Nonce verification in Wordpress - Step-by-Step Execution

Concept Flow - Nonce verification

User submits form with nonce

↓

Server receives request

↓

Extract nonce from request

↓

Call wp_verify_nonce()

↓

Process request

↓

Send success

The server checks the nonce sent by the user. If valid, it processes the request; if not, it rejects it.

Execution Sample

Wordpress

<?php
if (isset($_POST['my_nonce']) && wp_verify_nonce($_POST['my_nonce'], 'my_action')) {
    // Process form
} else {
    // Reject request
}
?>

This code checks if the nonce sent in the form is valid before processing the form.

Execution Table

Step	Action	Nonce Value	Verification Result	Branch Taken
1	Receive POST request	abc123	Not checked yet	Waiting for verification
2	Call wp_verify_nonce('abc123', 'my_action')	abc123	true	Process form
3	Process form data	abc123	true	Form processed successfully
4	Send success response	abc123	true	Success sent
5	End	abc123	true	Execution complete

💡 Nonce verified as true, request processed successfully

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
$_POST['my_nonce']	undefined	abc123	abc123	abc123	abc123
wp_verify_nonce result	undefined	undefined	true	true	true

Key Moments - 2 Insights

Why do we check if the nonce exists before verifying it?

Because if the nonce is missing, wp_verify_nonce() will fail or cause errors. Checking existence avoids errors and ensures safe verification (see execution_table step 1).

What happens if wp_verify_nonce() returns false?

The request is rejected and not processed to protect against CSRF attacks. This is shown by the false branch in the concept_flow diagram.

Visual Quiz - 3 Questions

Look at the execution table, what is the verification result at step 2?

A True

B False

C Not checked yet

D Undefined

💡 Hint

Check the 'Verification Result' column at step 2 in the execution_table.

At which step does the form get processed?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'Branch Taken' column to find when 'Process form' happens.

If the nonce was invalid, what would change in the execution flow?

A The nonce value would be removed from POST

B The verification result at step 2 would be false and the form would be rejected

C The form would still be processed

D The server would crash

💡 Hint

Refer to the concept_flow diagram showing the false branch after wp_verify_nonce() call.

Concept Snapshot

Nonce verification in WordPress:
- Nonce is a security token to protect forms.
- Use wp_verify_nonce(nonce, action) to check validity.
- Check nonce exists before verifying.
- If true, process request; if false, reject.
- Prevents CSRF attacks by validating user intent.

Full Transcript

Nonce verification in WordPress is a security step to confirm that a form submission or request is genuine and not forged. When a user submits a form, the server receives the nonce value sent with it. The server then calls wp_verify_nonce() with the nonce and the expected action name. If the function returns true, the server processes the form data safely. If it returns false, the server rejects the request to prevent unauthorized actions. It is important to check that the nonce exists in the request before verifying it to avoid errors. This process helps protect WordPress sites from CSRF attacks by ensuring that requests come from valid users and not attackers.

Practice

1. What is the main purpose of using a nonce in WordPress?

easy

A. To create database backups automatically

B. To speed up page loading times

C. To store user preferences

D. To protect against unauthorized actions and CSRF attacks

Solution

1. Step 1: Understand what a nonce is

   A nonce is a security token used to verify requests are intentional and authorized.

2. Step 2: Identify nonce purpose in WordPress

   WordPress uses nonces to protect against CSRF (Cross-Site Request Forgery) attacks by verifying actions.

3. Final Answer:

   To protect against unauthorized actions and CSRF attacks -> Option D

4. Quick Check:

   Nonce = Security token for authorization [OK]

Hint: Nonce = security check token to stop bad requests [OK]

Common Mistakes:

• Thinking nonce speeds up performance
• Confusing nonce with user data storage
• Assuming nonce creates backups

2. Which function is used to verify a nonce in WordPress?

easy

A. wp_create_nonce()

B. wp_verify_nonce()

C. check_nonce()

D. nonce_verify()

Solution

1. Step 1: Recall nonce creation function

   wp_create_nonce() is used to create a nonce, not verify it.

2. Step 2: Identify the correct verification function

   wp_verify_nonce() is the official WordPress function to check if a nonce is valid.

3. Final Answer:

   wp_verify_nonce() -> Option B

4. Quick Check:

   Verify nonce = wp_verify_nonce() [OK]

Hint: Verify nonce starts with 'wp_verify_' [OK]

Common Mistakes:

• Using wp_create_nonce() to verify
• Assuming check_nonce() is a WordPress function
• Mixing function names

3. What will the following code output if the nonce is invalid?

if ( ! wp_verify_nonce($_POST['my_nonce'], 'my_action') ) {
  echo 'Invalid nonce';
} else {
  echo 'Nonce verified';
}

medium

A. Nonce verified

B. PHP error: undefined index

C. Invalid nonce

D. No output

Solution

1. Step 1: Understand wp_verify_nonce behavior

   wp_verify_nonce returns false if the nonce is invalid or missing.

2. Step 2: Analyze the if condition

   If wp_verify_nonce returns false, the condition !false is true, so 'Invalid nonce' is echoed.

3. Final Answer:

   Invalid nonce -> Option C

4. Quick Check:

   Invalid nonce triggers message 'Invalid nonce' [OK]

Hint: Invalid nonce means wp_verify_nonce returns false [OK]

Common Mistakes:

• Assuming invalid nonce prints 'Nonce verified'
• Ignoring the negation (!) in the if condition
• Expecting no output on invalid nonce

4. Identify the error in this nonce verification code snippet:

if ( wp_verify_nonce($_POST['nonce'], 'save_data') ) {
  // process data
} else {
  wp_die('Security check failed');
}

medium

A. No error, code is correct

B. Missing negation (!) before wp_verify_nonce

C. Using wp_die() instead of wp_redirect()

D. Incorrect nonce action string 'save_data'

Solution

1. Step 1: Understand wp_verify_nonce return values

   wp_verify_nonce() returns truthy integer (1 or 2) if valid or previously used, false if invalid/expired.

2. Step 2: Analyze the code logic

   if (wp_verify_nonce()) processes if truthy (valid), else wp_die() if falsy (invalid). Correct logic.

3. Final Answer:

   No error, code is correct -> Option A

4. Quick Check:

   if (wp_verify_nonce()) process else die [OK]

Hint: if(wp_verify_nonce()) process; else die works [OK]

Common Mistakes:

• Thinking negation (!) is required
• Assuming wp_die() is wrong here
• Changing action string unnecessarily

5. You want to secure an AJAX request in WordPress using a nonce. Which sequence correctly implements nonce creation and verification?

hard

A. Create nonce with wp_create_nonce('ajax_action') in PHP; send it via AJAX; verify with wp_verify_nonce($_POST['nonce'], 'ajax_action')

B. Create nonce with wp_verify_nonce('ajax_action'); send it via AJAX; verify with wp_create_nonce($_POST['nonce'], 'ajax_action')

C. Create nonce with wp_create_nonce('ajax_action') in JavaScript; verify with wp_verify_nonce($_GET['nonce'], 'ajax_action')

D. Create nonce with wp_create_nonce('ajax_action') in PHP; no need to verify on AJAX request

Solution

1. Step 1: Understand nonce creation and usage

   Nonce must be created in PHP using wp_create_nonce with an action name.

2. Step 2: Verify nonce on AJAX request

   Nonce sent via AJAX (usually POST) must be verified in PHP using wp_verify_nonce with the same action.

3. Final Answer:

   Create nonce with wp_create_nonce('ajax_action') in PHP; send it via AJAX; verify with wp_verify_nonce($_POST['nonce'], 'ajax_action') -> Option A

4. Quick Check:

   Nonce create in PHP, verify in PHP with same action [OK]

Hint: Create nonce in PHP, verify in PHP with same action [OK]

Common Mistakes:

• Trying to create nonce in JavaScript
• Mixing up create and verify functions
• Skipping verification on AJAX requests