I'm trying to come to an accurate decision here about safe ajax requests from a template.

The thing about AJAX that always scares me is that the called script location is public:


I just don't feel comfortable with that kind of public knowledge.

Is there a proper way of keeping prying eyes out of that script while still being able to make AJAX calls confidently?


2 Answers 2


Security through obscurity isn't a good pattern to follow. You have to have a URL to make XHR or JSONP calls. Anyone who knows anything about searching the DOM using developer tools, Firebug, etc... can easily find your remote script URL. To me, this is the wrong question to ask.

The more relevant question to security is, how do I harden my AJAX handler script from unwanted intrusions?

The simple answer to this question is to use WordPress nonces for verifying the authenticity of the request.

There are other functions you can use if you want to make sure the request came from wp-admin or simply verify a nonce outright without an API function.

Check out this page in the Codex for more information about WP Nonces.

You can also use conditionals like current_user_can() to add additional layers of security for privileged AJAX requests. If you find that someone is abusing that script, start logging IPs. If requests fail to meet criteria after so many tries, block the offending IP addresses.

The bottom line is make sure your code is secure. Hiding or obscuring scripts is not a good alternative to proper security. Snoopers will find what they want if they are motivated enough.

  • Can I not just use wp_create_nonce and then my own custom functions.php?
    – dcolumbus
    Aug 27, 2012 at 3:08
  • @dcolumbus Not sure I understand your question. Aug 27, 2012 at 3:09
  • Instead of using the Wordpress admin-ajax.php and it's method of handeling AJAX, can I not use my own "myajax-function.php" and call that with nonce?
    – dcolumbus
    Aug 27, 2012 at 3:12
  • @dcolumbus It's the same exact thing at the end of the day. There's no difference of security in you using your own ajax handler rather than the native WordPress handler. I've used admin-ajax.php for many enterprise level sites and we've never had an issue at all. Using admin-ajax.php means you're routing WP to a callback function of your choosing. Aug 27, 2012 at 3:16
  • I'm trying to determine where to draw the line with WordPress ... what should I be including into myajax-functions.php file?
    – dcolumbus
    Aug 27, 2012 at 3:18

Yes don't use that script and use the secure one WordPress provides for you.


Please read AJAX in Plugins

In response to comments.

You can use wp-admin/admin-ajax.php from the front end. You just need to make sure it is defined as your ajaxurl then your php function needs to hook into
add_action( 'wp_ajax_nopriv_your_action', 'your_callback_function' );

The nopriv flag makes it accessible from the front end.

  • Yes, but these requests are not from the WP Admin. They are from the front-end.
    – dcolumbus
    Aug 27, 2012 at 2:51
  • @dcolumbus You can still use admin-ajax.php for an AJAX handler on the front-end. Aug 27, 2012 at 3:02
  • @dcolumbus, I think the concept is same for using AJAX from front-end as well. You can have a look on the following video tutorial for better understanding: http://www.youtube.com/watch?v=7pO-FYVZv94. Cheers.
    – Mahmudur
    Aug 27, 2012 at 3:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.