I am refactoring my plugin that resets the WordPress database tables back to their defaults and came across an issue.

The form submission itself works fine. However, after the first submit, and if you do not refresh the page and submit the form again, the nonce seems to fail. Perhaps there is someone that fully understands how nonces work as I am not sure what is causing this.

I have the necessary check for wp_nonce_field and check_admin_referer on the administration side.

As I can't post specific parts of the code, here is the link to the refactored (WIP) plugin:


  • Does the URL change after the first submit? Are the URL parameters different?
    – Tom J Nowell
    Commented Jul 14, 2015 at 3:07
  • I don't see where you're setting the current admin page in your form?
    – Tom J Nowell
    Commented Jul 14, 2015 at 3:13
  • I didn't add it as it just sets the action to the current page if you omit it. If I do something like <form action="<?php echo $_SERVER[ 'REQUEST_URI' ] ?>"... it still has the same effect. Commented Jul 14, 2015 at 3:21
  • You need to, otherwise how does WordPress know to load your page rather than the standard tools page without the necessary URL parameters
    – Tom J Nowell
    Commented Jul 14, 2015 at 12:21
  • It's strange. Like I said even if I do add that to the form action it yields the same results. If what you're saying is correct, it wouldn't work the first time the form is submitted; but it does. And anytime you refresh the page after that. It's only when you submit the form, and submit it again without refreshing that it throws what seems to be the nonce error. Commented Jul 14, 2015 at 15:00

1 Answer 1


Not 100 % positive but my understanding is that a Nonce expire as soon as you use it. It can only be used for one transaction. So it seems to be logic that it expire after the first call.

You should probably return a new one with the response of your first validated request and replace it.

Hope this helps!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.