WordPress AJAX Nonce Security: UK Best Practices
17 August 2026
Learn how to secure your WordPress AJAX requests with nonces. A practical, UK-focused guide to preventing CSRF attacks and best practices for 2026.
What Is a Nonce and Why Do You Need It for AJAX?
A nonce, short for 'number used once', is a security token that WordPress uses to verify the legitimacy of requests. In the context of AJAX, nonces protect against Cross-Site Request Forgery (CSRF) attacks, where a malicious actor could trick a logged-in user into performing actions without their consent. Without a nonce, an attacker could forge a request to, say, update a user's role or delete a post, simply by sending a crafted AJAX call. Every nonce is tied to a specific user, action, and time window, making it unique and short-lived. For UK developers, ensuring nonces are correctly implemented is a fundamental step in meeting security best practices under the UK GDPR, which requires appropriate technical measures to protect user data.
How to Create and Pass a Nonce in WordPress AJAX
To create a nonce, use the WordPress function `wp_create_nonce( 'your_action' )`. It's essential to use a unique, descriptive action string that relates to the task, such as 'submit_booking_form'. Pass this nonce to your JavaScript via `wp_localize_script`, which safely outputs data to the front end. Alternatively, for inline scripts, you can embed it in a data attribute. In your JavaScript AJAX call, include the nonce in the data, often as `_wpnonce` or `nonce`. For example: `data: { action: 'my_action', nonce: myNonce }`. On the server side, always verify the nonce using `check_ajax_referer( 'your_action', 'nonce' )` or `wp_verify_nonce`. This simple step ensures that the request is authentic and originates from where it should.
Verifying Nonces on the Admin and Front End
WordPress provides two main functions for verifying nonces. `check_ajax_referer()` is a convenient wrapper that also checks the AJAX referer and performs the nonce verification for you. It's commonly used in `wp_ajax_` hooks. For custom contexts, `wp_verify_nonce()` gives you more control, allowing you to return false and handle the error gracefully. When verification fails, always return a proper HTTP response, such as `wp_send_json_error( 'Invalid nonce' )` and exit. Never continue with the request. Also consider whether your AJAX endpoint is on the front end or admin. For admin, ensure you're checking capabilities as well. A robust approach is to combine nonce checks with capability checks, as this covers both CSRF and authorisation issues.
Common Nonce Pitfalls and How to Avoid Them
One common pitfall is failing to generate a fresh nonce for each page load, especially when using page caching. If a nonce is cached, it will expire after the default 12-24 hour window, and users may see unexpected errors. To mitigate this, ensure you exclude pages with AJAX forms from cache, or use a nonce that can be refreshed via a dedicated AJAX endpoint. Another pitfall is using the same nonce for multiple actions – each action should have its own unique nonce. Also, avoid sending nonces in the URL (GET requests), as they may be logged in server logs or shared accidentally. Stick to POST or POST with the data in the body. Finally, remember that nonces are not a substitute for sanitising and validating input – always treat user data as untrusted.
UK Compliance and Security Best Practices for WordPress AJAX
For UK businesses, security is not just about code quality – it's a legal requirement under the UK GDPR. Nonces are part of 'security of processing', ensuring that personal data is handled securely. When implementing AJAX endpoints, always use HTTPS to encrypt traffic, as nonces can be intercepted in plain HTTP. Similarly, ensure you have strong site-level security measures, such as firewalls and brate limiting, to prevent brute-force attacks on AJAX endpoints. Remember to log suspicious activity, but be mindful of data minimisation – don't log unnecessary personal data. By following these practices, you not only protect your users but also build trust and avoid potential fines. For a full security review, consider consulting a WordPress security specialist familiar with UK regulations.
FAQ
By default, a WordPress nonce remains valid for 12 to 24 hours. Specifically, it's valid for 12 hours after creation, and then in the 12-24 hour window its lifespan varies based on the last activity. You can customise this with the 'nonce_life' filter, but be cautious – extending the live window increases the risk of a stolen nonce being reused. For sensitive actions, consider shorter expiry times.