Free tools Windows power users keep installed
One-click scans. No signup required.
WordPress nonces are hash-based request tokens that help prevent cross-site request forgery (CSRF) when a form, URL, AJAX call, or REST request changes data. Create a token for a specific action, verify it in the same context, and still run capability checks and input validation. A valid nonce proves that WordPress generated the request context; it does not prove that the requester is authenticated or allowed to perform the operation.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The practical rule is simple: use wp_nonce_field() in forms, wp_nonce_url() in nonce-protected links, check_ajax_referer() for AJAX, and the wp_rest action with the X-WP-Nonce header for cookie-authenticated REST requests.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What a WordPress nonce does
Despite the name, a WordPress nonce is not strictly a number and is not a one-time password. The WordPress Developer Resources handbook describes it as a hash-based value used to help protect URLs and forms from misuse. Its job is to indicate that a request came from a page or script that WordPress generated for a particular action.
That makes a nonce a CSRF-mitigation control. It is only one part of a secure state-changing operation. The handler must also determine whether the current user can perform the action and whether every submitted value is valid and correctly sanitized.
#1 Best Overall
- Nonce: checks the request context and action.
- Authentication: establishes who the requester is, such as through a WordPress login cookie.
- Authorization: checks whether that user may change the target resource, normally with
current_user_can(). - Input validation: confirms that IDs, strings, dates, and other values have the expected type, range, and meaning.
Never use a nonce as a substitute for authentication, authorization, or access control. The official developer documentation states this explicitly.
Start with a specific action string
Every nonce should describe the operation and, where appropriate, the object being changed. A context-rich action such as delete-comment_123 is safer to reason about than a generic action such as update. The same exact action string must be supplied when the token is verified.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhy specificity matters
An action string separates one operation from another. A token created for deleting comment 123 should not be accepted by code that edits a different object or performs an unrelated operation. Include a stable resource identifier when the operation targets one record, and keep the action vocabulary consistent across creation and verification.
Create a reusable action value
$action = 'delete-comment_123';
$nonce = wp_create_nonce( $action );Using a variable for the action reduces mismatches between the code that creates the token and the code that checks it. Do not silently fall back to a broad action name just because it is shorter.
Choose the creation function for the request context
| Context | Create the token with | Verify with |
|---|---|---|
| WordPress admin form | wp_nonce_field( 'my-action_123' ) |
check_admin_referer( 'my-action_123' ) |
| Nonce-protected URL | wp_nonce_url( $url, 'my-action_123' ) |
check_admin_referer( 'my-action_123' ) |
| AJAX request | wp_create_nonce( 'my-action_123' ) |
check_ajax_referer( 'my-action_123' ) |
| Custom verification flow | wp_create_nonce( 'my-action_123' ) |
wp_verify_nonce( $value, 'my-action_123' ) |
| REST API with cookie authentication | wp_create_nonce( 'wp_rest' ) |
Send the value in X-WP-Nonce or _wpnonce; WordPress performs REST cookie checking |
The table is a context choice, not a security ranking. Use the verifier that matches how the request reaches your handler so failures have the behavior you expect.
Protect an admin form with wp_nonce_field()
1. Print the hidden field
Place wp_nonce_field() inside the form that performs the state-changing operation:
<?php
wp_nonce_field( 'delete-comment_123' );
?>WordPress prints the hidden nonce field that the submitted form will carry back to the server. The action string in this call must exactly match the action used by the handler.
2. Verify before changing data
<?php
check_admin_referer( 'delete-comment_123' );
// Check the submitted values, check the required capability,
// then perform the deletion.
?>Call the verifier before the operation. If verification fails, stop processing rather than continuing with the deletion or update. A successful check still does not establish that the user may delete the specific comment; perform a separate current_user_can() check and validate the submitted resource identifier.
Use the same pattern for admin links
When an administrative action is triggered by a URL instead of a form, wrap the destination with wp_nonce_url():
<?php
$url = wp_nonce_url( $url, 'delete-comment_123' );
?>The receiving admin handler verifies the action with check_admin_referer( 'delete-comment_123' ) before changing anything. Keep destructive actions behind an explicit capability check even when the URL contains a valid nonce.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Verify an AJAX request safely
Generate a token for the JavaScript request
Create a nonce with wp_create_nonce() and make it available to the script through the page data or another server-generated value. Use the action that identifies the operation, for example:
<?php
$nonce = wp_create_nonce( 'delete-comment_123' );
?>The client must send that value with the AJAX request in the field or request location expected by the handler. Do not invent a second action name in the JavaScript code.
Use check_ajax_referer() in the handler
<?php
check_ajax_referer( 'delete-comment_123' );
// Validate request data, check the required capability,
// and only then change the target resource.
?>With its default settings, check_ajax_referer() terminates the request when the nonce is missing or invalid. That is appropriate when the endpoint should not continue at all after a failed CSRF check.
Understand the return value
When the check succeeds, check_ajax_referer() returns:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →1when the nonce was generated 0–12 hours ago.2when it was generated 12–24 hours ago.
The value is useful when your application needs to distinguish the two valid age windows. It is not a replacement for the capability check and does not make the token single-use.
Use wp_verify_nonce() when you need custom failure handling
<?php
if ( ! wp_verify_nonce( $value, 'delete-comment_123' ) ) {
// Return the application-specific error response and stop.
}
// Continue only after capability and input checks succeed.
?>wp_verify_nonce() lets your code decide how to format a failure response instead of relying on the default termination behavior. Treat a false result as a hard stop for the state-changing operation.
Send a nonce to the WordPress REST API
For REST requests made inside a logged-in WordPress session, use the special action wp_rest:
<?php
$nonce = wp_create_nonce( 'wp_rest' );
?>Send the header on every manual request
Include the generated value in the X-WP-Nonce header for each manual REST request that relies on cookie authentication:
fetch( endpoint, {
headers: {
'X-WP-Nonce': nonce
}
} );The same token may be sent as _wpnonce instead. The REST API uses the wp_rest action, and WordPress handles the cookie check through rest_cookie_check_errors().
What happens when the token is missing
If a cookie-authenticated REST request does not include the required nonce, WordPress treats the request as unauthenticated. A request can therefore have a valid login cookie and still fail to establish the authenticated REST context when the nonce is absent.
Do not confuse REST nonces with API credentials
REST cookie authentication is intended for requests made within the WordPress login session. Application passwords are a separate authentication option available since WordPress 5.6; they are not a different spelling of the wp_rest nonce and should be evaluated as a separate authentication mechanism.
Rank #4
Nonce lifetime, ticks, and session changes
The default window is variable
WordPress Developer Resources describes the default nonce lifetime as one day, but implementation uses two half-life ticks. In practice, a nonce is normally valid for a variable period between 12 and 24 hours, depending on when it was generated relative to the tick boundary. Do not describe the default as an exact 24-hour guarantee.
Nonces are not single-use
The word “nonce” can suggest a token that becomes invalid after one request. WordPress nonces do not work that way. A valid value may be accepted during its validity window, so a nonce cannot by itself prevent replay or serve as a transaction identifier.
Account for login and logout changes
Nonces are tied to the current user session. If a user logs in or out asynchronously, a page may still contain values generated for the previous session. Those already-rendered nonces can become invalid even though the page itself is still open. Refresh or regenerate the token after the session state changes instead of assuming the old page data remains usable.
Handle logged-out visitors deliberately
For visitors who are not logged in, WordPress defaults the nonce user ID to 0. That shared default is not sufficient for a critical guest action that needs to distinguish one visitor from another. The developer documentation identifies the nonce_user_logged_out filter as the mechanism for adding an application-specific session value for logged-out users.
Use that extra session mechanism for important guest workflows, and still validate the request and constrain what an unauthenticated visitor is allowed to do.
Nonce versus capability: the check sequence
A secure state-changing handler should make the checks in an intentional order:
- Verify the nonce for the exact action. Reject the request when it is missing, invalid, or outside the valid window.
- Check the current user’s capability. Use
current_user_can()with the capability and, where applicable, the target resource context. - Validate and sanitize every input. Confirm IDs, action values, and other fields are the expected type and refer to an allowed resource.
- Perform the change. Only reach the write, delete, or other side effect after the preceding checks pass.
Reversing these steps can expose information or perform work for a request that should have been rejected. In particular, a nonce does not show that the requester owns the target object or has permission to modify it.
Best Value
Choosing the right verifier
| Request type | Recommended creation | Recommended verification | Failure behavior to expect |
|---|---|---|---|
| Admin form | wp_nonce_field() |
check_admin_referer() |
Stop the admin request when verification fails |
| Admin URL | wp_nonce_url() |
check_admin_referer() |
Stop the admin request before the action runs |
| AJAX | wp_create_nonce() |
check_ajax_referer() |
Default behavior terminates a failed request; successful checks return 1 or 2 |
| Custom handler | wp_create_nonce() |
wp_verify_nonce() |
Your code supplies the failure response and stops the operation |
| REST with login cookies | wp_create_nonce( 'wp_rest' ) |
X-WP-Nonce or _wpnonce |
Without the token, WordPress treats the request as unauthenticated |
Regardless of the row, the operation still needs a capability decision and input validation. The context-specific functions do not remove those requirements.
Troubleshoot common nonce failures
The form works until the user logs in or out
The page is probably holding a token tied to the previous session. Regenerate the nonce after the asynchronous session transition, or reload the page so WordPress can render values for the current session.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →An AJAX request always fails
- Confirm that the action string used by
wp_create_nonce()is identical to the one passed tocheck_ajax_referer(). - Confirm that the request actually sends the generated value in the location your handler reads.
- Check whether the token has crossed the variable 12–24-hour validity window.
- Remember that a failed
check_ajax_referer()normally terminates the request, so inspect the response and server logs rather than expecting your later handler code to run.
A REST request is seen as unauthenticated
For cookie-authenticated REST calls, verify that the request includes a current nonce created with the wp_rest action. Send it in X-WP-Nonce or as _wpnonce. Also ensure the browser is operating inside the intended WordPress login session; the REST nonce does not replace the login cookie.
The nonce passes but the operation must still be denied
This is expected when the user is logged in but lacks the required permission, or when the submitted resource is not one the user may change. Keep the capability check and input validation after nonce verification.
Deploy nonce-protected changes carefully
Nonce changes often ship with plugin, theme, or REST-endpoint changes. Test them in a staging environment before production, and take a backup before significant plugin or application changes. AWS guidance for WordPress plugin installation and development also recommends backups for significant changes.
Exercise each request path separately during deployment: submit the admin form, follow the protected admin URL, trigger the AJAX action, and make the REST request with and without the required header. Verify both the expected success path and the rejection path, including a user who is logged in but lacks the capability.
A compact implementation checklist
- Choose an action string that names the operation and, when useful, the target ID.
- Create the value with the function appropriate to the form, URL, AJAX, custom, or REST context.
- Verify the same action string before any state change.
- For REST cookie requests, create the nonce with
wp_restand sendX-WP-Nonceor_wpnonceon every manual request. - Reject failures instead of continuing with partial work.
- Run
current_user_can()separately for authorization. - Validate and sanitize every request value.
- Plan for the variable 12–24-hour default validity period.
- Regenerate tokens after login or logout transitions.
- Add a session mechanism through
nonce_user_logged_outfor critical guest actions. - Stage and back up substantial plugin or application changes before deployment.
Used this way, WordPress nonces provide the request-origin check they are designed for without being mistaken for an authentication system or a permission decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
