I'm registering a custom post type named Datasheet. When registering it, I register the callback for meta boxes

'register_meta_box_cb'  => [ $this, "add_metaboxes" ]

This is my callback

function add_metaboxes ( $post ) {  
   wp_nonce_field ( plugin_basename(__FILE__), 'datasheet_meta_nonce');

Also I registered this hook

add_action ('save_post_datasheet', [ $this, 'save_datasheet_meta' ], 10, 2);

This is the callback

function save_datasheet_meta ( $post_id, $post ) {

    $nonce = wp_verify_nonce ( plugin_basename(__FILE__), 'datasheet_meta_nonce');

    if (!$nonce) {
      die ("Security check failed");

Expected/dsidered: I was expecting that this last callback is fired when creating and or updating but ONLY IN THESE CASES; so I can check the nonces.

Actual behaviour If I simply start to create a new Datasheet, I got nothing else than

Security check failed    

This happens simply opening domain.tld/wp-admin/post-new.php?post_type=datasheet from side admin menu

So I cannot understand WHY this action is fired just entering the page... causing my nonce check to fail.

2 Answers 2


When you choose "Your CPT > Add New", WP calls get_default_post_to_edit(), which actually creates an "empty" post (with 'post_status' => 'auto-draft') and then calls wp_insert_post(). This is what is causing your save_datasheet_meta() function to be called before you think it should.

Hence, generally you should add some additional sanity checks to the beginning of any func you hook into save_post, ala:

save_datasheet_meta ($post_id, $post)
    if ('auto-draft' == $post->post_status) {
        // bail, because your nonce will not be set at this point
        return ;

    // post{,-new}.php enqueue some JS which periodically saves the post_content,
    // but NOT any post_meta
    // so, a `save_post` hook func that only cares about updating post_meta should
    // bail when DOING_AUTOSAVE is true
    if (defined ('DOING_AUTOSAVE') && DOING_AUTOSAVE) {
        return ;

    $nonce = wp_verify_nonce ( plugin_basename(__FILE__), 'datasheet_meta_nonce');

    if (!$nonce) {
        die ("Security check failed");

    // save post_meta's here

    return ;

You should not have a nonce in your metabox, and obviously not check for it in your save handler.

I know everybody copied the codex page on creating metaboxes but the use of nonce there is just super wrong. Nonce is done and validated on the whole submitted form and there is no additional security, or other value by adding it into metabox.

The only thing that the nonce do, is to validate that the submission is from the page edit and not from the quick edit, xml-rpc, or json api, but for that kind of usage you better use a simple hidden input (this might be required if your metabox contains only checkboxes).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.