Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?

1 Answer 1


WordPress nonces are meant to prevent unauthorized execution of code. In the case of meta boxes, they are protecting you against malicious users potentially adding unauthorized meta-information to your posts and pages by forging POST requests. Why wouldn't you want to use nonces?

  • Idk, I've just started reading into nonces, but if a user is already logged into the admin panel as an admin anyway then nonces or not they would still be able to execute code in the metabox.
    – Howdy_McGee
    Commented Aug 7, 2013 at 16:51
  • Nonces are roughly defined here, but the definition lacks information. Commented Aug 7, 2013 at 17:00
  • 2
    @Howdy_McGee Yes, but nonces are meant to prevent an attacker from sending arbitrary POST data to, say, example.com/wp-admin/post.php?post=5&action=edit and having WordPress merrily execute it. (Or are you arguing that there's already a nonce on that page for the post_content, so why the second one? I'm not sure of the answer to that.)
    – Pat J
    Commented Aug 7, 2013 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.