WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours.

Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with the client via AJAX and want to know if I should just generate a nonce when the page loads and use that for all communication or generate a new one for every request and include it in the response.

share|improve this question
up vote 5 down vote accepted

1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function.

To be more accurate, the lifetime is controlled by filter

apply_filters( 'nonce_life', DAY_IN_SECONDS );

2, if the lifetime value makes you doubt if it is "an implementation side-effect", you may want to add_filter('nonce_life',create_function('$v', 'return 60*5;')); to shorten the lifetime to 5 minutes in my example.

3, if you're concerned about the security of your plugin, you should use csrf token instead.

share|improve this answer

WordPress nonces are not use-once. You can reuse the nonce as often as you like until it expires.

share|improve this answer
I was more asking if this was a conscious and deliberate design decision or just an implementation side-effect that may be unexpectedly fixed at some point in the future. – Lex R Apr 4 '13 at 16:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.