Can I verify nonce which was generated on a different WP site?

In theory yes, but it will be a very bad thing to do. For that you will need to have the secret used to generate the nonce at site A in site B which means tht if site B is compromised site A might be as well (there is also some time synchronization that needs to be done between the site, but that the lesser worry).

There are two ways to properly go about it

  1. don’t use nonce at all. nonce are there to protect registered users and if the submitter of the form is unlikely to be registered or the form do not do anything destructive on the server, then no point in using them

  2. Site A should embed the form as an Iframe from site B. That way the nonce was generated by site B and it can verify it without knowing the secrets of site A

Leave a Comment