I want to increase the nonce lifespan from the default 12-24h, to 36-48h.

I found the following code in the codex, but don't know where to put it.

add_filter( 'nonce_life', function () { return 172800; } );

can i put this line in the functions.php to change the nonce lifespan sitewide?

Is there an easy way to check the sitewide default lifespan of nonces?

Are there any security issues with increasing the nonce lifetime by 24h?

  • Are you expecting people to have your page open for 48hrs and still want to submit? Commented Jan 23, 2018 at 9:03
  • I am using a caching plugin that delivers pages that are up to 24h old. In some cases the nonce is not valid anymore, and some functions on the page, like a rating don't work.
    – Philip
    Commented Jan 23, 2018 at 9:19
  • see also wordpress.stackexchange.com/a/278906/50021 Commented Sep 21, 2020 at 17:45

1 Answer 1

  1. Yes

  2. Not really, but you can verify your change by login to admin and go to your profile. Wait 18 hours and try to submit. It should fail.

  3. The longer the nonce expiration time is the longer an attacker might be able to trick you into performing unintended operation (but there is actually very slim chance for that unless you have an http site and like to use it in public wifi/networks, but then nonce is not your biggest problem).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.