I have created a self submitting contact form template and it works nicely, however when I was browsing the web in search for tutorials (for creating contact forms) I have noticed that some people used wp_nounce_field inside their forms,but according to Konstantin Kovshenin it is a bad idea.

So should I use wp_nonce_field on my contact form or not?


  • Nonces are for security. They're used to protect forms from being misused. In the article's comments, Konstantin says it is absolutely necessary to use one if the form performs an action such as delete or edit. So, I think the answer to your question depends on your form's functionality. – henrywright Oct 6 '14 at 11:54
  • It is a contact form template... – Dejo Dekic Oct 6 '14 at 11:55
  • What exactly does it do though? – henrywright Oct 6 '14 at 11:56
  • It captures user email,name,last name and a message, then it sends confirmation email to user and sends that data (name,message,lastname,user email) to admin mail. – Dejo Dekic Oct 6 '14 at 11:59
  • My own personal view would be to use one. Better to be safe than sorry. However, I'm sure some would disagree in this case – henrywright Oct 6 '14 at 12:01

You should not. Nonce is used to protect against cross site request forgery attacks (CSRF) in which another aite tries to trick you into submitting a form to your site which will perform some hostile action.

Nonces are unique value that can be generated only by a specific site at a specific time and therefor can not be guess by the attacking site. What you do is generate a nonce and add it to your form when you generate the HTML for it and validate that it is actually was generated by your site at a reasonable time frame before attempting to handle it.

As contact form should not do anything more then store info in the DB or send a mail there is no point in protecting them agains CSRF. for 99% of the time it will make no dfference for the user but as konstantin points out if caching is used somewhere either by a caching plugin or some caching server out of your control (most ISPs probably has one) you might supply to the user a stale nonce which will fail validation and prevent users from submitting the form.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.