How to Fix the 'Nonce Invalid' Error in WordPress (2026)
17 August 2026
Practical UK guide to fixing the 'nonce invalid' WordPress error: causes, step-by-step solutions, and prevention tips for your website.
What Does 'Nonce Invalid' Mean in WordPress?
A nonce (number used once) is a security token WordPress generates to verify user requests, form submissions, and AJAX calls. It's tied to the user's session, the specific action, and expires after 12 hours. When the token doesn't match or has expired, WordPress throws the 'nonce invalid' error. This usually means the page loaded but the security check failed – often due to stale cache or outdated forms. In the UK, users might notice this after leaving a tab open overnight or when using certain plugins like membership or booking systems. It's a nuisance, not necessarily a hack, and can be fixed with systematic troubleshooting.
Why Does the Nonce Become Invalid? Common Causes
The most frequent triggers in 2026 include: aggressive caching plugins or CDNs like Cloudflare serving a cached page with an old nonce; a server clock that's out of sync (important for UK hosts that use UTC); plugin or theme conflicts that incorrectly enqueue scripts; and WordPress timezone settings that don't match your hosting server's time. Using multiple tabs or browser back buttons can also generate new nonces on one page, making others invalid. In the UK, be aware that some local caching or security plugins, installed for GDPR cookie consent, might alter nonce generation by disabling cookie sessions. Identifying the root cause is the first step to a permanent fix.
Step-by-Step Fixes for the Nonce Invalid Error
Start simple: refresh the page and retry. If that fails, clear your browser cache. Next, log into your WordPress admin (if you can) and clear any page caching plugin – WP Rocket, W3 Total Cache, or your host's built-in cache. Then deactivate all plugins and switch to a default theme like Twenty Twenty-Five; test again. If it works, reactivate plugins one by one. Also, go to Settings > General and revisit your WordPress Timezone – ensure it's set to London time if you're in the UK, but your server should use UTC. Finally, visit Settings > Permalinks and click 'Save Settings' to regenerate rewrite rules. This often clears stuck nonce issues.
UK Hosting and Timezone Tips to Avoid Nonce Issues
Many UK hosts (like Krystal, 20i, and Heart Internet) run their servers on UTC, while WordPress defaults to your set timezone. Nonces are time-sensitive, but they use server time, not your WordPress timezone. If your server's clock drifts – or if your host's NTP sync is misconfigured – nonces can become invalid prematurely. Check your server's date and time in cPanel or ask support. Also, during British Summer Time changes, cached pages with old nonces can linger. Use a caching plugin that excludes logged-in users and doesn't cache dynamic forms. If you're on shared hosting, consider a site like Cloudways or a managed WordPress host that proactively fixes time sync issues.
How Developers Can Prevent Nonce Invalid Errors
As a developer, always generate nonces with wp_create_nonce() and pass them to your JavaScript using wp_localize_script(). Verify with check_admin_referer() for admin forms or check_ajax_referer() for AJAX requests. Never hard-code nonces in templates; always use localized variables. Extend nonce lifetime with the 'nonce_life' filter if needed, but keep security in mind – a common practice is setting it to 24 hours. For REST API calls, use the built-in wp_rest nonce and always regenerate it on page load. Also, use the nocache_headers() function when serving pages with nonces to prevent caching. Test with different caching plugins to ensure compatibility, especially with UK-specific GDPR cache-consent plugins.
FAQ
No, the 'nonce invalid' error is not a security risk by itself. It simply means a security token was missing, expired, or mismatched. WordPress rejects the request to protect against CSRF attacks. However, it can indicate a misconfigured site or cache. Don't panic – just follow the troubleshooting steps to restore normal function.