Docs4dev
Docs
wordpress / latest / functions / wp_nonce_field.html

wp_nonce_field( int|string $action = -1, string $name = '_wpnonce', bool $referer = true, bool $echo = true ): string

Retrieves or display nonce hidden field for forms.

Description

The nonce field is used to validate that the contents of the form came from the location on the current site and not somewhere else. The nonce does not offer absolute protection, but should protect against most cases. It is very important to use nonce field in forms.

The $action and $name are optional, but if you want to have better security, it is strongly suggested to set those two parameters. It is easier to just call the function without any parameters, because validation of the nonce doesn’t require any parameters, but since crackers know what the default is it won’t be difficult for them to find a way around your nonce and cause damage.

The input name will be whatever $name value you gave. The input value will be the nonce creation value.

Parameters

$action int|string Optional
Action name.

Default: -1

$name string Optional
Nonce name. Default '_wpnonce'.

Default: '_wpnonce'

$referer bool Optional
Whether to set the referer field for validation.

Default: true

$echo bool Optional
Whether to display or return hidden form field.

Default: true

Return

string Nonce field HTML markup.

Source

File: wp-includes/functions.php. View all references

function wp_nonce_field( $action = -1, $name = '_wpnonce', $referer = true, $echo = true ) {
	$name        = esc_attr( $name );
	$nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />';

	if ( $referer ) {
		$nonce_field .= wp_referer_field( false );
	}

	if ( $echo ) {
		echo $nonce_field;
	}

	return $nonce_field;
}

Uses

Uses Description
wp_referer_field() wp-includes/functions.php

Retrieves or displays referer hidden field for forms.
wp_create_nonce() wp-includes/pluggable.php

Creates a cryptographic token tied to a specific action, user, user session, and window of time.
esc_attr() wp-includes/formatting.php

Escaping for HTML attributes.

Used By

Used By Description
the_block_editor_meta_boxes() wp-admin/includes/post.php

Renders the meta boxes forms.
the_block_editor_meta_box_post_form_hidden_fields() wp-admin/includes/post.php

Renders the hidden form required for the meta boxes form.
network_step1() wp-admin/includes/network.php

Prints step 1 for Network installation process.
WP_Screen::render_screen_options() wp-admin/includes/class-wp-screen.php

Renders the screen options tab.
install_themes_upload() wp-admin/includes/theme-install.php

Displays a form to upload themes from zip files.
WP_List_Table::display_tablenav() wp-admin/includes/class-wp-list-table.php

Generates the table navigation above or below the table
admin_color_scheme_picker() wp-admin/includes/misc.php

Displays the default admin color scheme picker (Used in user-edit.php).
WP_Theme_Install_List_Table::display() wp-admin/includes/class-wp-theme-install-list-table.php

Displays the theme install table.
install_plugins_upload() wp-admin/includes/plugin-install.php

Displays a form to upload plugins from zip files.
_wp_dashboard_control_callback() wp-admin/includes/dashboard.php

Outputs controls for the current dashboard widget.
wp_dashboard() wp-admin/includes/dashboard.php

Displays the dashboard.
wp_dashboard_quick_press() wp-admin/includes/dashboard.php

The Quick Draft widget display and creation of drafts.
settings_fields() wp-admin/includes/plugin.php

Outputs nonce, action, and option_page fields for a settings page.
find_posts_div() wp-admin/includes/template.php

Outputs the modal window used for attaching media to posts or pages in the media-listing screen.
wp_comment_reply() wp-admin/includes/template.php

Outputs the in-line comment reply-to form in the Comments list table.
_list_meta_row() wp-admin/includes/template.php

Outputs a single row of public meta data in the Custom Fields meta box.
meta_form() wp-admin/includes/template.php

Prints the form in the Custom Fields meta box.
WP_Themes_List_Table::display() wp-admin/includes/class-wp-themes-list-table.php

Displays the themes table.
media_upload_type_form() wp-admin/includes/media.php

Outputs the legacy media upload form for a given media type.
media_upload_type_url_form() wp-admin/includes/media.php

Outputs the legacy media upload form for external media.
media_upload_gallery_form() wp-admin/includes/media.php

Adds gallery form to upload iframe.
media_upload_library_form() wp-admin/includes/media.php

Outputs the legacy media upload form for the media library.
post_comment_meta_box() wp-admin/includes/meta-boxes.php

Displays comments for post.
link_categories_meta_box() wp-admin/includes/meta-boxes.php

Displays link categories form fields.
post_categories_meta_box() wp-admin/includes/meta-boxes.php

Displays post categories form fields.
WP_Post_Comments_List_Table::display() wp-admin/includes/class-wp-post-comments-list-table.php
WP_Comments_List_Table::extra_tablenav() wp-admin/includes/class-wp-comments-list-table.php
WP_Comments_List_Table::display() wp-admin/includes/class-wp-comments-list-table.php

Displays the comments table.
WP_Terms_List_Table::inline_edit() wp-admin/includes/class-wp-terms-list-table.php

Outputs the hidden row displayed when inline editing
request_filesystem_credentials() wp-admin/includes/file.php

Displays a form to the user to request for their FTP/SSH details in order to connect to the filesystem.
WP_Posts_List_Table::inline_edit() wp-admin/includes/class-wp-posts-list-table.php

Outputs the hidden row displayed when inline editing
Custom_Image_Header::step_1() wp-admin/includes/class-custom-image-header.php

Display first step of custom header image page.
Custom_Image_Header::step_2() wp-admin/includes/class-custom-image-header.php

Display second step of custom header image page.
confirm_delete_users() wp-admin/includes/ms.php
list_core_update() wp-admin/update-core.php

Lists available core updates.
list_plugin_updates() wp-admin/update-core.php

Display the upgrade plugins form.
list_theme_updates() wp-admin/update-core.php

Display the upgrade themes form.
list_translation_updates() wp-admin/update-core.php

Display the update translations form.
Custom_Background::admin_page() wp-admin/includes/class-custom-background.php

Displays the custom background page.
signup_nonce_fields() wp-includes/ms-functions.php

Adds a nonce field to the signup page.
wp_comment_form_unfiltered_html_nonce() wp-includes/comment-template.php

Displays form token for unfiltered comments.
_WP_Editors::wp_link_dialog() wp-includes/class-wp-editor.php

Dialog for internal linking.

Changelog

Version Description
2.0.4 Introduced.

© 2003–2022 WordPress Foundation
Licensed under the GNU GPLv2+ License.
https://developer.wordpress.org/reference/functions/wp_nonce_field