- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
WordPress nonces are security tokens used to help confirm that a request was intentionally generated in an expected context.
They are commonly added to forms, action URLs, AJAX requests and authenticated REST requests.
What Nonces Protect
Nonces help reduce cross-site request forgery and accidental repeated actions.
They can help confirm that a request came from a page or interface that WordPress generated for the current user.
What Nonces Do Not Protect
A nonce is not:
- Authentication.
- Authorization.
- A password.
- A one-time token in the strict cryptographic sense.
- A substitute for capability checks.
- Protection against every replay scenario.
Always check whether the current user can perform the action.
Creating and Verifying Nonces
WordPress provides APIs for:
- Adding a nonce field to a form.
- Adding a nonce to a URL.
- Creating a token for AJAX or other requests.
- Verifying admin, AJAX or custom request tokens.
Use an action string specific to the operation and object.
Lifetime
WordPress nonces remain valid during a time window and can be generated repeatedly for the same user and action.
Do not store them as permanent secrets or expect them to be valid indefinitely.
Guest Users
Logged-out visitors can share the same default user context.
High-risk guest actions may require a separate session or token design rather than relying on the default guest nonce behavior.
Safe Action Pattern
A state-changing action should normally check:
- Authentication where required.
- Capability or ownership.
- Nonce or request intent.
- Input validation.
- Safe processing.
- Escaped output or controlled redirect.
Frequently Asked Questions
Does a valid nonce prove the user is an administrator?
No. Authorization must be checked separately.
Are WordPress nonces used only once?
No. They remain valid for a limited window and are not strict one-time values.
Continue Learning
Previous: [WordPress Database Security](/resources/wordpress-manual/security/database-security/)
Next: [Validation, Sanitization and Escaping](/resources/wordpress-manual/security/validation-sanitization-escaping/)