From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours.

Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with the client via AJAX and want to know if I should just generate a nonce when the page loads and use that for all communication or generate a new one for every request and include it in the response.

2 Answers 2


1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function.

To be more accurate, the lifetime is controlled by filter

apply_filters( 'nonce_life', DAY_IN_SECONDS );

2, if the lifetime value makes you doubt if it is "an implementation side-effect", you may want to add_filter('nonce_life',create_function('$v', 'return 60*5;')); to shorten the lifetime to 5 minutes in my example.

3, if you're concerned about the security of your plugin, you should use csrf token instead.


WordPress nonces are not use-once. You can reuse the nonce as often as you like until it expires.

  • 1
    I was more asking if this was a conscious and deliberate design decision or just an implementation side-effect that may be unexpectedly fixed at some point in the future.
    – Lexi
    Commented Apr 4, 2013 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.