A nonce, short for “number used once,” is a security token WordPress generates to verify that a request — like submitting a form or clicking a delete button — actually came from a legitimate source, not a malicious script.
Each nonce is unique, tied to a specific action, and expires after a short time, making it far harder for an attacker to reuse or forge a request.
Why This Matters
Without nonces, a malicious website could potentially trick a logged-in WordPress user’s browser into performing an unwanted action — deleting a post or changing a setting — without them ever intending to do so. This type of attack is known as cross-site request forgery.
Do You Need to Worry About Nonces?
Not directly. WordPress and well-built plugins handle nonce generation and verification automatically behind the scenes. It becomes relevant mainly for developers writing custom forms or admin actions, where nonces should always be added to protect against forged requests.