WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering about the impact nonces would have on the default comment form a theme has. Because Nonces are a built-in feature of WordPress I thought about giving it a try.

Does somebody has already implemented nonces in the standard comment form? (can't imagine that I'm the first one who thinks about that... !)

Can someone suggest an already existing plugin that does the job or provide a code snippet that integrates the WP Nonce Field into the themes comment form and checks for it when the form gets submitted?

share|improve this question
up vote 5 down vote accepted

I haven't done this personally, but it would be pretty easy. If you are building your comment form manually, just before the end of the </form> put:

<?php wp_nonce_field( 'comment_nonce' ) ?>

Then, just hook into the pre_comment_on_post action which fires when you submit a comment:

add_action( 'pre_comment_on_post', 'my_verify_comment_nonce' );

function my_verify_comment_nonce() {

    check_admin_referer( 'comment_nonce' );


If you want to just hook into the standard comment form that Twenty Ten uses (comment_form()) then you could instead hook into comment_form like so:

add_action( 'comment_form', 'my_add_comment_nonce_to_form' );

function my_add_comment_nonce_to_form() {

    wp_nonce_field( 'comment_nonce' );


Not tested, so let me know if you have any issues!

share|improve this answer
Oh I'll give it a try and then provide a core patch if it seems fit. Should prevent the one-request-spammers from entering comments any longer. check_admin_referer() might be misused, because it ain't the admin - or is it? Need to look into how comments are stored. – hakre Aug 18 '10 at 11:42
As far as I know, there is no problem with using check_admin_referer(), I think the name is a little misleading. – Joe Hoyle Aug 18 '10 at 12:42
I'll rate this as answered or the moment because it mostly seems fit. Thanks for sharing! – hakre Aug 27 '10 at 22:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.