What Is a WordPress Nonce?
Definition
A WordPress nonce is a short-lived security token that WordPress adds to forms and admin links to prove a request was meant to happen. WordPress describes it as a "number used once" that helps "protect URLs and forms from certain types of misuse," chiefly cross-site request forgery (CSRF).
How It Works
When WordPress builds an admin screen, it generates a nonce for each sensitive action, such as deleting a comment or saving a setting, and puts it in the link or form. When the request comes back, the code checks the nonce before doing anything.
A few details matter:
- Not really "once." WordPress's documentation says nonces "aren't strictly numbers" and are not used only once; "they have a limited 'lifetime' after which they expire." By default that lifetime is one day.
- Tied to user and action. A nonce is generated for a given user and a given action, so a token for one admin's "delete comment 42" will not work for someone else or a different action.
- Checked by code. Developers call functions such as
check_admin_referer()orwp_verify_nonce(). If a plugin forgets the check, the nonce on the form does nothing. - Not a permission check. WordPress is blunt: "Nonces should never be relied on for authentication, authorization, or access control." Code must also call
current_user_can()to confirm the user is allowed to act.
Real-World Example
WordPress 5.1.1, released in March 2019, fixed a flaw in how comments were filtered (CVE-2019-9787). The NVD description says WordPress before 5.1.1 allowed "Remote Code Execution by unauthenticated users in a default configuration" because "CSRF protection is mishandled" and a filtering error led to XSS, which "results in administrative access." WordPress credited Simon Scannell of RIPS Technologies and Ronni Skansing of Prueba Cybersecurity for the discovery and shipped updated versions for older branches as well. WordPress said sites that support automatic background updates "have already started to update automatically."
Why It Matters for a Small Business
Site owners never see nonces, but they depend on every plugin getting them right. A plugin that skips the check lets an attacker change settings or create accounts by luring a logged-in admin to a web page. That is why "missing nonce" and "CSRF" advisories deserve the same update urgency as other plugin bugs, and why admins should not browse the web in the same session they use for site management. Custom code built by a freelancer or agency deserves the same scrutiny, because nobody else will ever review it.
How to Spot It / How DTS Handles It
Warning signs: plugin advisories mentioning CSRF or nonce validation, settings that changed unexpectedly, custom code that handles form submissions without wp_verify_nonce() and current_user_can(), and "Are you sure you want to do this?" errors that a developer suppressed instead of fixing.
DTS tracks plugin advisories, applies CSRF fixes quickly, and reviews custom plugin code for nonce and capability checks. See our WordPress health check, or our WordPress maintenance service for ongoing updates.
Related Terms
- Cross-site request forgery (CSRF): the attack nonces exist to stop.
- Broken access control: what happens when capability checks are missing too.
- Cross-site scripting (XSS): a flaw that can read and reuse nonces.
- Plugin vulnerability: where missing nonce checks show up.
- REST API exposure: another surface that needs nonce and permission checks.
- Patch management: getting fixes in quickly.
Sources
- WordPress.org, Nonces (Common APIs Handbook): https://developer.wordpress.org/apis/security/nonces/
- WordPress.org, WordPress 5.1.1 Security and Maintenance Release (March 2019): https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/
- NIST NVD, CVE-2019-9787 (published March 14, 2019): https://nvd.nist.gov/vuln/detail/CVE-2019-9787
Last updated October 14, 2026.