I was wondering about the impact nonces would have on the default comment form a theme has. Because Nonces are a built-in feature of WordPress I thought about giving it a try.

Does somebody has already implemented nonces in the standard comment form? (can't imagine that I'm the first one who thinks about that... !)

Can someone suggest an already existing plugin that does the job or provide a code snippet that integrates the WP Nonce Field into the themes comment form and checks for it when the form gets submitted?

1 Answer 1


I haven't done this personally, but it would be pretty easy. If you are building your comment form manually, just before the end of the </form> put:

<?php wp_nonce_field( 'comment_nonce' ) ?>

Then, just hook into the pre_comment_on_post action which fires when you submit a comment:

add_action( 'pre_comment_on_post', 'my_verify_comment_nonce' );

function my_verify_comment_nonce() {

    check_admin_referer( 'comment_nonce' );


If you want to just hook into the standard comment form that Twenty Ten uses (comment_form()) then you could instead hook into comment_form like so:

add_action( 'comment_form', 'my_add_comment_nonce_to_form' );

function my_add_comment_nonce_to_form() {

    wp_nonce_field( 'comment_nonce' );


Not tested, so let me know if you have any issues!

  • 1
    Oh I'll give it a try and then provide a core patch if it seems fit. Should prevent the one-request-spammers from entering comments any longer. check_admin_referer() might be misused, because it ain't the admin - or is it? Need to look into how comments are stored.
    – hakre
    Aug 18, 2010 at 11:42
  • 3
    As far as I know, there is no problem with using check_admin_referer(), I think the name is a little misleading.
    – Joe Hoyle
    Aug 18, 2010 at 12:42
  • I'll rate this as answered or the moment because it mostly seems fit. Thanks for sharing!
    – hakre
    Aug 27, 2010 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.