Bpers

WordPress plugin · free · GPL

Find out which nonce failed, and why.

WordPress tells you “Are you sure you want to do this?” and stops. It will not say which nonce, or why. This plugin watches every nonce check, records the ones that genuinely blocked something, and states the most likely cause with the specific thing to check next.

Get it on WordPress.org Read the FAQ
Version
1.2.0
Requires
WordPress 5.6
Tested up to
WordPress 7.1
Requires PHP
7.4
Licence
GPL, free
Recorded failure Confirmed

No nonce was submitted

The field or query argument never reached the server.

Next check
Confirm the form actually renders wp_nonce_field(), and that nothing strips the hidden input before submit.
action
woocommerce-process_checkout
request
ajax · POST · /wp-admin/admin-ajax.php
source
woocommerce/includes/class-wc-ajax.php
user
logged in

An illustration of the fields one recorded failure contains — not a screenshot. Pick a cause above.

What it diagnoses

Five errors that all mean the same thing, and never say so.

“Are you sure you want to do this?”

The classic admin nonce failure. WordPress blocks the request and gives you nothing else to go on.

“Security check failed”

The same failure, phrased by a plugin or a theme instead of by core.

“The link you followed has expired”

An expired nonce on a link or a form — usually a page left open too long.

A silent 403 from admin-ajax.php

Or a bare −1 response. Nothing on screen, nothing in the log, nothing to search for.

A form that appears to do nothing

It submits, the page reloads, and whatever you changed did not save.

Causes it tells apart

Five different problems produce one identical message.

Each is diagnosed separately, and the plugin says whether it is confirmed fact or inference.

No nonce was submitted

The field or query argument never reached the server. Confirmed, not inferred.

The session ended

An auth cookie arrived but no longer resolves to a user.

A cached page served a stale nonce

Detected when an anonymous request fails while a known caching layer is active.

No session token

The user is logged in but has no session for the nonce to key against.

Expired or mismatched action

Everything needed was present, so the value itself did not match.

What it touches

Read-only, and it stores no secrets.

What it records

  • The most likely cause, with an explicit confidence level
  • A concrete next check to run
  • The nonce action string
  • Request type — ajax, rest, admin, admin-post, cron, cli, frontend — plus method and path
  • A best-effort guess at which plugin or theme ran the check
  • Whether the user was logged in

What it never records

  • The nonce value itself
  • Authentication cookies or session tokens
  • Passwords, API keys, or any request body
  • Query strings, which routinely carry one-time tokens

Function arguments are excluded from the stack trace capture, so sensitive values are never even loaded into memory during attribution.

Nothing is sent anywhere. No external service, no telemetry, no phone-home, no upsell and no premium version. Storage is a single non-autoloaded option capped at 200 events with a seven-day expiry, so it cannot grow unbounded on a busy site.

Inside the plugin

Three screens.

01 Recorded failures
The log, with headline figures and a ranking of what is failing most.
02 Causes and fixes
Every diagnosis explained in full, with the concrete checks to run.
03 Environment
The settings that decide whether a nonce verifies at all: nonce lifetime, any detected page cache, persistent object cache, and login session length. A nonce lifetime shortened by another plugin, or a session shorter than the nonce it carries, explains failures that otherwise look like bugs.

Questions

Nonces, and what goes wrong with them.

Why does WordPress say “Are you sure you want to do this?”
Because a nonce check failed. WordPress puts a one-time token into admin forms and links to prove a request came from your own page, rather than being forged by another site while you are logged in. When that token is missing, expired, or does not match, WordPress blocks the request and shows that message — without saying which of those it was. This plugin records the failure and tells you which.
What is a nonce in WordPress?
A “number used once”: a short-lived token WordPress adds to forms and action links to protect against cross-site request forgery. Nonces expire after 24 hours by default, which is why a page left open overnight often fails on submit.
Does this fix nonce failures?
No, and deliberately so. It is a diagnostic tool. Automatically extending nonce lifetimes or bypassing checks would weaken the protection nonces exist to provide. It tells you where the fault is; fixing it stays a decision you make.
Why is my log empty?
That is the expected result on a healthy site. The plugin records only checks that actually blocked a request. Reproduce the failing request and it will be captured.
Will it slow my site down?
The recorder only does work when a check actually fails. There is no cost on successful requests, and events are written once per request rather than once per event.
Why does it say “possible cause” rather than telling me exactly what happened?
Because WordPress does not distinguish an expired nonce from one generated for a different action — both simply fail to match. Where the cause can be established as fact, the plugin says “Confirmed”. Where it is inference, it says so.
Is it safe on a production site?
Yes. It is read-only, stores no secrets, and caps its own storage. The clearing action is capability-checked and nonce-protected.
Does it work with multisite?
Yes. The log is per-site, and uninstalling clears it across every site in the network.

Install it from your own dashboard.

Plugins → Add New → search for “Nonce Failure Explainer”. Free, GPL, and nothing to configure.

View on WordPress.org The other tools