Nonces and Security in Themes — a practical guide to WordPress theme nonces with clear examples you can reuse in real projects.
WordPress Theme Development Series (72/96). Prefer one article? Read the complete WordPress theme development tutorial.
Short description
Nonces verify intent; capabilities authorize users. You need both for state-changing actions.
Verify nonce
if (! isset($_POST['_wpnonce']) || ! wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['_wpnonce'])), 'acme_theme_action')) {
wp_die('Invalid request');
}