Nonce verification in Wordpress - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to verify a nonce in WordPress.

Wordpress

if ( ! wp_verify_nonce( $_POST['[1]'], 'my_action' ) ) {
    wp_die( 'Security check failed' );
}

Drag options to blanks, or click blank then click option'

Acheck_nonce

Bmy_nonce

Cnonce_value

Dsecurity_token

Attempts:

3 left

💡 Hint

Common Mistakes

Using a wrong nonce field name.

Not checking the nonce at all.

The nonce field name used in the form is 'my_nonce', so we verify it with the same key.

2fill in blank

medium

Complete the code to create a nonce field in a WordPress form.

Wordpress

<?php wp_nonce_field( '[1]', 'my_nonce' ); ?>

Drag options to blanks, or click blank then click option'

Amy_action

Bsave_post

Csubmit_form

Dnonce_check

Attempts:

3 left

💡 Hint

Common Mistakes

Using different action names for creating and verifying nonce.

Omitting the nonce field in the form.

The action name 'my_action' should match the one used in wp_verify_nonce for verification.

3fill in blank

hard

Fix the error in the nonce verification code.

Wordpress

if ( ! wp_verify_nonce( $_POST['[1]'], 'save_post' ) ) {
    wp_die( 'Invalid nonce' );
}

Drag options to blanks, or click blank then click option'

Amy_nonce

Bnonce

Csecurity

Dtoken

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different nonce field name than the form.

Not checking if the nonce exists before verifying.

The nonce field name must match the one used in the form, which is 'my_nonce'.

4fill in blank

hard

Fill both blanks to create and verify a nonce correctly.

Wordpress

<?php wp_nonce_field( '[1]', '[2]' ); ?>

if ( ! wp_verify_nonce( $_POST['my_nonce'], '[3]' ) ) {
    wp_die( 'Nonce check failed' );
}

Drag options to blanks, or click blank then click option'

Aupdate_data

Bmy_nonce

Csave_data

Dnonce_field

Attempts:

3 left

💡 Hint

Common Mistakes

Using different action names for creation and verification.

Mismatching nonce field names.

The action name 'update_data' is used to create and verify the nonce. The nonce field name is 'my_nonce'.

5fill in blank

hard

Fill all three blanks to properly create, check, and handle a nonce in WordPress.

Wordpress

<?php wp_nonce_field( '[1]', '[2]' ); ?>

if ( ! isset( $_POST['[2]'] ) || ! wp_verify_nonce( $_POST['[2]'], '[1]' ) ) {
    wp_die( '[3]' );
}

Drag options to blanks, or click blank then click option'

Adelete_post

Bdelete_nonce

CNonce verification failed

DInvalid nonce

Attempts:

3 left

💡 Hint

Common Mistakes

Not checking if nonce is set before verification.

Using different names for nonce field and action.

Using unclear error messages.

The action name is 'delete_post', the nonce field name is 'delete_nonce', and the error message is 'Invalid nonce'.

Practice

1. What is the main purpose of using a nonce in WordPress?

easy

A. To create database backups automatically

B. To speed up page loading times

C. To store user preferences

D. To protect against unauthorized actions and CSRF attacks

Solution

1. Step 1: Understand what a nonce is

   A nonce is a security token used to verify requests are intentional and authorized.

2. Step 2: Identify nonce purpose in WordPress

   WordPress uses nonces to protect against CSRF (Cross-Site Request Forgery) attacks by verifying actions.

3. Final Answer:

   To protect against unauthorized actions and CSRF attacks -> Option D

4. Quick Check:

   Nonce = Security token for authorization [OK]

Hint: Nonce = security check token to stop bad requests [OK]

Common Mistakes:

• Thinking nonce speeds up performance
• Confusing nonce with user data storage
• Assuming nonce creates backups

2. Which function is used to verify a nonce in WordPress?

easy

A. wp_create_nonce()

B. wp_verify_nonce()

C. check_nonce()

D. nonce_verify()

Solution

1. Step 1: Recall nonce creation function

   wp_create_nonce() is used to create a nonce, not verify it.

2. Step 2: Identify the correct verification function

   wp_verify_nonce() is the official WordPress function to check if a nonce is valid.

3. Final Answer:

   wp_verify_nonce() -> Option B

4. Quick Check:

   Verify nonce = wp_verify_nonce() [OK]

Hint: Verify nonce starts with 'wp_verify_' [OK]

Common Mistakes:

• Using wp_create_nonce() to verify
• Assuming check_nonce() is a WordPress function
• Mixing function names

3. What will the following code output if the nonce is invalid?

if ( ! wp_verify_nonce($_POST['my_nonce'], 'my_action') ) {
  echo 'Invalid nonce';
} else {
  echo 'Nonce verified';
}

medium

A. Nonce verified

B. PHP error: undefined index

C. Invalid nonce

D. No output

Solution

1. Step 1: Understand wp_verify_nonce behavior

   wp_verify_nonce returns false if the nonce is invalid or missing.

2. Step 2: Analyze the if condition

   If wp_verify_nonce returns false, the condition !false is true, so 'Invalid nonce' is echoed.

3. Final Answer:

   Invalid nonce -> Option C

4. Quick Check:

   Invalid nonce triggers message 'Invalid nonce' [OK]

Hint: Invalid nonce means wp_verify_nonce returns false [OK]

Common Mistakes:

• Assuming invalid nonce prints 'Nonce verified'
• Ignoring the negation (!) in the if condition
• Expecting no output on invalid nonce

4. Identify the error in this nonce verification code snippet:

if ( wp_verify_nonce($_POST['nonce'], 'save_data') ) {
  // process data
} else {
  wp_die('Security check failed');
}

medium

A. No error, code is correct

B. Missing negation (!) before wp_verify_nonce

C. Using wp_die() instead of wp_redirect()

D. Incorrect nonce action string 'save_data'

Solution

1. Step 1: Understand wp_verify_nonce return values

   wp_verify_nonce() returns truthy integer (1 or 2) if valid or previously used, false if invalid/expired.

2. Step 2: Analyze the code logic

   if (wp_verify_nonce()) processes if truthy (valid), else wp_die() if falsy (invalid). Correct logic.

3. Final Answer:

   No error, code is correct -> Option A

4. Quick Check:

   if (wp_verify_nonce()) process else die [OK]

Hint: if(wp_verify_nonce()) process; else die works [OK]

Common Mistakes:

• Thinking negation (!) is required
• Assuming wp_die() is wrong here
• Changing action string unnecessarily

5. You want to secure an AJAX request in WordPress using a nonce. Which sequence correctly implements nonce creation and verification?

hard

A. Create nonce with wp_create_nonce('ajax_action') in PHP; send it via AJAX; verify with wp_verify_nonce($_POST['nonce'], 'ajax_action')

B. Create nonce with wp_verify_nonce('ajax_action'); send it via AJAX; verify with wp_create_nonce($_POST['nonce'], 'ajax_action')

C. Create nonce with wp_create_nonce('ajax_action') in JavaScript; verify with wp_verify_nonce($_GET['nonce'], 'ajax_action')

D. Create nonce with wp_create_nonce('ajax_action') in PHP; no need to verify on AJAX request

Solution

1. Step 1: Understand nonce creation and usage

   Nonce must be created in PHP using wp_create_nonce with an action name.

2. Step 2: Verify nonce on AJAX request

   Nonce sent via AJAX (usually POST) must be verified in PHP using wp_verify_nonce with the same action.

3. Final Answer:

   Create nonce with wp_create_nonce('ajax_action') in PHP; send it via AJAX; verify with wp_verify_nonce($_POST['nonce'], 'ajax_action') -> Option A

4. Quick Check:

   Nonce create in PHP, verify in PHP with same action [OK]

Hint: Create nonce in PHP, verify in PHP with same action [OK]

Common Mistakes:

• Trying to create nonce in JavaScript
• Mixing up create and verify functions
• Skipping verification on AJAX requests