Nonces & CSRF protection in WordPress

When to use this skill

Use this skill whenever code accepts or acts on a request that changes state or performs a privileged action. Concretely:

• HTML <form> submissions (admin or front-end) handled via admin-post.php, admin_post_*, or a settings page.
• admin-ajax.php handlers (wp_ajax_*, wp_ajax_nopriv_*) and fetch()/jQuery AJAX.
• Action links such as "Delete", "Approve", "Activate" that carry a query argument.
• Settings API pages (the Settings API adds a nonce automatically — verify you are not bypassing it).
• Any custom endpoint reached over $_GET / $_POST / $_REQUEST.

If a request only reads public data and changes nothing, a nonce is not required — but the moment it writes, deletes, or triggers a side effect, it is mandatory.