WordPress • Safeguard Your Website with Nonces

A crucial aspect of securing your WordPress website is the use of nonces. Nonces (Number used ONCE) are an essential security feature in WordPress that help protect against malicious attacks, such as Cross-site Request Forgery (CSRF).

What is a CSRF

Cross-site Request Forgery (CSRF) refers to an attack where a malicious website tricks a user’s browser into performing an unintended action on another website that the user is authenticated to access.

What are WordPress Nonces?

WordPress nonces are unique tokens generated by the WordPress platform to verify the authenticity of requests made within the system. Nonces add an extra layer of security by ensuring that only authorized actions are performed on your website.

When a user performs an action on a WordPress website, such as submitting a form, a nonce is generated and attached to the request. This nonce is typically included as a hidden field in forms or added as a parameter in URLs. When the request is submitted, WordPress checks the validity of the nonce to ensure that the action is authorized.

How to create a WordPress Nonce

To create a nonce in a form, you can use the wp_nonce_field() function. This function generates a hidden field containing the nonce value and adds it to your form.

<form method="POST">
    <?php wp_nonce_field( 'your_nonce_action', 'your_nonce_field' ); ?>
</form>

To verify the nonce’s validity, you can use the wp_verify_nonce()

if ( ! isset( $_POST['your_nonce_field'] ) 
    || ! wp_verify_nonce( $_POST['your_nonce_field'], 'your_nonce_action' ) 
) {
   // nonce did not verify.
} else {
   // process form data
}

Nonces in URL

Nonces can also be used in URLs to add an extra layer of security when performing actions that modify data or state on a WordPress website. Here’s an example of how to include a nonce in a URL:

wp_nonce_url( 'your-action-url', 'your_nonce_action', 'your_nonce_name' );

If you have suggestions for improving the code, please send an email. It should be noted that the code's functionality is provided without any guarantee or responsibility.