This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document like so:

/* <![CDATA[ */
var nc_ajax_getpost = {
    getpostNonce: "8a3318a44c"
/* ]]> */

So if I was building a quick scrapper I would just get the nonce value from that page and then use it in my POST...making the whole exercise of using a Nonce useless...

What am I missing here?

  • 2
    Nonces have nothing to do with content scraping, where had you got that idea from?..
    – Rarst
    Commented Oct 28, 2011 at 21:55
  • K so let me use a run-of-the-mill example then. Nonce is being used to prevent a security related attack...the attacker can still get the nonce from the website since it is being displayed publicly...wtf?
    – Adrian
    Commented Oct 28, 2011 at 22:07
  • 1
    It would probably make sense for you to rephrase this into more generic question about nonce. Way too much for comments and your initial wording about scraping does not apply.
    – Rarst
    Commented Oct 28, 2011 at 22:36

2 Answers 2


Nonces are unique to each logged-in user. You can't scrape a logged-in user's nonces unless you have their cookies. But if you have a user's cookies, you've already stolen their identity and can do whatever you want.

Nonces are meant to protect against users being tricked into doing something they didn't mean to do, by clicking a link or submitting a form. So they, themselves, perform this action (unintentionally), not the attacker.



"In security engineering, nonce is an arbitrary number used only once to sign a cryptographic communication. ... It is often a random ... authentication protocol to ensure that old communications cannot be reused in replay attacks. "

The idea is to stop the submitting of repeat data. You create a single-use unique identifier personal to you, so that when you submit data, it can only be done once. It has nothing to do with browsing your site. Which is what site scraping does. How would you differentiate between a scraping bot and a trawling bot (like Google)?

  • 9
    I must note that (confusingly) WordPress nonces can be used more than once just fine. So it doesn't have anything to do with repeated submission either, it's about verifying intent of specific user doing specific action towards specific object.
    – Rarst
    Commented Nov 1, 2011 at 18:52
  • 3
    @Rarst - excellent point about nonce reuse, and saddly the comments in the source code and the codex itself indicate that it is one time use only key. codex.wordpress.org/Function_Reference/wp_create_nonce - Which sucks when you develop a feature assuming those numbers will not validate more than once. :( Commented Aug 16, 2012 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.