I've been screening the code of several widget and haven't found any one of them handling nonce. I also took a look at the WP_Widget class and found nothing about it as well.

This is from the codex: (https://codex.wordpress.org/Widgets_API)

class Foo_Widget extends WP_Widget {
    function __construct() {

    public function widget( $args, $instance ) {

    public function form( $instance ) {
        $title = ! empty( $instance['title'] ) ? $instance['title'] : __( 'New title', 'text_domain' );
        <label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title:' ); ?></label> 
        <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>">

        * why no nonce field created here?

    public function update( $new_instance, $old_instance ) {

I was expecting to have to create a nonce in the form function. Everywhere I looked nobody is handling nonce in the form function where data will be submitted. I wonder why?

1 Answer 1


You have to be more clear about your problem. It will be better to publish you code and anyone can check it a give their help.

I have created a contact form before with nonce and inside the form i added: <input type="hidden" name="nonce" value="<?php echo wp_create_nonce('send_email_nonce'); ?>"/>

and on the on the form handler i added:

$formNonce = $_POST['nonce'];

if (!wp_verify_nonce($formNonce, 'send_email_nonce')) {
  echo json_encode(array(
    'success' => false,
    'message' => __('Nonce was not verified!', 'shomtek')

But it depends on what is the purpose of your widget and form. I suggest you to be more specific and post your code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.