Is there a point having several nonces? Does it increase the security?

E.g adding nonces to meta boxes while <form> (which is basically the whole add/edit post screen) already has one by default.

  • Docs, tutorials and old answers all insist adding nonce when you'll make a custom meta box
  • Like I said, WordPress already adds a nonce to <form> by default
  • Only I (admin) has access to admin area, everybody else gets redirected
  • I would prefer not to add nonce to every meta box codeblock - adding complicated meta boxes is a huge amount of code even without it

How is it then?

Optional bonus question: How about field sanitizing, validation? If nobody else has access..

  • 1
    Never trust any kind of user submitted data, not even data that you yourself submit. You should sanitize and validate regardless of who submitted the data Feb 23, 2016 at 5:52

1 Answer 1


No, there isn't any point in that.

All docs relating to metaboxes are probably inspired from the wrong code at the codex which use a nonce.

The problem which nonces in metabox inadvertently solve is avoiding data corruption when the quick edit feature of the posts list page is used (or thinking about it any sort of external API as well), as at that point there is no metabox and no data in the form. This can be tricky especially if you have checkboxes in the meta box, but the better way to solve it is by having an explicit hidden input that will indicate that the metabox was displayed (basically this is what the nonce does but it is confusing as it has nothing to do with security).

As for sanitation and validation, you should always do it, because users can send bad values to your code which might even be a legal input. It helps with security but it is not the only reason you should do it - https://xkcd.com/327/

  • Haha, love the comic and also your blog, lots of interesting opinions.
    – N00b
    Feb 23, 2016 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.