The save_post hook is called every time someone calls the function wp_insert_post(). Plugins do that, unfortunately some themes too, and WordPress itself on several places when …
- someone uses post per email or XML RPC
- an auto-draft is created
- the Quick Draft feature on the dashboard is used
- a navigation menu item is added
- a revision is created
You really don’t want to handle all those action without your own verification.
Besides that, nonces should guarantee that an action cannot be repeated by someone who listens to another person’s network traffic. In theory, nonces prevent that. The default WordPress nonces are not very secure in that regard, because they can be reused. But your users might have installed a plugin that creates real nonces. Do you really want to bypass their extra security measures? Probably not.
Related Posts:
- WordPress media library allow uploading fake file
- How to get WordPress’ hooks/actions run sequence?
- How many times can I hook into the same action?
- Is there a hook before the user is authenticated?
- Hook into WordPress update?
- Verify nonce in REST API?
- switch_to_blog(): Load textdomain
- Can I hook inside another hook?
- Adding function directly vs using hook in function.php
- How can I send to multiple Contact Form 7 recipients based on form input? [closed]
- What is the action hook for save media-form on gallery tab?
- Check if action hook exists before adding actions to it
- Handling nonces for actions from guests to logged-in users
- Post-Registration, post-meta hook?
- Removing action added from constructor
- Security – Ajax and Nonce use [closed]
- after login that will redirect user role into a page
- Create hooks based on an array of hook names?
- Access post meta just after publishing
- How and why can a hook call itself without causing recursion?
- Is This A Correct Example Usage Of current_filter()?
- Seeking Hook Whenever a Custom Taxonomy Term Has Been Added
- How can i trigger an action manually?
- Can I trigger the publish_post hook by using wp_insert_post?
- WooCommerce New customer email Hook? [closed]
- When is it useful to use wp_verify_nonce
- admin_notices not working in post editor
- How to detect when a user changes their name?
- How to check what kind of saving it is?
- Override wp_delete_post and move to trash instead for custom post type
- Nonce actions and names available via open source
- How do I grab specific posts (by post id) and display the title, featured image, and excerpt?
- Empty Super Cache programmatically (with ACF action) [closed]
- Hook all http requests
- Setting Cookie with init hook causes ‘header already sent’
- How do I check if AJAX nonces are implemented correctly?
- Is there an “Add Page” hook?
- How To Make Sure That My Action Hook Executes Last
- Does update_comment_meta hook exists?
- how to determine how many and what kind of arguments are passed to hooks
- Can not set custom title on some WordPress setups
- BuddyPress User Profile Menu
- How to hook in after user’s registration email has been sent?
- Checking post format during xmlrpc_publish_post
- Hook for when a page template is changed
- Append a code when at the current page in wp_list_pages()
- Footer.php being inserted before article closing tag?
- Get all posts with a duplicate name
- Save acf field data via acf/save_post before post is saved
- Above-the-fold inline styles from SASS generated stylesheet
- Redirect in form handler causing form to be submitted twice
- Checking login status before wp_get_current_user is initialised
- Add media library tab
- Conditional hook [closed]
- Add_menu_page() error message -> “You do not have sufficient permissions to access this page”
- Where is the right place to register/enqueue scripts & styles
- Displaying list of cities according to the selected state. Using the WordPress hook
- Removing parent theme action on pluggable function not working
- Removing a Filter
- Which action hook should I use to intercept a form upon submission?
- Would there be anything stopping me from removing both wp_head and wp_footer?
- Where Are Hooks?
- WordPress wp_loaded action hook
- Check if `do_action()` in WordPress returns any result
- How to cancel an action hooked to untrash_post? or any hook
- add_action hook for publish_post not working
- Modify Notification Message When Profile Updated
- WordPress plugin activation, deactivation and uninstall hook not being triggered
- Hook for inserting?
- How to stop WordPress from updating the post meta
- Using nonce when loading posts with AJAX
- Can an RSS item be altered with a hook?
- Block Update Profile Errors
- Thickbox ‘tb_unload’ function being called twice
- How to remove a meta description or other contents
- Hooking save_post breaks check for term in added_term_relationship hook?
- Restrict editing of post type to list stored in user meta
- Delay action unltil the untill previous (hoocked) action is completed
- Rewrite the search page to use an appended slug + parameter
- What is the hook to remove a menu items group from Appearance > Menus column Add menu items
- Add stuff above header edit form
- do_action not working in loop
- add_action doesn’t work for my function
- Add HTML code before the title of the Tag page
- WP_mail() Issue. Duplicate emails if $_GET[‘A’] == email
- Hooks with same priority number. Can one stack items returned in divs, position: absolute each with their own z-index?
- trying to locate the correct file to edit my internal linking anchor tags
- Can add_image_size be added earlier
- Hook to change Author Info
- Send email to post author 1 day before his project ends
- can’t access dashboard and showing forbidden page
- prepopulate form from a hook within wordpress function.php file
- Query author’s posts & posts that have author’s id as meta value
- Change Title Type
- admin_post hook not working
- What is meaning of BEFORE and AFTER in this hook name?
- How to display before H1 Title
- How to set Post ID from context to an attribute in child block of Gutenberg Query Loop
- How can I get the ID before after_setup_theme?
- Hook on opening a media/document