Using a nonce with your forms validates that the contents of the form came from the location on the current site and not somewhere else.
Using with a form
Create the nonce HTML
$OurNonceField = wp_nonce_field( 'MySiteSomeUniqueNonceName', 'my_site_request_nonce', true, false ); //Used to validate that the contents of the form request came from the current site and not somewhere else
Include it in the form contents
<form method="POST">
$OurNonceField
</form>
Verifying the nonce when receiving the form submission
if (isset( $_POST['my_site_request_nonce'])) //Ignore forms that are not ours
{
//-------------------------------------
//----- A FORM HAS BEEN SUBMITTED -----
//-------------------------------------
//CHECK THE FORM NONCE FIELD IS VALID
if (
(!isset( $_POST['my_site_request_nonce'])) ||
(wp_verify_nonce($_POST['my_site_request_nonce'], 'MySiteSomeUniqueNonceName') !== 1) //1=nonce created within last 12 hours
)
{
wp_redirect( home_url( '/' ) );
die;
}
}
Feel free to comment if you can add help to this page or point out issues and solutions you have found. I do not provide support on this site, if you need help with a problem head over to stack overflow.