WordPress REST API Nonce Expiration Explained for UK Developers
17 August 2026
Learn how WP REST API nonces expire, why it happens, and how to fix authentication issues on UK WordPress sites.
What Is a WordPress REST API Nonce?
In WordPress, a nonce is a security token used to verify that a request originates from an authenticated user and not from a malicious third party. For the REST API, nonces are typically sent in the `X-WP-Nonce` header or as a `_wpnonce` parameter. They help prevent Cross-Site Request Forgery (CSRF) attacks by confirming that the user initiated the action. Unlike cryptographic keys, nonces are not secret; they are time-limited hashes tied to the user session, the action, and the site. Understanding how they work is essential for UK developers building custom themes, plugins, or headless WordPress applications.
How Long Does a Nonce Last?
By default, WordPress nonces have a lifetime of 12 to 24 hours. Specifically, a nonce generated today can be used until midnight of the next day, with a 12-hour grace period. This means the maximum validity is 36 hours, but the exact expiration depends on the server timezone and when WordPress loads the `nonce_life` filter. For REST API requests, the same rules apply. If a user leaves a tab open overnight and returns to submit a form or trigger an API call, the nonce may have expired, resulting in a 403 error. UK developers often need to account for this, especially for long-running admin panels or single-page applications.
Why Do Nonces Expire?
Nonces expire for security reasons. An infinite lifetime would allow captured nonces to be replayed indefinitely, undermining the protection against CSRF. By expiring after a short period, WordPress limits the window in which a stolen nonce can be exploited. Additionally, nonces are tied to the user session and the specific action being performed. If a user logs out or their session is invalidated, the nonce immediately becomes useless. For UK websites, this is particularly relevant when dealing with GDPR compliance: expired nonces help ensure that user actions cannot be replayed without consent, reducing the risk of unauthorised data mutations.
Handling Expired Nonces on the Frontend
When a REST API nonce expires, the API response typically returns a 403 status with a message like 'The nonce has expired.' To handle this gracefully, you should detect the error and refresh the nonce. In JavaScript, you can fetch a fresh nonce from the `wp/v2` endpoint or use `wpApiSettings.nonce` if you enqueued the script through WordPress. For a better user experience, intercept 403 responses and re-issue the request after refreshing the nonce, or prompt the user to reload the page. UK developers often implement a queue to avoid multiple simultaneous refreshes. Always ensure your AJAX or fetch wrapper checks for expired nonces and retries with the new token.
Best Practices for UK Websites
For UK-based WordPress sites, consider extending nonce lifetimes only when absolutely necessary, using filters like `nonce_life` to set a custom duration. This can be useful for long-running admin forms, but be aware of the security trade-off. Alternatively, implement a robust frontend that refreshes nonces on demand. Also, remember that UK hosting environments often employ caching plugins (e.g., WP Rocket or W3 Total Cache). Cached pages can serve stale nonces, so exclude REST API responses from cache or use the `X-WP-Nonce` header correctly. Finally, test your site's behaviour across time zones and daylight saving changes, as nonce expiry is time-based.
FAQ
A WordPress nonce remains valid for up to 24 hours, plus a 12-hour grace period. So the maximum effective lifetime is 36 hours from generation. The exact duration can be modified using the `nonce_life` filter, but the default is designed to balance security and usability.