Title: Nonce Failure Explainer Author: Syed Shahzaib Hassan Published: 2026 年 8 月 19 日 Last modified: 2026 年 8 月 19 日 --- 搜索插件 ![](https://ps.w.org/nonce-failure-explainer/assets/banner-772x250.png?rev=3655387) ![](https://ps.w.org/nonce-failure-explainer/assets/icon.svg?rev=3655387) # Nonce Failure Explainer 作者：[Syed Shahzaib Hassan](https://profiles.wordpress.org/shahzaibhassan/) [下载](https://downloads.wordpress.org/plugin/nonce-failure-explainer.1.0.0.zip) * [详情](https://cn.wordpress.org/plugins/nonce-failure-explainer/#description) * [评价](https://cn.wordpress.org/plugins/nonce-failure-explainer/#reviews) * [安装](https://cn.wordpress.org/plugins/nonce-failure-explainer/#installation) * [开发进展](https://cn.wordpress.org/plugins/nonce-failure-explainer/#developers) [支持](https://wordpress.org/support/plugin/nonce-failure-explainer/) ## 描述 “Security check failed” is an outcome, not a diagnosis. It does not tell you whether the nonce field was missing, the action string differed, the session ended, a cached page served a stale value, or the nonce simply expired. Nonce Failure Explainer records every failed nonce check and states the most likely cause, along with the specific thing to check next. #### What it records For each failure: * The most likely cause, with an explicit confidence level * A concrete next check to run * The nonce action string * The request type (ajax, rest, admin, admin-post, cron, cli, frontend), method, and path * A best-effort guess at which plugin or theme ran the check * Whether the user was logged in #### What it never records * The nonce value itself * Authentication cookies or session tokens * Passwords, API keys, or any request body * Query strings, which routinely carry one-time tokens Function arguments are excluded from the stack trace capture, so sensitive values are never even loaded into memory during attribution. #### Causes it distinguishes * **No nonce was submitted** — the field or query argument never reached the server. Confirmed, not inferred. * **The session ended** — an auth cookie arrived but no longer resolves to a user. * **A cached page served a stale nonce** — detected when an anonymous request fails while a known caching layer is active. * **No session token** — the user is logged in but has no session for the nonce to key against. * **Expired or mismatched action** — everything needed was present, so the value itself did not match. #### Design Read-only. The plugin observes and explains; it never alters a request, extends a nonce lifetime, or changes site behaviour in any way. Storage is a single non- autoloaded option capped at 200 events with a seven-day expiry, so it cannot grow unbounded on a busy site. Nothing is sent anywhere. There is no external service, no telemetry, and no phone- home. ## 屏幕截图 [⌊Tools → Nonce Failures. Each failure carries a confidence level, the specific thing to check next, the request context it came from, and where possible the plugin that ran the check.⌉⌊Tools → Nonce Failures. Each failure carries a confidence level, the specific thing to check next, the request context it came from, and where possible the plugin that ran the check.⌉[ Tools Nonce Failures. Each failure carries a confidence level, the specific thing to check next, the request context it came from, and where possible the plugin that ran the check. ## 安装 1. Upload the plugin to `/wp-content/plugins/nonce-failure-explainer`, or install it through the Plugins screen. 2. Activate it. 3. Reproduce the failing request. 4. Visit **Tools Nonce Failures**. ## 常见问题 ### Does this fix nonce failures? No, and deliberately so. Version 1 is a diagnostic tool. Automatically extending nonce lifetimes or bypassing checks would weaken the protection nonces exist to provide. ### Will it slow my site down? The recorder only does work when a check actually fails, which on a healthy site is never. There is no cost on successful requests. ### Why does it say “possible cause” rather than telling me exactly what happened? Because WordPress does not distinguish an expired nonce from one generated for a different action — both simply fail to match. Where the cause can be established as fact, the plugin says “Confirmed”. Where it is inference, it says so. ### Is it safe on a production site? Yes. It is read-only, stores no secrets, and caps its own storage. The clearing action is capability-checked and nonce-protected. ### Does it work with multisite? Yes. The log is per-site, and uninstalling clears it across every site in the network. ## 评价 此插件暂无评价。 ## 贡献者及开发者 「Nonce Failure Explainer」是开源软件。 以下人员对此插件做出了贡献。 贡献者 * [ Syed Shahzaib Hassan ](https://profiles.wordpress.org/shahzaibhassan/) [帮助将「Nonce Failure Explainer」翻译成简体中文。](https://translate.wordpress.org/projects/wp-plugins/nonce-failure-explainer) ### 对开发感兴趣吗? 您可以[浏览代码](https://plugins.trac.wordpress.org/browser/nonce-failure-explainer/)， 查看[SVN仓库](https://plugins.svn.wordpress.org/nonce-failure-explainer/)，或通过 [RSS](https://plugins.trac.wordpress.org/log/nonce-failure-explainer/?limit=100&mode=stop_on_copy&format=rss) 订阅[开发日志](https://plugins.trac.wordpress.org/log/nonce-failure-explainer/)。 ## 更新日志 #### 1.0.0 * Initial release. ## 额外信息 * 版本 **1.0.0** * 最后更新：**1 天前** * 活跃安装数量 **不到10** * WordPress 版本 ** 5.6 或更高版本 ** * 已测试的最高版本为 **7.1** * PHP 版本 ** 7.4 或更高版本 ** * 语言 * [English (US)](https://wordpress.org/plugins/nonce-failure-explainer/) * 标签 * [ajax](https://cn.wordpress.org/plugins/tags/ajax/)[debugging](https://cn.wordpress.org/plugins/tags/debugging/) [developer](https://cn.wordpress.org/plugins/tags/developer/)[nonce](https://cn.wordpress.org/plugins/tags/nonce/) [security](https://cn.wordpress.org/plugins/tags/security/) * [高级视图](https://cn.wordpress.org/plugins/nonce-failure-explainer/advanced/) ## 评级 尚未提交反馈。 [您的评价](https://wordpress.org/support/plugin/nonce-failure-explainer/reviews/#new-post) [查看全部评论](https://wordpress.org/support/plugin/nonce-failure-explainer/reviews/) ## 贡献者 * [ Syed Shahzaib Hassan ](https://profiles.wordpress.org/shahzaibhassan/) ## 支持 有话要说吗？是否需要帮助？ [查看支持论坛](https://wordpress.org/support/plugin/nonce-failure-explainer/)