wp_nonce_field( int|string $action = -1, string $name = '_wpnonce', bool $referer = true, bool $echo = true )

Retrieve or display nonce hidden field for forms.

Contents

Description Description

The nonce field is used to validate that the contents of the form came from the location on the current site and not somewhere else. The nonce does not offer absolute protection, but should protect against most cases. It is very important to use nonce field in forms.

The $action and $name are optional, but if you want to have better security, it is strongly suggested to set those two parameters. It is easier to just call the function without any parameters, because validation of the nonce doesn’t require any parameters, but since crackers know what the default is it won’t be difficult for them to find a way around your nonce and cause damage.

The input name will be whatever $name value you gave. The input value will be the nonce creation value.

Parameters Parameters

$action

(int|string) (Optional) Action name.

Default value: -1

$name

(string) (Optional) Nonce name.

Default value: '_wpnonce'

$referer

(bool) (Optional) Whether to set the referer field for validation.

Default value: true

$echo

(bool) (Optional) Whether to display or return hidden form field.

Default value: true

Top ↑

Return Return

(string) Nonce field HTML markup.

Top ↑

Source Source

File: wp-includes/functions.php 

function wp_nonce_field( $action = -1, $name = '_wpnonce', $referer = true, $echo = true ) {
	$name        = esc_attr( $name );
	$nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />';

	if ( $referer ) {
		$nonce_field .= wp_referer_field( false );
	}

	if ( $echo ) {
		echo $nonce_field;
	}

	return $nonce_field;
}

Expand full source code Collapse full source code View on Trac

Top ↑

Changelog Changelog

Changelog
Version Description
2.0.4 Introduced.

Top ↑

Top ↑

Uses Uses

Uses
Uses Description
wp-includes/formatting.php: esc_attr()

Escaping for HTML attributes.
wp-includes/pluggable.php: wp_create_nonce()

Creates a cryptographic token tied to a specific action, user, user session, and window of time.
wp-includes/functions.php: wp_referer_field()

Retrieve or display referer hidden field for forms.

Top ↑

Used By Used By

Used By
Used By Description
wp-admin/includes/post.php: the_block_editor_meta_boxes()

Renders the meta boxes forms.
wp-admin/includes/post.php: the_block_editor_meta_box_post_form_hidden_fields()

Renders the hidden form required for the meta boxes form.
wp-admin/includes/user.php: _wp_personal_data_export_page()

Personal data export.
wp-admin/includes/user.php: _wp_personal_data_removal_page()

Personal data anonymization.
wp-admin/includes/network.php: network_step1()

Prints step 1 for Network installation process.
wp-admin/includes/class-wp-screen.php: WP_Screen::render_screen_options()

Render the screen options tab.
wp-admin/includes/theme-install.php: install_themes_upload()
wp-admin/includes/class-wp-list-table.php: WP_List_Table::display_tablenav()

Generate the table navigation above or below the table
wp-admin/includes/misc.php: admin_color_scheme_picker()

Display the default admin color scheme picker (Used in user-edit.php)
wp-admin/includes/class-wp-theme-install-list-table.php: WP_Theme_Install_List_Table::display()
wp-admin/includes/plugin-install.php: install_plugins_upload()

Upload from zip
wp-admin/includes/dashboard.php: _wp_dashboard_control_callback()

Outputs controls for the current dashboard widget.
wp-admin/includes/dashboard.php: wp_dashboard()

Displays the dashboard.
wp-admin/includes/dashboard.php: wp_dashboard_quick_press()

The Quick Draft widget display and creation of drafts.
wp-admin/includes/plugin.php: settings_fields()

Output nonce, action, and option_page fields for a settings page.
wp-admin/includes/template.php: find_posts_div()

Outputs the modal window used for attaching media to posts or pages in the media-listing screen.
wp-admin/includes/template.php: wp_comment_reply()

Outputs the in-line comment reply-to form in the Comments list table.
wp-admin/includes/template.php: _list_meta_row()

Outputs a single row of public meta data in the Custom Fields meta box.
wp-admin/includes/template.php: meta_form()

Prints the form in the Custom Fields meta box.
wp-admin/includes/class-wp-themes-list-table.php: WP_Themes_List_Table::display()
wp-admin/includes/media.php: media_upload_type_form()

Outputs the legacy media upload form for a given media type.
wp-admin/includes/media.php: media_upload_type_url_form()

Outputs the legacy media upload form for external media.
wp-admin/includes/media.php: media_upload_gallery_form()

Adds gallery form to upload iframe
wp-admin/includes/media.php: media_upload_library_form()

Outputs the legacy media upload form for the media library.
wp-admin/includes/meta-boxes.php: post_comment_meta_box()

Display comments for post.
wp-admin/includes/meta-boxes.php: link_categories_meta_box()

Display link categories form fields.
wp-admin/includes/meta-boxes.php: post_categories_meta_box()

Display post categories form fields.
wp-admin/includes/class-wp-post-comments-list-table.php: WP_Post_Comments_List_Table::display()
wp-admin/includes/class-wp-comments-list-table.php: WP_Comments_List_Table::extra_tablenav()
wp-admin/includes/class-wp-comments-list-table.php: WP_Comments_List_Table::display()
wp-admin/includes/class-wp-terms-list-table.php: WP_Terms_List_Table::inline_edit()

Outputs the hidden row displayed when inline editing
wp-admin/includes/file.php: request_filesystem_credentials()

Displays a form to the user to request for their FTP/SSH details in order to connect to the filesystem.
wp-admin/includes/class-wp-posts-list-table.php: WP_Posts_List_Table::inline_edit()

Outputs the hidden row displayed when inline editing
wp-admin/custom-header.php: Custom_Image_Header::step_1()

Display first step of custom header image page.
wp-admin/custom-header.php: Custom_Image_Header::step_2()

Display second step of custom header image page.
wp-admin/includes/ms.php: confirm_delete_users()
wp-admin/update-core.php: list_core_update()
wp-admin/update-core.php: list_plugin_updates()
wp-admin/update-core.php: list_theme_updates()
wp-admin/update-core.php: list_translation_updates()
wp-admin/custom-background.php: Custom_Background::admin_page()

Display the custom background page.
wp-includes/ms-functions.php: signup_nonce_fields()

Add a nonce field to the signup page.
wp-includes/comment-template.php: wp_comment_form_unfiltered_html_nonce()

Display form token for unfiltered comments.
wp-includes/class-wp-editor.php: _WP_Editors::wp_link_dialog()

Dialog for internal linking.
Show 39 more used by Hide more used by

Top ↑

User Contributed Notes User Contributed Notes

  1. Skip to note 1 content
    You must log in to vote on the helpfulness of this noteVote results for this note: 2You must log in to vote on the helpfulness of this note
    Contributed by Codex —

    Basic Examples
    While less secure than the examples that follow, this is the simplest implementation which omits all arguments. In your form add the following:

    <?php wp_nonce_field(); ?>

    It’s better to name your action and nonce in your form. Enter values for the first and second arguments to print the necessary hidden field:

    <form method="post">
   <!-- some inputs here ... -->
   <?php wp_nonce_field( 'name_of_my_action', 'name_of_nonce_field' ); ?>
</form>

    Then in the page where it is being submitted to, you may verify it using the wp_verify_nonce() function. Notice that you have to manually retrieve the nonce (from the $_POST array in this example), and the name of the action is the 2nd parameter instead of the first:

    if ( ! isset( $_POST['name_of_nonce_field'] ) 
    || ! wp_verify_nonce( $_POST['name_of_nonce_field'], 'name_of_my_action' ) 
) {
   print 'Sorry, your nonce did not verify.';
   exit;
} else {
   // process form data
}

You must log in before being able to contribute a note or feedback.