i have a case in my admin panel where i need to call my own function that resides in my own php file, with a GET request. This function is actually removing entries from the database.

So, i would like to make sure that this cannot be invoked from anybody else than the admin user. What is the best way of doing that ? Notice that my 'example.php?filename=..' script is executed directly and should return with refreshing the page on the admin panel.

How do i secure that properly ? Is there a better way of doing that while being controlled by Wordpress default security measures ?

It would be also great to be able to execute things like get_option in the context of my php code.

1 Answer 1


Read about "Nonces".

Create one and append it to your URL:

$url = 'example.php?filename=whatever&nonce=' . wp_create_nonce('my_sensitive_action');

When your request is fulfilled check for it:

// here verify if the nonce was used before
if(wp_verify_nonce($_GET['nonce'], 'my_sensitive_action')){
  // it's ok, it wasn't used before

Also the validity of these nonces has a time limit, like one day or so. If the nonce is not used within this period, it will expire...

  • yes, i know about nonces, but these are mainly used for csrf types of attacks. An admin check should still happen to avoid privilege escalations. I was thinking of maybe somehow including my code in a more proper way. I was reading a few things just now about wordpress custom actions. It feels like this is the way to go, probably along with an is_admin() check, do you think that's correct ? +1 for your answer, thanx !
    – SpyrosP
    Commented Oct 1, 2012 at 1:26
  • 1
    well, you can always do extra checks, see current_user_can for example. is_admin() is probably not necessary, as you most likely hooked your function to an action available only within the administration pages, right? Commented Oct 1, 2012 at 1:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.