I have created a self submitting contact form template and it works nicely, however when I was browsing the web in search for tutorials (for creating contact forms) I have noticed that some people used wp_nounce_field inside their forms,but according to Konstantin Kovshenin it is a bad idea.
So should I use wp_nonce_field on my contact form or not?
Thanks!
You should not. Nonce is used to protect against cross site request forgery attacks (CSRF) in which another aite tries to trick you into submitting a form to your site which will perform some hostile action.
Nonces are unique value that can be generated only by a specific site at a specific time and therefor can not be guess by the attacking site. What you do is generate a nonce and add it to your form when you generate the HTML for it and validate that it is actually was generated by your site at a reasonable time frame before attempting to handle it.
As contact form should not do anything more then store info in the DB or send a mail there is no point in protecting them agains CSRF. for 99% of the time it will make no dfference for the user but as konstantin points out if caching is used somewhere either by a caching plugin or some caching server out of your control (most ISPs probably has one) you might supply to the user a stale nonce which will fail validation and prevent users from submitting the form.
As the accepted answer points out, nonces are security features designed to protect against CSRF or Replay Attacks which is pointless for contact forms since they are already public facing forms. But, does not fully explain how bad nonces are for WordPress sites using caching plugins. Google's emphasis on page load times has caused a very large uptick in the use of caching plugins over the past few years, and more and more themes are starting to include thier own caching engines as well. While many caching engines now suggest refreshing your cache every 6-10 hours, this negatively impacts a low-traffic site's performance and SEO. Because WP Cron jobs are activated by page loads, it means that a cache set to expire after 6 hours does not actually regenerate after 6 hours, but instead regenerates the next time after 6 hours a guest visits your website.
Refreshing a cache generally takes a little bit longer than actually delivering a page; so, for that 6th hour guest, it means that they actually have to wait longer for a page to load than if you did not have a caching plugin at all.
This is not a big deal for high volume websites where you are getting hundreds or thousands of visitors a day, but if you are looking at a small business website that may only gets a few dozen visitors a week, forcing frequent cache refreshes actually slows your site's average page load time down. This leads to worse user experiences, and reduces your performance ranking with major search engines.
There is also the issue that some major caching engines don't have a default refresh time on the cache; so, if you were to for example install your contact form on a site with WP Fastest Cache, then your contact form would be broken out of the box until you go into the settings and add a time-out protocol or no-cache your contact page. This is a big deal if you plan to ever let other developers use your contact form because if they don't know about this, it can lead to a lot of support calls.
