Preventing CSRF in WordPress Plugins — a practical guide to WordPress CSRF nonce with clear examples you can reuse in real projects.
WordPress Plugin Development Series (72/95). Prefer one article? Read the complete WordPress plugin development tutorial.
Short description
CSRF tricks a logged-in browser into submitting requests. Nonces + same-site practices reduce this risk.
CSRF protection
check_admin_referer('acme_update');
// or for GET actions:
wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'acme_delete');