WooCommerce Security

Before writing code

Fetch live docs:

1. Web-search site:developer.wordpress.org plugins security for WordPress security handbook
2. Web-search site:developer.woocommerce.com security best practices for WooCommerce security
3. Web-search wordpress security hardening latest for current hardening guidance

Nonces (CSRF Protection)

How Nonces Work

WordPress nonces prevent Cross-Site Request Forgery:

• Generate: wp_create_nonce( 'my_action' ) or wp_nonce_field( 'my_action', 'my_nonce' ) (for forms)
• Verify: wp_verify_nonce( $_POST['my_nonce'], 'my_action' ) or check_admin_referer( 'my_action', 'my_nonce' )
• Valid for 24 hours (two 12-hour ticks)

AJAX Nonces