WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently working on the admin page of my custom post type, and I got stuck on deciding whether to add a nonce field again for the second metabox or not. I'm very new to custom post types, and searching online about this doesn't really yield that many results.

Any thoughts? Thanks.

share|improve this question
up vote 11 down vote accepted

I would recommend so.

You do (and should) have your own nonce with which to check the origin of the data and the intent of the user. If you have just one nonce for a metabox - then you run into problems if that metabox is removed (not the same as hidden). If removed the second metabox will (or at least should) never save since the nonce is longer sent.

Of course from a security point of view, nothing is added by a second nonce - unless you ever wish to only update one metabox and not the other: nonces should be unique to the action.


As pointed out there is only one form for the post edit screen. So, in theory, you only need one nonce field with which to validate the action and the origin of the data. However, since metaboxes can be removed - by having a nonce field in only one metabox there is no guarantee the nonce will be there. By placing a nonce field in each metabox you can check if data from that metabox has been sent (and is actually from where you think it is) prior to processing any data. E.g:


  //Check this is not an auto-save route

  if(nonce of metabox1 present and valid){
     //Process data from metabox1
    //Either metabox removed - or invalid nonce. Take no action.

  if(nonce of metabox2 present and valid){
     //Process data from metabox2
    //Either metabox removed - or invalid nonce. Take no action.


The name of the nonce field should be unique to the metabox (and not clash with any other nonces that are present on the form from other plug-ins).

The nonce value should be unique to the action (and this generally should include the origin of the data (e.g. edit-post as opposed to quick-edit)). I generally include the post ID too.

share|improve this answer
hmm. but there's only one <form> tag on the admin page. should the nonce field be unique to the form or not? tia, @Stephen – Ana Ban Apr 19 '12 at 2:27
Yes, so the nonce name should be unique to the metabox so you can check it for each metabox. The nonce value should be unique to the action performed and the origin of the data (e.g. since 'quick edit' and the normal edit screen both trigger the save_post action). – Stephen Harris Apr 19 '12 at 10:00
updated answer to hopefully clarify what I'm saying :) – Stephen Harris Apr 19 '12 at 10:12
win. thanks man. one per metabox it is. :D – Ana Ban Apr 19 '12 at 12:25
See my answer. save_post can be called from various contexts, so a nonce is not guaranteed. Its also a convenient way of checking that your callback actually has to do something. When adding multiple nonces, use unique names. It does work. – Stephen Harris Sep 23 '13 at 11:37

You could also hook the submit box that never dissapears adding the nonce field to it

add_action( 'post_submitbox_start', 'theme_submitdiv_extra' );
function theme_submitdiv_extra()
  wp_nonce_field( 'theme_meta_box_nonce', 'meta_box_nonce' );

Then, in your save_post action:

if( !isset( $_POST['meta_box_nonce'] ) || !wp_verify_nonce( $_POST['meta_box_nonce'], 'theme_meta_box_nonce' ) ) return;
share|improve this answer

The nonce field is used to validate that the contents of the form came from the location on the current site and not somewhere else.

codex: wp_nonce_field

only one nonce field per form is required, use more that one as not sense for me.

maybe you can investigate and use check_admin_referer() to be sure your request is from an admin page

share|improve this answer
aaiyt, thanks, @Ludovic – Ana Ban Apr 19 '12 at 12:25

In WP 3.5.2 The whole edit page is wrapped in a form-tag so you should NOT add your own form-tags !! If still do that and try to add another separate custom meta box it will fail when saving and only lead you to wp-admin home when trying to save!!

Also Do NOT add the NONCE field either as there is only supposed to be one per form (this also might make it fail!!) And the page edit already has a nonce field!


The thing is 1) since there is only one Form-tag for the whole edit screen, as the correct answer author has admitted, and 2) it automatically has an nonce added to it. Why would you have to add more? It will always have the nonce no matter what...

The intent is in my view to edit the page by content or meta data eg. one nonce field... Also when I tried to add more it doesn't even work with multiple meta-boxes!! One will work and the other will fail and only redirect the user to wp-admin home!

share|improve this answer
You have posted same answer on two questions, was it accidental? Which of the two did you mean to reply? – Rarst Aug 8 '13 at 18:27
Sorry accidental, this one. If you use firebug or chrome view component of a meta box added with a form-tag in wp 3.6 it's automaticly removed an wrapped in the whole form for the post. So how is this wrong? Why would you add several nonce fields then? – OZZIE Aug 16 '13 at 10:39
try it and you will see – OZZIE Sep 22 '13 at 14:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.