A nonce is a security token that WordPress adds to links and forms to confirm that a request really came from you. The word means "number used once," and it protects your site from an attack called CSRF.
You will rarely notice a nonce, but it works quietly every time you delete a post, update a plugin or save your settings.
Why Does WordPress Need Nonces?
CSRF stands for Cross-Site Request Forgery. In this attack, a bad website tricks your logged-in browser into doing something on your site, such as deleting a user. A nonce stops this, because the attacker can't guess the correct token.
Think of it like the one-time password your bank sends before a payment. Without the right code, the action simply doesn't go through.
How Do Nonces Work in WordPress?
Each nonce is tied to a specific action and a specific user. For example, the trash link for a post carries a token like _wpnonce=4f2a9c1b7e in its URL. When you click it, WordPress checks the token before it moves anything.
Unlike a true one-time code, a WordPress nonce can be used more than once, but it expires after a while, up to 24 hours by default. Developers add nonces with a few core functions:
// Inside the form
wp_nonce_field( 'wpt_save_settings', 'wpt_nonce' );
// Before saving the data
check_admin_referer( 'wpt_save_settings', 'wpt_nonce' );For AJAX requests, check_ajax_referer() does the same job.
When a Nonce Check Fails
If a nonce is missing or expired, WordPress stops the action and shows the message "The link you followed has expired." Older versions showed the famous "Are you sure you want to do this?" error instead. This message can also appear when you upload a file bigger than your server allows, because the token gets lost along with the form data.
A nonce only confirms that the request came from your own site. It doesn't check permissions, so always pair it with current_user_can() before doing anything sensitive.
So, the next time you spot _wpnonce in a URL, you will know what it does. Nonces are tiny, but they keep many risky actions safe. If anything is unclear, ask us in the comment box below.