Okay, not sure what was wrong with my original code, but this post put me on the right path.
To generate the nonce, use:
wp_nonce_field( plugin_basename( __FILE__ ), 'my_reset_nonce',true,false);
To verify, use:
if ( ! isset( $_POST['my_reset_nonce'] ) || ! wp_verify_nonce( ( $_POST['my_reset_nonce'] ), plugin_basename( __FILE__ ) ) ) {
die;
} else {
// Reset the form.
}
Various other variables, conditionals, sanitizing, etc. omitted for clarity.
Related Posts:
- Why am I sometimes getting a 404 error when I try to update a page with Elementor?
- When is it useful to use wp_verify_nonce
- Why Better WP security plugin returns 418 I’m a Teapot “error”?
- Weird problems after recovery from security breach
- Security checking in meta_box save is reluctant?
- wp_create_nonce function doesn’t work inside a plugin?
- 404 errors when updating options in admin dashboard
- wp_verify_nonce fails always
- What security concerns should I have when setting FS_METHOD to “direct” in wp-config?
- What Are Security Best Practices for WordPress Plugins and Themes? [closed]
- How to catch/what to do with a WP Error Object
- Are WordPress Plugins essential?
- I found this in a plugin. What does it do? is it dangerous?
- An unexpected error occurred. Something may be wrong with WordPress.org or this server’s configuration
- What are the common security flaws I need to look for? [closed]
- Disabled plugins are they security holes – rumor or reality?
- What could a hacker do with my wp-config.php
- What are the best practices for updating?
- Is there a plugin that will override the “Error establishing a database connection” message? [closed]
- How Can I Securely Implement a Password-less Login Feature?
- Error: call_user_func_array() expects parameter 1 to be a valid callback
- How to eliminate weird 404 errors in wp-admin?
- Security and .htaccess
- Loading external page template and enqueue script from plugin causes 403 forbidden error
- Validation error: Extending Gutenberg gallery block
- Why “Contact Form 7” doesn’t update PHPmailer library?
- Are there procedures to prevent malicious plugin updates?
- Secure WordPress paid plugin
- How to make media upload private? [duplicate]
- Does WordPress contain “default” anti-SQL injection code that responds with a 404 error?
- How do I fix the “sorry, you are not allowed to access this page” error I get on the “plugins > settings” links?
- Should messages in WP_Error already be html escaped?
- What does a security risk in a plugin look like?
- How to get Login Error messages on a custom template
- WordPress Capabilities: edit_user vs edit_users
- Should we use plugins that aren’t available from the official WordPress site?
- PHP Deprecated: Non-static method should not be called statically
- How to check plugins for malicious code?
- How to properly secure my WordPress installation?
- Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?
- Where should my plugin POST to?
- Plugins error (Use roles and capabilities instead) on latest version, multisite
- WordPress error – PHP Fatal error: Uncaught Error: Call to undefined function register_block_type_from_metadata()
- Security error WP 4.0 + WP phpBB Bridge [closed]
- Reduce nonce lifespan
- Should I install plugins to my WordPress installation from web sites having in URL “nulled” or, “null”?
- Error: “Cannot modify header information”
- Disabled plugins are security holes – rumor or reality?
- Plugin.php: PHP Notice: Undefined offset: 0 in
- check for the current screen
- Should I use RIPS tool to test my themes and plugins?
- “Are you sure you want to do this?” when deactivating all plugins in WordPress 4.3.1 [closed]
- Prevent Brute Force Attack
- How should I handle errors within a plugin?
- Why users disable the WordPress update?
- How many security plugins are too many? [closed]
- Will WordPress username displayed somewhere in the site?
- Upgrading WordPress 4.0 asks for FTP password
- Force plugin to fail activation
- An Unexpected HTTP Error occurred during the API request
- Is revealing just the AUTH_KEY a security issue?
- How Restrict access to admin dashboard by specific static ip?
- Dashboard Disappears after Upgrade
- Protecting against malicious code in WordPress plugin updates
- Questions about brute force attacks on the admin username, coming from amazon IP addresses
- How do you install the automattic developer plugin under localhost for mamp when there is an error, deprecated?
- echo do_shortcode is not working on theme’s template
- How to expire all wordpress user passwords instantly?
- Seaweed Plugin not working
- All plugins deactivated due to error
- How to get the wpnonce value?
- How to limit WordPress pages during updates?
- How can I see the error generated by plugin activation?
- rms_unique_wp_mu_pl_fl_nm.php
- Unable to activate wordpress importer after installing it
- How can we deal with unmaintained plugins with vulnerabilities?
- Security issues with WP sites
- How can I create a plugin installation link?
- Escape when echoed
- Should you escape hardcoded URLs?
- Error in the wp-config.php file: PHP Fatal error: Uncaught Error: Unknown named parameter (PHP 8.0)
- How to implement Sentry on WordPress? [closed]
- Preventing BFA in WordPress without using a plugin
- Can a plugin still effect a site even after deletion?
- Accessing GET variable named ‘error’
- Error handling a plugin with exceptions
- Unable to install theme recommended plugins on Multisite
- Problem with wordpress version 3.8
- How can I make uploaded images in the editor load with HTTPS?
- How to stop xmlrpc attacks without disabling component to allow JetPack to work in WordPress?
- How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
- Post-terms-order PHP errors after update
- Call to undefined function get_userdata in user.php
- Only Homepage not loading properly
- Accidentally Broke Site (Please Help) [closed]
- WordPress filter that hook after each action/filter hook
- One of my plugins broke when I tried to update it, how do I safely uninstall it?
- Images not showing after changing wp-content folder name
- How to delete Passwrd Protected posts cookies when a user logged out from the site
- The safest way to automate WordPress backups