---
title: WordPress nonce
canonical: https://wpsecurityninja.com/dictionary/wordpress-nonce/
---
# WordPress nonce

A WordPress nonce is a short-lived token used to verify that a request was intentional, mainly to reduce CSRF risk.

Last updated: 2026-08-26

Also called: nonce, wpnonce, wp_nonce

## Related terms

- [CSRF](https://wpsecurityninja.com/dictionary/csrf/): CSRF tricks a logged-in browser into sending a request the user did not mean to send.
- [Cross-site scripting (XSS)](https://wpsecurityninja.com/dictionary/xss/): Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- [Privilege escalation](https://wpsecurityninja.com/dictionary/privilege-escalation/): Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
- [WordPress user roles](https://wpsecurityninja.com/dictionary/wordpress-user-roles/): User roles group capabilities that decide what each account can do in WordPress, from reading to full admin.

## Why it matters for WordPress

Core and well-built plugins attach nonces to admin forms and AJAX calls so a random third-party page cannot easily forge those actions while you are logged in. A missing or unchecked nonce shows up in CVE write-ups constantly. A nonce is not encryption, and it is not a substitute for capability checks.

## How it shows up in practice

- Hidden `_wpnonce` fields on settings forms
- URLs with `?_wpnonce=` on one-click actions
- Advisories that say “missing nonce verification” on a privileged endpoint
- Expired nonce errors after leaving an admin tab open too long

## What to do

1. Keep WordPress and plugins updated when nonce-related bugs ship.
2. In custom code, verify nonces and `current_user_can( ... )` together.
3. Do not treat “the URL is obscure” as protection.
4. If you build admin UI, fail closed when the nonce is missing or wrong.