I'm developing a WordPress site which posts a number of ajax calls from jquery to PHP and returns data from PHP to jquery.

I need to know when must I use and verify nonce?

2 Answers 2


Nonces should be used to verify intent of the user, especially on destructive actions.

Imagine there is a link user can click to delete a post. User can do it, so when they click is a post gets deleted.

Now imagine someone else tricks user into clicking this link (look at this cat pic!). User still can do it, so from access perspective they are allowed to and a post still gets deleted. But it wasn't their intent to delete anything in this situation.

Nonce adds a level of protection into these situations by limiting the action to a specific user in a specific span of time. If nonce is used then that very specific nonce needs to be used to trick user into taking an action.


You would use a nonce to help verify that the request came from a page generated by your website.

If you verify a nonce that comes with an AJAX request, then there's a pretty good chance that the request came from your site's front-end, where wp_create_nonce() was run, rather than a bot, 3rd-party application, or malicious script sending a request to your admin-ajax.php file.

Take note of this message from the documentation however (emphasis mine):

They help protect against several types of attacks including CSRF, but do not protect against replay attacks because they aren't checked for one-time use. Nonces should never be relied on for authentication or authorization, access control. Protect your functions using current_user_can(), always assume Nonces can be compromised.

So they're far from the only thing you should use to secure your requests, but they can provide an extra layer for certain types of attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.