wppaste
WordPress

wp_nonce_url( string $actionurl, int|string $action = -1, string $name = '_wpnonce' ): string

Since
2.0.4
Source
wp-includes/functions.php:1868

Appends a nonce query parameter to a URL so a subsequent request to that link can be verified before running a sensitive action. The action name you pass must match the one used later in wp_verify_nonce() or check_admin_referer(), and the returned string is already run through esc_html(), not esc_url(), so avoid escaping it a second time.

Retrieves URL with nonce added to URL query.

Compatibility

WordPress
since 2.0.4
PHP
7.4–8.6-dev
  • 6.7.7
  • 6.8.8
  • 6.9.7
  • 7.0.4
  • 7.1.0

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$actionurlstring
URL to add nonce action.
$actionint|stringoptional
Nonce action name. Default -1.Default: -1
$namestringoptional
Nonce name. Default '_wpnonce'.Default: '_wpnonce'

Return value

string
Escaped URL with nonce action added.

Code examples

Every example is editable and runs in a real WordPress booted in your browser by WordPress Playground. Press Run, then edit the code: clicking away re-runs it. Nothing is sent anywhere until you do.

Build a nonce-protected trash link for a post

Generate the same kind of nonce-carrying admin link WordPress uses for row actions like Trash.

$post_id = 2;
$trash_url = admin_url( 'post.php?post=' . $post_id . '&action=trash' );
$nonce_url = wp_nonce_url( $trash_url, 'trash-post_' . $post_id );

printf( '<a href="%s">Trash post %d</a>', $nonce_url, $post_id );
echo '<pre>' . esc_html( $nonce_url ) . '</pre>';

wp_nonce_url() already escapes its return value, so wrapping the whole string in esc_url() or esc_html() again is unnecessary and can double-encode it.

Give an admin-post.php action link a custom nonce field name

Some handlers check a nonce stored under a name other than the default _wpnonce, which the third argument controls.

$post_id = 2;
$action_url = admin_url( 'admin-post.php?action=clear_price_meta&post_id=' . $post_id );
$nonce_url = wp_nonce_url( $action_url, 'clear_price_meta_' . $post_id, 'price_nonce' );

echo esc_html( $nonce_url );
echo '<br>Current price meta: ' . esc_html( get_post_meta( $post_id, 'price', true ) );

The handler for admin-post.php would then read the nonce with $_REQUEST['price_nonce'] instead of $_REQUEST['_wpnonce'].

Common problems and fixes · 3

Why does check_admin_referer() reject a URL built with wp_nonce_url()?

The nonce is created from wp_create_nonce( $action ), so the string passed as $action here must be identical to the string later passed to check_admin_referer() or wp_verify_nonce(). Leaving $action at its default of -1 makes the check trivially satisfiable and defeats the point of the nonce.

Why do the ampersands in my URL look wrong after calling this function?

The function first replaces any '&' in $actionurl with a plain '&' so add_query_arg() can parse the URL, then runs the whole result through esc_html(), which re-encodes '&' back to '&'. That is expected when the URL is printed inside HTML, but it looks odd if you inspect the raw string or try to use it directly in a redirect.

Can I use wp_nonce_url() to protect an AJAX or REST request?

This function only appends a nonce to a link's query string for a normal GET request; it does not set headers or generate the kind of nonce object the REST API or admin-ajax.php scripts typically read.

Alternatives and related functions

wp_create_nonce
When you only need the raw nonce string, for example to embed it in JavaScript or a REST header instead of a URL query argument.
wp_nonce_field
When the action is triggered by a form submission rather than a plain link, so the nonce needs to be a hidden input.
check_admin_referer
When you need to verify, on the receiving admin page, the nonce that a wp_nonce_url() link supplied.
wp_verify_nonce
When you want to validate a nonce value manually outside the admin-referer helper, for example inside a custom handler.

Performance profile

How much work a call to wp_nonce_url() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class
Trivial

Touches nothing outside its own arguments.

Scaling
Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions
18

Executed per call on PHP 8.5. The body compiles to 18.

Plugin surface
None

Nothing here hands control to plugin code.

Called by
50

50 places in core call this, so the cost is paid more often than your own code shows.

What it touches

  • hookthird-party callbacksapply_filters()one call below wp_nonce_url()

Further down the call graph this can also reach option, cache, serialize, transient and query. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 1 distinct outcome

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_nonce_url() can have, taken from its control-flow graph on PHP 8.5.

WhenInstructionsCalls it makes
always18wp_create_nonce(), add_query_arg(), esc_html()

Across PHP versions

PHPCompiledExecutedBranchesNotes
8.6-dev18180
8.518180
8.4181803 fewer instructions than PHP 8.3
8.321210
8.221210
8.121210
7.421210

An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.

Uses · 3

Used by · 50

Show all 50

Source code

View on Trac View on GitHub 

function wp_nonce_url( $actionurl, $action = -1, $name = '_wpnonce' ) {	$actionurl = str_replace( '&amp;', '&', $actionurl );	return esc_html( add_query_arg( $name, wp_create_nonce( $action ), $actionurl ) );}

Changelog

Introduced in 2.0.4. Unchanged from 6.7.7 through 7.1.0.

  1. 6.7.7
  2. 6.8.8
  3. 6.9.7
  4. 7.0.4
  5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data
Generated from the wordpress-develop 7.0.4 tag, from src/wp-includes/functions.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.