP. Sometimes it doesn’t, and then PHP settings are irrelevant no matter how high you set them. Two layers sit in front, and each has a distinctive fingerprint.
413 Request Entity Too Large. On nginx this comes from client_max_body_size, and nginx’s documented default is 1 MB. That’s smaller than PHP’s own default, and smaller than most premium theme zips. The setting lives in the server config, so on managed nginx hosting it’s a support request. On your own server, raise it in the server block and reload. Cloudflare returns the same status code from its own ceiling. That ceiling is 100 MB on Free and Pro, 200 MB on Business, und bis zu 5 GB on Enterprise. Cloudflare’s limit only bites on very large files. Seeing a 413 auf einen 20 MB theme behind Cloudflare? Nginx is the likelier culprit. You can test which by pausing Cloudflare briefly and retrying.
403 Forbidden with no WordPress styling. That’s a web application firewall. ModSecurity and Imunify360 inspect the request body, and a zip full of PHP files trips rules written to catch uploaded malware. It’s a known false positive on WordPress admin actions, and CloudLinux publishes a support article on WAF rules blocking site updates and admin access. You can’t fix this from inside WordPress. Ask your host to check the WAF log for the timestamp of your upload and whitelist the rule that fired. If your host gives you an Imunify dashboard, the blocked request appears under Incidents with a control to disable that rule.
Here’s a quick way to tell these apart from a PHP problem. A WAF or proxy block gives you a bare server error page, with no admin bar and no styling. A PHP limit gives you a WordPress-styled error page. If the page still looks like WordPress, the request got through.
Installing Without the Uploader
The dashboard uploader is a convenience, not a requirement. WordPress finds themes by scanning a directory, so putting the folder there by any means works identically. When you’ve spent twenty minutes on limits, switch to one of these and move on. (There’s no prize for making the uploader work.)
Over SFTP or a File Manager. Unzip the theme on your computer. You should end up with a single folder containing style.css at its top level. Upload that folder into wp-content / themen. Reload Appearance > Themes and it’s there, ready to activate. This bypasses every PHP limit, every WAF rule and the FTP credentials prompt in one move, because nothing is being posted through the web server. Most control panel file managers will also let you upload the zip and extract it in place, which is faster over a slow connection.
Mit WP-CLI. If you have SSH, wp theme install ../my-theme.zip installs from a local file, and adding –aktivieren Sie switches to it immediately. There’s also –force to overwrite an existing copy, which is the command-line equivalent of the “already installed” Bildschirm. If a theme is blocked by a version header you’re confident about, –ignore-requirements installs it anyway. Be careful with that last one. The author set that header because they expect the theme to break on older PHP.
One caution for both routes. Uploading by hand puts a theme on the site without any of core’s validation. A theme missing style.css simply won’t appear in the theme list, with no error to explain why. If the folder is there and WordPress doesn’t show it, open style.css and check the Theme Name header.
Which Fix to Try First
Ordering matters more than the individual fixes, because two minutes of checking saves an hour of editing config files. Arbeiten Sie diese der Reihe nach durch.
- Check the zip’s file size. Unter 8 MB and failing? Skip ahead, it’s not a limit. Über 8 MB with an “expired link” Error? That’s your answer.
- Check the zip’s contents. Open it. One folder at the top, style.css inside it, means the package is fine. Anything else, especially a documentation folder, means you have the wrong download.
- Read the second sentence. Das map above takes you straight to the cause.
- Try a small theme. Install Twenty Twenty-Five, the current default, straight from the theme directory. If that works, your uploader and permissions are fine, and the problem is your file or its size. If it fails too, the problem is server-wide.
- Look at the error page. WordPress styling means PHP ran. Eine nackte 403 oder 413 means it didn’t.
- Only then, edit config files. Start with .user.ini, wait the full five minutes, and confirm the new limit before changing anything else.
If you’re troubleshooting under time pressure on a live site, invert that order and just SFTP the folder into place. Get the site working, then work out why the uploader failed when nobody’s waiting.
A word on the tool most guides send you to at this point. Gesundheitscheck & Troubleshooting is still recommended everywhere for isolating plugin conflicts, and it still has 200,000 aktive Installationen. But its last WordPress.org release was version 1.7.1 auf 25 Juli 2024, tested only up to WordPress 6.6.7. Running a two-year-old diagnostic plugin against WordPress 7.1 to debug an upload is a strange way to reduce your variables. Rename the plugins folder over SFTP instead: it’s faster, it’s reversible, and it doesn’t add code to the install you’re trying to diagnose.
Häufig gestellte Fragen
Why does WordPress say “the link you followed has expired” when I upload a theme?
Because your theme zip is bigger than PHP’s post_max_size Rahmen, which defaults to 8 MB. PHP discards the whole submission when it goes over that cap, including the security token WordPress checks first. WordPress sees a missing token and prints its standard expired-link message. Erheben post_max_size und upload_max_filesize together, or install the theme over SFTP.
How big can a WordPress theme zip file be?
WordPress itself imposes no limit. Your ceiling is the lower of your host’s upload_max_filesize und post_max_size, and anything nginx or Cloudflare enforces in front of them. Published defaults range widely: WP Engine sets 50 MB, Kinsta 128 MB, SiteGround 256 MB, and stock PHP just 2 MB. WordPress.com caps theme zips at 50 MB regardless of plan.
Why is there no Upload Theme button in my WordPress dashboard?
Three likely reasons. You’re on a multisite network and aren’t a Super Admin, in which case core blocks it and only your network admin can install themes. Or wp-config.php contains DISALLOW_FILE_MODS, which most managed hosts set deliberately. Or your account isn’t an administrator. None of these produce an error message, which is why the button just isn’t there.
Do I need the Business plan to upload a custom theme on WordPress.com?
Nicht mehr. WordPress.com restricted custom theme uploads to Business, Commerce and the legacy Pro plan until late 2025. Its support page listed Personal and Premium too by 12 Dezember 2025. Free sites still can’t upload themes. If a guide tells you to buy the Business plan purely to install a theme zip, check the current plan page before you pay.
Can I install a WordPress theme without the dashboard uploader?
Ja, and it’s often faster. Unzip the theme, then copy the folder into wp-content / themen over SFTP or with your host’s file manager. WordPress detects it on the next page load. With SSH access, wp theme install ../my-theme.zip –aktivieren Sie does the same in one command. Both routes bypass PHP upload limits, firewall rules and the FTP credentials prompt.
Is it safe to set the themes folder to 777 to fix an upload error?
Nein, and it usually doesn’t even fix it. When WordPress asks for FTP credentials, the trigger is an ownership mismatch. The owner of newly created files differs from the owner of your WordPress files. Permissions aren’t the issue. Setting 777 makes the directory writable by every account on the server without changing ownership at all. Ask your host to correct file ownership, or add definieren(‘FS_METHOD’, ‘direct’); to wp-config.php.
Which hosts let me raise the upload limit myself, and which make me ask support?
Hosts with a PHP settings panel let you change it directly. Hostinger exposes it in hPanel under PHP Configuration, and most cPanel hosts put it in MultiPHP INI Editor. Managed hosts generally don’t. WP Engine needs a support request to go above its 50 MB default, zu einem 256 MB maximum. SiteGround won’t raise its 256 MB ceiling on shared plans at all. On any host running PHP-FPM you can also try a .user.ini file yourself before contacting anyone.
Fazit
Theme upload failures feel random because the error messages describe the check that failed rather than the mistake you made. They’re not random. A zip over 8 MB gets you a message about expired links. A ThemeForest full download gets you a message about a missing stylesheet. A multisite site admin gets no button and no explanation at all. Match the symptom to the cause using the list near the top of this page, and most of these resolve in a couple of minutes.
When they don’t, stop fighting the uploader. Copying a theme folder into wp-content / themen over SFTP works on every host, needs no config changes, and takes less time than a support ticket. Keep the uploader for the days it cooperates.
Installing the theme is rarely the last step, so here are the guides for what usually comes next. Fixing WordPress login crashes is the one to read if a new theme locked you out of wp-admin. Und “briefly unavailable for scheduled maintenance” explains the file a failed install sometimes leaves behind. And if you’re replacing an existing theme rather than adding one, read our guide to changing a WordPress theme safely, oben verlinkt. It covers what breaks at activation and how to roll back.