wp_nonce_field( int|string $action = -1, string $name = ‘_wpnonce’, bool $referer = true, bool $display = true ): string

User Contributed Notes

1. Skip to note 3 content

   Codex 9 years ago

   You must log in to vote on the helpfulness of this noteVote results for this note: 11You must log in to vote on the helpfulness of this note

   Basic Examples
   While less secure than the examples that follow, this is the simplest implementation which omits all arguments. In your form add the following:

   <?php wp_nonce_field(); ?>

   It’s better to name your action and nonce in your form. Enter values for the first and second arguments to print the necessary hidden field:

   <form method="post">
      <!-- some inputs here ... -->
      <?php wp_nonce_field( 'name_of_my_action', 'name_of_nonce_field' ); ?>
   </form>

   Then in the page where it is being submitted to, you may verify it using the wp_verify_nonce() function. Notice that you have to manually retrieve the nonce (from the $_POST array in this example), and the name of the action is the 2nd parameter instead of the first:

   if ( ! isset( $_POST['name_of_nonce_field'] ) 
       || ! wp_verify_nonce( $_POST['name_of_nonce_field'], 'name_of_my_action' ) 
   ) {
      print 'Sorry, your nonce did not verify.';
      exit;
   } else {
      // process form data
   }
2. Skip to note 4 content

   Sarathlal N 2 years ago

   You must log in to vote on the helpfulness of this noteVote results for this note: 1You must log in to vote on the helpfulness of this note

   We can create a nonce field without a name because it is optional. In that case, the name will be _wpnonce.

   wp_nonce_field( 'my-action-name' );

   The above statement echo a hidden field named as _wpnonce.

   To verify this nonce, we can use the `wp_verify_nonce` function.

   if ( isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( $_REQUEST['_wpnonce'], 'my-action-name' ) ) {
     //do you action
   } else {
     die( __( 'Security check', 'textdomain' ) );
   }