內容簡介
Nonce Failure Explainer 外掛可協助診斷 WordPress 中的 nonce 檢查失敗問題，提供具體的錯誤原因與後續檢查建議，讓使用者能快速解決「Are you sure you want to do this?」等錯誤訊息。
【主要功能】
• 記錄每次 nonce 檢查的失敗情況
• 提供最可能的錯誤原因與信心指標
• 建議具體的後續檢查步驟
• 支援多種請求類型的診斷
• 不記錄任何敏感資訊或 nonce 值
• 讀取模式，無法更改請求或行為
外掛標籤
開發者團隊
② 後台搜尋「Nonce Failure Explainer — Diagnose "Are You Sure You Want To Do This?"」→ 直接安裝（推薦）
原文外掛簡介
If WordPress has shown you “Are you sure you want to do this?”, “Security check failed”, “The link you followed has expired”, or a bare 403 on an AJAX request, a nonce check failed. WordPress will not tell you which nonce, or why.
This plugin does. It watches every nonce check on your site, records the ones that genuinely block something, and states the most likely cause along with the specific thing to check next.
The errors this diagnoses
“Are you sure you want to do this?” — the classic admin nonce failure
“Security check failed” — the same failure, phrased by a plugin or theme
“The link you followed has expired” — an expired nonce on a link or form
A silent 403 or -1 response from admin-ajax.php
Forms that submit and appear to do nothing at all
Causes it distinguishes
No nonce was submitted — the field or query argument never reached the server. Confirmed, not inferred.
The session ended — an auth cookie arrived but no longer resolves to a user.
A cached page served a stale nonce — detected when an anonymous request fails while a known caching layer is active.
No session token — the user is logged in but has no session for the nonce to key against.
Expired or mismatched action — everything needed was present, so the value itself did not match.
What it records
For each failure:
The most likely cause, with an explicit confidence level
A concrete next check to run
The nonce action string
The request type (ajax, rest, admin, admin-post, cron, cli, frontend), method, and path
A best-effort guess at which plugin or theme ran the check
Whether the user was logged in
What it never records
The nonce value itself
Authentication cookies or session tokens
Passwords, API keys, or any request body
Query strings, which routinely carry one-time tokens
Function arguments are excluded from the stack trace capture, so sensitive values are never even loaded into memory during attribution.
Three sections
Recorded failures — the log, with headline figures and a ranking of what is failing most.
Causes and fixes — every diagnosis explained in full, with the concrete checks to run.
Environment — the settings that decide whether a nonce verifies at all: nonce lifetime, any detected page cache, persistent object cache, and login session length. A nonce lifetime shortened by another plugin, or a session shorter than the nonce it carries, explains failures that otherwise look like bugs.
Design
Read-only. The plugin observes and explains; it never alters a request, extends a nonce lifetime, or changes site behaviour in any way. Storage is a single non-autoloaded option capped at 200 events with a seven-day expiry, so it cannot grow unbounded on a busy site.
Nothing is sent anywhere. There is no external service, no telemetry, no phone-home, no upsell, and no premium version.
