Hey I'm relatively new to WP, and I'm trying to get a handle on nonces since they're a good security check. I'm having difficulty verifying my nonces in save_post however.

The checks fail on the $_POST checks. When var_dumping the $_POST variable, I can see my nonces and post field names, but I cannot verify them in bulk. When I remove the verification, everything works fine.

link to gist

This is my save function:

function mdw_save($post_id)
    $metas = array(
    foreach ($metas as $meta) {
        if (!isset($_POST[$meta])) {

        if (!wp_verify_nonce($_POST[$meta . '_nonce'], 'mdw_save')) {

        if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE) {
            return $post_id;

        update_post_meta($post_id, $meta, $_POST[$meta]);

    return $post_id;

You don't need a nonce for every field, a single nonce should suffice

This is because a nonce isn't tied to a field, it's tied to a request, and verifies that you did indeed intend to press update, or click a link, submit a form, etc

As an example, back in the days of MySpace, they didn't verify intention on the logout script, so you could put an image tag on your profile and set the src as the logout URL. Anybody who visited your profile would get logged out.

If MySpace had added a nonce, they'd have been able to verify if you'd arrived at the URL intentionally, or by accident/malice.

As a result, you should never need to verify multiple nonces at the same time, you only need 1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.