check_admin_referer()

check_admin_referer() — Ensures intent by verifying that a user was referred from another admin page with the correct security nonce. This function ensures the user intends to perform a given action, which helps protect against clickjacking style attacks. It verifies intent, not authorization, therefore it does not verify the user’s capabilities. This should be performed with current_user_can() or similar. If the nonce value is invalid, the function will exit with an “Are You Sure?” style message.

Inputs: $action (int|string): The nonce action. $query_arg (string): Optional. Key to check for nonce in $_REQUEST. Default ‘_wpnonce’.

Returns int|false: 1 if the nonce is valid and generated between 0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago. False if the nonce is invalid. Only possible when $action is -1, as the function otherwise exits rather than returning false.