Better WordPress Security with WordPress Nonces | WordPress PHP Security

In this video, I go over how to create better security on your #WordPress site with #Nonces!
github.com/alexander-young/wp...
💖 Become a Patron to show support & get perks!
/ wpcasts
Sign up for the newsletter. Free course coming in 2020:
wpcasts.tv
*SOCIAL*
Twitter: / alexanderbyoung
Instagram: / the_alex_young
Facebook: / wpcasts.tv

[@WPCasts]

Let's chat on Twitter! twitter.com/AlexanderBYoung

[@patrickcameron2950]

I'm a lot closer to wrapping my head around nonces than I was before - thank you! Looking forward to digging through your other videos.

[@jlcdrivewayramps7343]

simple. clear. I cant stand tutorials which are too complex. they confuse more than help. keep it simple and you did. thank you.

[@RyanDewhurst]

Hey! Ryan here from WPScan. Great video. Just something to note that wasn't mentioned is that Chrome and other browsers will soon be enabling "SameSite=Lax" cookies by default, which will prevent most CSRF attacks in modern web browsers, when they implement it by default. Nonces should absolutely still be used of course, but the risk of a CSRF attack should also be reduced when web browsers implement SameSite by default.

[@LevyCarneiro]

Great format with you facing diagonally. Best format I've seen for screencast videos.

[@leebuckle8288]

People in the UK reading the title like -.-

[@manavbudhia]

Great to see your video after long time..

[@wassy83]

Thank you so much!

[@MoserDamasceno]

Thank you!

[@rauljauregi6615]

nice! Thank you very much

[@TheMarouuu]

Great stuff!

[@alex_ishchenko]

Thanks!

[@vladtircomnicu1630]

Super useful

[@Pharoxx105]

Could you explain how to use a nonce with cached form pages? I want to serve the form page from a static cache

[@patrickcameron2950]

Perhaps best to just exclude that page from caching?

[@gorangagrawal]

How to get NOnce for Headless WordPress? Custom endpoint i.e with REST API?
And if yes then should we secure the Nonce endpoint by checking like current_user_can() or should just let it be without any checks?

[@amitbiswas1885]

What happens if user open this form as not logged in state and then login in another tab, return to first tab and submit the form? Nonce error happens. Why? how to deal with that situation?

[@user-ck7rb1hg8o]

Hello, what are you using for bundling JS?

[@WPCasts]

I actually wasn't bundling it. I was just using the browser-supported ES6 :)

[@RhyandMarketingGroup]

Always love how you dig deeper into WP more than the average channel! Check out the function check_ajax_referer() (developer.wordpress.org/reference/functions/check_ajax_referer/). It pretty much does what you built, but with a simple function call. It's super handy.

[@msvmanikantasrivishnu7788]

1st like :-)

[@WPCasts]

🎉 woot!

[@afflictionmarketing5303]

I don't understand it. Because the nonce filed is a hidden field. Evey when bot submit the request still isset return true and query get executed. ????

[@user-ck7rb1hg8o]

Note that the nonces are unique to the current user's session, so if a user logs in or out asynchronously any nonces on the page will no longer be valid.
codex.wordpress.org/WordPress_Nonces

[@Draanor]

Nonces are to stop replay attacks, they are to help ensuring that a request was made from a valid source and that the request is only run only once and that the primed request can expire if the user fails to submit. Nonces are basically useless on forms that don't require user authentication.

[@ReLLaKaT316]

Noooonce

[@muhammadfarooqi]

it's not useful.... it is very useful....:) thankx

[@WPCasts]

Glad to hear that!