wp_nonce_url( string $actionurl, int|string $action = -1, string $name = '_wpnonce' )

Retrieve URL with nonce added to URL query.

Contents

Description Description

Parameters Parameters

$actionurl

(string) (Required) URL to add nonce action.

$action

(int|string) (Optional) Nonce action name.

Default value: -1

$name

(string) (Optional) Nonce name.

Default value: '_wpnonce'

Top ↑

Return Return

(string) Escaped URL with nonce action added.

Top ↑

Source Source

File: wp-includes/functions.php 

function wp_nonce_url( $actionurl, $action = -1, $name = '_wpnonce' ) {
	$actionurl = str_replace( '&', '&', $actionurl );
	return esc_html( add_query_arg( $name, wp_create_nonce( $action ), $actionurl ) );
}

Expand full source code Collapse full source code View on Trac

Top ↑

Changelog Changelog

Changelog
Version Description
2.0.4 Introduced.

Top ↑

Top ↑

Uses Uses

Uses
Uses Description
wp-includes/formatting.php: esc_html()

Escaping for HTML blocks.
wp-includes/pluggable.php: wp_create_nonce()

Creates a cryptographic token tied to a specific action, user, user session, and window of time.
wp-includes/functions.php: add_query_arg()

Retrieves a modified URL query string.

Top ↑

Used By Used By

Used By
Used By Description
wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php: WP_Privacy_Data_Removal_Requests_List_Table::column_next_steps()

Next steps column.
wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php: WP_Privacy_Data_Export_Requests_List_Table::column_next_steps()

Displays the next steps column.
wp-includes/admin-bar.php: wp_admin_bar_recovery_mode_menu()

Add a link to exit recovery mode when Recovery Mode is active.
wp-admin/includes/update.php: wp_recovery_mode_nag()

Displays a notice when the user is in recovery mode.
wp-admin/includes/template.php: do_block_editor_incompatible_meta_box()

Function that renders a “fake” meta box with an information message, shown on the block editor, when an incompatible meta box is found.
wp-admin/press-this.php: wp_load_press_this()
wp-admin/includes/ajax-actions.php: wp_ajax_delete_plugin()

Ajax handler for deleting a plugin.
wp-admin/includes/ajax-actions.php: wp_ajax_delete_theme()

Ajax handler for deleting a theme.
wp-admin/includes/class-wp-posts-list-table.php: WP_Posts_List_Table::handle_row_actions()

Generates and displays row action links.
wp-admin/includes/class-wp-links-list-table.php: WP_Links_List_Table::handle_row_actions()

Generates and displays row action links.
wp-admin/includes/class-wp-ms-themes-list-table.php: WP_MS_Themes_List_Table::column_name()

Handles the name column output.
wp-admin/includes/class-wp-ms-sites-list-table.php: WP_MS_Sites_List_Table::handle_row_actions()

Generates and displays row action links.
wp-admin/includes/class-wp-terms-list-table.php: WP_Terms_List_Table::handle_row_actions()

Generates and displays row action links.
wp-admin/includes/class-wp-ms-users-list-table.php: WP_MS_Users_List_Table::handle_row_actions()

Generates and displays row action links.
wp-admin/includes/theme.php: wp_prepare_themes_for_js()

Prepare themes for JavaScript.
wp-admin/includes/theme.php: delete_theme()

Remove a theme
wp-admin/includes/theme.php: get_theme_update_available()

Retrieve the update link if there is a theme update available.
wp-admin/includes/class-wp-plugins-list-table.php: WP_Plugins_List_Table::single_row()
wp-admin/includes/class-theme-upgrader-skin.php: Theme_Upgrader_Skin::after()
wp-admin/includes/class-theme-installer-skin.php: Theme_Installer_Skin::after()
wp-admin/includes/class-plugin-installer-skin.php: Plugin_Installer_Skin::after()
wp-admin/includes/class-plugin-upgrader-skin.php: Plugin_Upgrader_Skin::after()
wp-admin/includes/class-wp-upgrader-skin.php: WP_Upgrader_Skin::request_filesystem_credentials()

Displays a form to the user to request for their FTP/SSH details in order to connect to the filesystem.
wp-admin/includes/class-wp-theme-install-list-table.php: WP_Theme_Install_List_Table::install_theme_info()

Prints the info for a theme (to be used in the theme installer modal).
wp-admin/includes/class-wp-theme-install-list-table.php: WP_Theme_Install_List_Table::single_row()

Prints a theme from the WordPress.org API.
wp-admin/includes/update.php: wp_plugin_update_row()

Displays update information for a plugin.
wp-admin/includes/update.php: wp_theme_update_row()

Displays update information for a theme.
wp-admin/includes/plugin-install.php: install_plugin_install_status()

Determine the status we can perform on a plugin.
wp-admin/includes/deprecated.php: wp_dashboard_plugins_output()

Display plugins text for the WordPress news widget.
wp-admin/includes/plugin.php: delete_plugins()

Remove directory and files of a plugin for a list of plugins.
wp-admin/includes/template.php: wp_import_upload_form()

Outputs the form used by the importers to accept the data to be imported
wp-admin/includes/class-wp-themes-list-table.php: WP_Themes_List_Table::display_rows()
wp-admin/includes/class-wp-users-list-table.php: WP_Users_List_Table::single_row()

Generate HTML for a single row on the users.php admin panel.
wp-admin/includes/media.php: get_media_item()

Retrieve HTML form for modifying the image attachment.
wp-admin/includes/post.php: _admin_notice_post_locked()

Outputs the HTML for the notice to say that someone else is editing or has taken over editing of this post.
wp-admin/includes/revision.php: wp_prepare_revisions_for_js()

Prepare revisions for JavaScript.
wp-admin/includes/meta-boxes.php: link_submit_meta_box()

Display link create form fields.
wp-admin/includes/class-wp-media-list-table.php: WP_Media_List_Table::_get_row_actions()
wp-admin/includes/class-walker-nav-menu-edit.php: Walker_Nav_Menu_Edit::start_el()

Start the element output.
wp-admin/update-core.php: do_core_upgrade()

Upgrade WordPress core display.
wp-admin/update-core.php: do_dismiss_core_update()

Dismiss a core update.
wp-admin/update-core.php: do_undismiss_core_update()

Undismiss a core update.
wp-includes/general-template.php: wp_logout_url()

Retrieves the logout URL.
wp-includes/link-template.php: get_delete_post_link()

Retrieves the delete posts link for post.
Show 39 more used by Hide more used by

Top ↑

User Contributed Notes User Contributed Notes

  1. Skip to note 1 content
    You must log in to vote on the helpfulness of this noteVote results for this note: 1You must log in to vote on the helpfulness of this note
    Contributed by Benjamin Intal —

    Note that wp_nonce_url escapes & to & and may cause links or redirects to become incorrect.

    // Sample URL, note the & in there
$url = 'http://localhost/?arg1=value1&arg2=value2';

// This will show http://localhost/?arg1=value1&arg2=value2&_wpnonce=abcdef
echo wp_nonce_url( $url, 'action' );

// This will return http://localhost/?arg1=value1&arg2=value2&_wpnonce=abcdef
echo add_query_arg( '_wpnonce', wp_create_nonce( 'action' ), $url );
  2. Skip to note 2 content
    You must log in to vote on the helpfulness of this noteVote results for this note: 0You must log in to vote on the helpfulness of this note
    Contributed by Codex —

    Example

    Plugin authors can safely add links that perform tasks using a combination of wp_nonce_url() and admin_url().
    For instance, start by creating the link users can click to do something interesting: 

    function my_plugin_do_something () {
?>
<h2><?php esc_html_e('My Plugin Admin Screen', 'my-plugin-textdomain');?></h2>
<p>
    <a href="<?php print wp_nonce_url(admin_url('options.php?page=my_plugin_settings'), 'doing_something', 'my_nonce');?>"
        class="button button-primary"><?php esc_html_e('Do Something!', 'my-plugin-textdomain');?></a>
    <span class="description"><?php esc_html_e('This button does something interesting.', 'my-plugin-textdomain');?></span>
</p>
<?php
}

    Then, to detect when the user clicks the link, check the nonce validity using wp_verify_nonce() in the function you defined when you called add_menu_page() or one of its Administration Menus wrappers. If the nonce isn’t valid, the link wasn’t clicked, so display the link. Otherwise, do “something interesting.” 

    add_action('admin_menu', 'add_my_plugin_admin_screen');
function add_my_plugin_admin_screen () {
    add_options_page(
        __('My Plugin Settings', 'my-plugin-textdomain'),
        __('My Plugin', 'my-plugin-textdomain'),
        'manage_options',
        'my_plugin_settings',
        'my_plugin_do_something'
    );
}

function my_plugin_do_something () {
    if (!isset($_GET['my_nonce']) || !wp_verify_nonce($_GET['my_nonce'], 'doing_something')) {
?>
<h2><?php esc_html_e('My Plugin Admin Screen', 'my-plugin-textdomain');?></h2>
<p>
    <a href="<?php print wp_nonce_url(admin_url('options.php?page=my_plugin_settings'), 'doing_something', 'my_nonce');?>"
        class="button button-primary"><?php esc_html_e('Do Something!', 'my-plugin-textdomain');?></a>
    <span class="description"><?php esc_html_e('This button does something interesting.', 'my-plugin-textdomain');?></span>
</p>
<?php
    } else {
        // User pressed "Do Something!" button, so
        // do something interesting.
    }
}

    Expand full source codeCollapse full source code

    Note that the recommended “context” parameter of the nonce is used to disambiguate which button was pressed. If you make more than one button users can press, make sure each button has a different nonce name and/or context.

You must log in before being able to contribute a note or feedback.