Title: Nonce Failure Explainer Author: Syed Shahzaib Hassan Published: 19 Ağustos 2026 Last modified: 19 Ağustos 2026 --- Eklentilerde ara ![](https://ps.w.org/nonce-failure-explainer/assets/banner-772x250.png?rev=3655387) ![](https://ps.w.org/nonce-failure-explainer/assets/icon.svg?rev=3655387) # Nonce Failure Explainer [Syed Shahzaib Hassan](https://profiles.wordpress.org/shahzaibhassan/) tarafından [İndir](https://downloads.wordpress.org/plugin/nonce-failure-explainer.1.0.0.zip) * [Detaylar](https://tr.wordpress.org/plugins/nonce-failure-explainer/#description) * [Değerlendirmeler](https://tr.wordpress.org/plugins/nonce-failure-explainer/#reviews) * [Kurulum](https://tr.wordpress.org/plugins/nonce-failure-explainer/#installation) * [Geliştirme](https://tr.wordpress.org/plugins/nonce-failure-explainer/#developers) [Destek](https://wordpress.org/support/plugin/nonce-failure-explainer/) ## Açıklama “Security check failed” is an outcome, not a diagnosis. It does not tell you whether the nonce field was missing, the action string differed, the session ended, a cached page served a stale value, or the nonce simply expired. Nonce Failure Explainer records every failed nonce check and states the most likely cause, along with the specific thing to check next. #### What it records For each failure: * The most likely cause, with an explicit confidence level * A concrete next check to run * The nonce action string * The request type (ajax, rest, admin, admin-post, cron, cli, frontend), method, and path * A best-effort guess at which plugin or theme ran the check * Whether the user was logged in #### What it never records * The nonce value itself * Authentication cookies or session tokens * Passwords, API keys, or any request body * Query strings, which routinely carry one-time tokens Function arguments are excluded from the stack trace capture, so sensitive values are never even loaded into memory during attribution. #### Causes it distinguishes * **No nonce was submitted** — the field or query argument never reached the server. Confirmed, not inferred. * **The session ended** — an auth cookie arrived but no longer resolves to a user. * **A cached page served a stale nonce** — detected when an anonymous request fails while a known caching layer is active. * **No session token** — the user is logged in but has no session for the nonce to key against. * **Expired or mismatched action** — everything needed was present, so the value itself did not match. #### Design Read-only. The plugin observes and explains; it never alters a request, extends a nonce lifetime, or changes site behaviour in any way. Storage is a single non- autoloaded option capped at 200 events with a seven-day expiry, so it cannot grow unbounded on a busy site. Nothing is sent anywhere. There is no external service, no telemetry, and no phone- home. ## Ekran Görüntüleri [⌊Tools → Nonce Failures. Each failure carries a confidence level, the specific thing to check next, the request context it came from, and where possible the plugin that ran the check.⌉⌊Tools → Nonce Failures. Each failure carries a confidence level, the specific thing to check next, the request context it came from, and where possible the plugin that ran the check.⌉[ Tools Nonce Failures. Each failure carries a confidence level, the specific thing to check next, the request context it came from, and where possible the plugin that ran the check. ## Yükleme 1. Upload the plugin to `/wp-content/plugins/nonce-failure-explainer`, or install it through the Plugins screen. 2. Activate it. 3. Reproduce the failing request. 4. Visit **Tools Nonce Failures**. ## SSS ### Does this fix nonce failures? No, and deliberately so. Version 1 is a diagnostic tool. Automatically extending nonce lifetimes or bypassing checks would weaken the protection nonces exist to provide. ### Will it slow my site down? The recorder only does work when a check actually fails, which on a healthy site is never. There is no cost on successful requests. ### Why does it say “possible cause” rather than telling me exactly what happened? Because WordPress does not distinguish an expired nonce from one generated for a different action — both simply fail to match. Where the cause can be established as fact, the plugin says “Confirmed”. Where it is inference, it says so. ### Is it safe on a production site? Yes. It is read-only, stores no secrets, and caps its own storage. The clearing action is capability-checked and nonce-protected. ### Does it work with multisite? Yes. The log is per-site, and uninstalling clears it across every site in the network. ## İncelemeler Bu eklenti için herhangi bir değerlendirme bulunmuyor. ## Katkıda Bulunanlar ve Geliştiriciler “Nonce Failure Explainer” açık kaynaklı yazılımdır. Aşağıdaki kişiler bu eklentiye katkıda bulunmuşlardır. Katkıda bulunanlar * [ Syed Shahzaib Hassan ](https://profiles.wordpress.org/shahzaibhassan/) [“Nonce Failure Explainer” eklentisini dilinize çevirin.](https://translate.wordpress.org/projects/wp-plugins/nonce-failure-explainer) ### Geliştirmeyle ilgilenir misiniz? [Kodu görüntüleyin](https://plugins.trac.wordpress.org/browser/nonce-failure-explainer/), [SVN deposuna](https://plugins.svn.wordpress.org/nonce-failure-explainer/) göz atın ya da [RSS](https://plugins.trac.wordpress.org/log/nonce-failure-explainer/?limit=100&mode=stop_on_copy&format=rss) ile [geliştirme günlüğüne](https://plugins.trac.wordpress.org/log/nonce-failure-explainer/) abone olun. ## Değişiklik Kaydı #### 1.0.0 * Initial release. ## Meta * Sürüm **1.0.0** * Son güncelleme **1 gün önce** * Etkin kurulumlar **10dan fazla** * WordPress sürümü ** 5.6 veya üstü ** * Test edilen sürüm **7.1** * PHP sürümü ** 7.4 veya üstü ** * Dil * [English (US)](https://wordpress.org/plugins/nonce-failure-explainer/) * Etiketler * [ajax](https://tr.wordpress.org/plugins/tags/ajax/)[debugging](https://tr.wordpress.org/plugins/tags/debugging/) [developer](https://tr.wordpress.org/plugins/tags/developer/)[nonce](https://tr.wordpress.org/plugins/tags/nonce/) [security](https://tr.wordpress.org/plugins/tags/security/) * [Gelişmiş görünüm](https://tr.wordpress.org/plugins/nonce-failure-explainer/advanced/) ## Puanlar Henüz inceleme gönderilmedi. [Değerlendirmeniz](https://wordpress.org/support/plugin/nonce-failure-explainer/reviews/#new-post) [Tüm değerlendirmeleri gör](https://wordpress.org/support/plugin/nonce-failure-explainer/reviews/) ## Katkıda bulunanlar * [ Syed Shahzaib Hassan ](https://profiles.wordpress.org/shahzaibhassan/) ## Destek Söyleyeceğiniz bir şey mi var? Yardım mı lazım? [Destek forumunu görüntüle](https://wordpress.org/support/plugin/nonce-failure-explainer/)