While looking for proper form submission handling in plugins for users (frontend) I've stumbled upon this article Handling POST Requests the WordPress Way, which encourages to use admin-post.php for this purpose. Taking a look into header we can find some kind of confirmation:

 * WordPress Generic Request (POST/GET) Handler
 * Intended for form submission handling in themes and plugins.
 * @package WordPress
 * @subpackage Administration

My main concern is that this method comes from admin part of WP code and its use in non-admin tasks makes some ambiguity.

Can anyone (especially WP authors) confirm that this approach intention is really holistic or admin only as I think?

  • 3
    I don't get the question. the code there is small and non ambiguous. If it fits your needs you can use it, if not, then not. The intentions of a code are usually documented in the code itself ;) – Mark Kaplun Mar 8 '16 at 12:04

admin-post.php is like a poor mans controller for handling requests.

It's useful in the sense that you don't need to process your request on an alternative hook such as init and check to see whether or not special keys exists on the superglobals, like:

function handle_request() {

    if ( !empty($_POST['action']) && $_POST['action'] === 'xyz' ) {
        //do business logic


add_action('init', 'handle_request');

Instead using admin-post.php affords you the ability to specify a callback function that will always be called on any request that supplies an action value that matches the suffix supplied to the action.

function handle_request() {

    //do business logic here...


add_action( 'admin_post_handle_request', 'handle_request' );
add_action( 'admin_post_nopriv_handle_request', 'handle_request' );

In the above example, we can forgoe the need to check for !empty($_POST['action']) && $_POST['action'] === 'xyz' because at this point that processing has been taken care of for us.

That is the result of the specifying the action parameter and value and posting said value to the admin-post.php URL.

Additionally what is beneficial is that admin-post.php handles both $_POST and $_GET so it's not neccessary to check what kind of method the request is of course unless you want to for more complex processing.

Bottom line:

It is safe to use, it's just the name that throws you off.

By the way you should also remember to wp_redirect() the user back to an acceptable location as requesting admin-post.php will return nothing but a white screen as its response.

| improve this answer | |
  • 2
    @PieterGoosen haha... in that case dare I say store everything to disk in the uploads directory cue flames now :D – Adam Mar 8 '16 at 12:52
  • 2
    @PieterGoosen, LOL, but dogs are strange and known to do anything :) – Mark Kaplun Mar 8 '16 at 13:11
  • 2
    @KrzysztofPrzygoda, you are just trying to make your life complicated. It is in core since 2.6 but there is almost no documentation, and core doesn't use it therefor you better not use it yourself. Intentions of the people that made it are not important at all, the only question should be "is it useful". – Mark Kaplun Mar 8 '16 at 13:17
  • 2
    I personally have been known to use these hooks, but I've only ever done so from the backend. I don't see a problem with it. Core doesn't use it probably because of the difficulty in backing out of their old architecture and or lack of desire for people to refactor (just speculating). It's there to be used, whether core utilize it themselves or not may have not been their direct intent but as methodology for you the integrator, sure... use it. As my comments indicate above it can be a clean way to handle certain kinds of requests. This is not a hard and fast rule though, do what suits you. – Adam Mar 8 '16 at 13:28
  • 3
    @KrzysztofPrzygoda there's never been a standard/best practice for handling post requests especially in the backend that is considered the "WordPress way". But just because core does not utilize these actions does not mean you shouldn't in some cases. People do all kinds of crazy form handling in WordPress for requests in the back and front end; there's little standards or consistency, just people doing crazy things on all manner of hooks. They are very convenient hooks especially if you don't need to return data with the redirect. – Adam Mar 8 '16 at 13:31

Seems fairly clear from the use of the nopriv handling (for non logged in users) in admin-post.php that this is indeed useable for both frontend and backend form handling, very similar to how admin-ajax.php can be used.

| improve this answer | |
  • I admit that the code looks usable but... you have to admit that user doing some admin actions looks also suspicious, right? This is where the ambiguity comes from. – Krzysztof Przygoda Mar 8 '16 at 13:24
  • Yes I had similar thought when I first used admin-ajax.php - the admin part seems a bit misleading in both cases... it may help to think admin as in as in adminstration rather than administrator... – majick Mar 8 '16 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.