Function to verify nonce in WordPress. Code examples

function verify_ajax_nonce() {
	if ( ! defined( 'DOING_AJAX' ) || ! DOING_AJAX ) {
		return false;
	}
	if ( ! isset( $_POST['ajax_nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_POST['ajax_nonce'] ) ), 'post-nonce' ) ) {
		wp_send_json( [ 'error' => __( 'Signature verification failed', 'domain' ) . '!' ] );
	}
}

The code you provided is a PHP function named verify_ajax_nonce() that is used to verify the authenticity of an AJAX request. Here’s a breakdown of how the function works:

The function first checks if the constant DOING_AJAX is defined and if it evaluates to true. If not, it immediately returns false. This condition ensures that the function is only executed during AJAX requests and not during regular page loads.

Next, the function checks if the ajax_nonce field is present in the $_POST superglobal array. The $_POST array contains data sent via an HTTP POST request. If the ajax_nonce field is not present, or if it fails the verification using the wp_verify_nonce() function, the function proceeds to send a JSON response with an error message.

In case the ajax_nonce verification fails, the wp_send_json() function is called. This function sends a JSON-encoded response to the client and terminates the script execution. The response is an associative array with an ‘error’ key, which contains a translated error message retrieved using the __() function. The __() function is used for language translation in WordPress, and ‘Signature verification failed’ is the original English text, which can be replaced with the corresponding translation in the ‘domain’ specified.

Overall, this function ensures that AJAX requests include a valid nonce value for security purposes. Nonce values are used to prevent cross-site request forgery (CSRF) attacks by validating that the request originated from the same website and was not tampered with.