Plugin security (nonces, sanitization) in Wordpress - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a nonce in WordPress plugin security?

A nonce is a unique token used to verify that a request comes from a trusted source, helping to protect against CSRF attacks.

beginner

Why is sanitization important in WordPress plugins?

Sanitization cleans user input to remove harmful code or characters, preventing security issues like SQL injection or XSS attacks.

beginner

Which WordPress function is commonly used to create a nonce field in forms?

The function wp_nonce_field() creates a hidden nonce field to include in forms for security verification.

intermediate

How do you verify a nonce in WordPress plugin code?

Use check_admin_referer() or check_ajax_referer() functions to verify the nonce before processing the request.

intermediate

Name two WordPress functions used for sanitizing user input.

Examples include sanitize_text_field() for text inputs and esc_url_raw() for URLs to ensure safe data handling.

What does a nonce protect against in WordPress plugins?

A Cross-Site Request Forgery (CSRF)

B SQL Injection

C Brute force login attempts

D File upload errors

Nonces help prevent CSRF by ensuring requests come from trusted sources.

Which function should you use to sanitize a URL input in WordPress?

A sanitize_text_field()

B wp_nonce_field()

C check_admin_referer()

D esc_url_raw()

esc_url_raw() cleans URLs to prevent malicious content and is used for sanitization.

What is the purpose of wp_nonce_field()?

A To create a hidden nonce input in forms

B To sanitize user input

C To verify a nonce

D To escape HTML output

wp_nonce_field() adds a hidden field with a nonce to forms.

Which function verifies a nonce in an AJAX request?

A check_admin_referer()

B wp_nonce_field()

C check_ajax_referer()

D sanitize_text_field()

check_ajax_referer() is used to verify nonces in AJAX calls.

Sanitization in WordPress plugins helps prevent:

A Slow page loading

B Security vulnerabilities like XSS

C Plugin conflicts

D Theme styling issues

Sanitization removes harmful input to prevent attacks like Cross-Site Scripting (XSS).

Explain how nonces work in WordPress plugin security and why they are important.

Think about how you confirm a request is safe before processing it.

Describe the role of sanitization in handling user input within WordPress plugins.

Imagine cleaning dirty water before drinking it.