WordPress Nonces

When to use

• The user is building a form, link, or admin action in WordPress and needs to protect it against cross-site request forgery with a nonce.
• The user needs to pass a nonce to a WordPress REST or admin-ajax request, typically via the X-WP-Nonce header or a request field.
• The user needs to verify an incoming nonce with wp_verify_nonce, check_admin_referer, or check_ajax_referer before acting.

When NOT to use

• Do not rely on a nonce to decide whether a user is allowed to do something; use a capability check with current_user_can.
• Do not add a nonce to a purely public, read-only GET that changes no state and needs no user session.

Core guidance