WordPress Nonce Lifetime: What It Is and How to Control It
17 August 2026
Learn how WordPress nonce lifetime works, how to change it, and why it matters for your UK site's security in 2026.
What Is a WordPress Nonce?
A WordPress nonce is a security token that verifies the authenticity of a request. Despite what the name suggests, it is not a 'number used once' – instead, it is a time-limited hash that protects your site against Cross-Site Request Forgery (CSRF). Each nonce is tied to the user's session, the action, and a time tick. In practice, this means a nonce ensures that a form submission or admin request genuinely originates from the logged-in user who initiated it, rather than from a malicious third-party website. For UK site owners, understanding nonce lifetime is a good first step towards a more secure WordPress setup, especially if you handle customer data. Nonces are essential, but they expire – which is exactly what we will explore next.
What Is the Default Nonce Lifetime in WordPress?
By default, WordPress nonces are valid for 12 hours. This is controlled by the 'nonce_life' filter, which applies to all nonces generated via wp_create_nonce() and verified with wp_verify_nonce(). Under the hood, the nonce is checked against the current time tick and the previous one, giving a 12-hour window. For logged-in users, a new login will usually produce new nonces, so older links or forms will no longer work. If you run a busy UK online store or a membership site, this default is often sufficient for standard user journeys. However, if your users spend a long time filling in complex forms or editing content, those 12 hours might not be enough – and that is when you may need to customise the lifetime.
How to Change the WordPress Nonce Lifetime
You can modify the nonce lifetime by adding a simple filter to your theme's functions.php file or a custom plugin. Here is a code snippet that extends the nonce lifetime to 24 hours: add_filter( 'nonce_life', function() { return DAY_IN_SECONDS; } ); Replace DAY_IN_SECONDS with any value you like – for example, 6 * HOUR_IN_SECONDS for six hours. Remember to use a child theme or a custom plugin for safety, and test thoroughly on a staging site first. For UK website owners, especially those processing personal data under GDPR, it is wise to keep the lifetime as short as your user experience allows. Changing this setting can be a lifeline for long-running workflows, but it also widens the attack window, so think carefully before you extend it.
When to Extend or Shorten the Nonce Lifetime
Extending the nonce lifetime is useful for multi-step forms, booking systems, or online courses where users may leave the page open for hours and then submit. A UK-based service business, for example, might have a long quote form that users fill in over time. Without a long enough nonce, the submission will fail and the user could be frustrated. Conversely, you might want to shorten the lifetime if your site handles highly sensitive financial transactions or if you experience a lot of bot activity. A shorter nonce reduces the time an attacker has to replay a captured request. There is no one-size-fits-all answer – the right length depends on your audience and the risk profile of your site.
Best Practices for Nonce Security in 2026
First, never rely on nonces alone for security – they only protect against CSRF, not XSS or authentication issues. Second, always regenerate nonces for critical actions, and consider invalidating them on logout or password change. Third, be mindful of caching. Many UK websites use page caching to improve speed, but cached pages can contain stale nonces. When a user submits a form, the nonce may be out of date, causing errors. To avoid this, you can exclude forms from the cache or implement nonce refresh via AJAX. Finally, keep WordPress and plugins updated. A solid nonce strategy, combined with sensible session management and HTTPS, will keep your WordPress site secure for both you and your users.
FAQ
By default, a WordPress nonce is valid for 12 hours. This is defined by the nonce_life filter. After that period, the nonce becomes invalid, and any form submission using it will be rejected by WordPress.