I'm developing a plugin (for the first time) and I'm trying to be responsible and include a nonce in my Ajax call. I've looked at a dozen tutorials, all with different approaches, and I thought I had it figured out, but I can't get it to verify the nonce. Am I missing a step somewhere in this process?

I should note that if I comment out the check_ajax_referer, everything else works, so the function, the javascript object and everything else seems to be correct.

First, I generate the nonce and store it in a Javascript object:

    $fmsapi_ajax_params = array (
        'ajaxurl' => admin_url('admin-ajax.php'),
        'ajax-nonce' => wp_create_nonce('fmsapi_refresh_nonce'),

    wp_register_script("fmsapi_refresh_script", plugins_url('fmsapi_refresh_hybrid_schedule.js', __FILE__), array('jquery'));
    wp_localize_script('fmsapi_refresh_script', 'fmsapi_Ajax', $fmsapi_ajax_params);

Next, in the Javascript, I include the nonce in the data I pass with the Ajax call:

jQuery(document).ready(function ($) {

    var data = {
        'action': 'fmsapi_refresh_hybrid_schedule',
        'year': year,
        'event': event,
        'team': team,
        'type': type,
        'security': fmsapi_Ajax.ajax_nonce,

    jQuery.post(fmsapi_Ajax.ajaxurl, data, function (response, status) {
        document.getElementById("frc_hybrid_table").innerHTML = response;

Finally, in PHP I attempt to check the nonce:

$security = filter_input(INPUT_POST, 'security');

check_ajax_referer('fmsapi_refresh_nonce', $security);

// Populate the table with the parameters provided
echo frc_populate_hybrid_schedule($year, $event, $team, $type);

I've cropped out some of the code not related to the nonce for brevity, but based on my research, this should work.

The Inspect console in Firefox doesn't flag any Javascript errors and I run the BlackBox plugin which doesn't return any PHP errors. Somewhere between creation and check, there's a problem, and I can't seem to find it.

  • 1
    you used a hyphen when localising and an underscore in the js for ajax nonce – inarilo Nov 18 '17 at 6:56

Looking at the documentation, the 2nd argument of check_ajax_referer() is:

(false|string) (Optional) Key to check for the nonce in $_REQUEST (since 2.5). If false, $_REQUEST values will be evaluated for '_ajax_nonce', and '_wpnonce' (in that order).

Not the value itself. So the correct usage would be:

check_ajax_referer('fmsapi_refresh_nonce', 'security' );
  • When combined with the error @inarilo found with the hyphen, this syntax worked. – Prdufresne Nov 19 '17 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.