What the check looks at
C6 reads the public pages that check C3 reads (home, newest post, shop page, newest product) and looks for a WordPress nonce in the HTML: a _wpnonce field, or a script value named nonce, _wpnonce, restNonce, storeApiNonce or ajax_nonce.
On a cached page it compares the age header with nonce_life, one day unless a filter changes it. WordPress accepts a nonce for the current half of that time and the one before, so a nonce lasts between half and all of nonce_life.
Like every request Edge Doctor sends, these go only to the hosts of your Site Address and WordPress Address (home_url() and site_url()). An address WordPress gives on another host, such as a single sign on page, is never requested.
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: Medium | No cached page carries a nonce Pages are cached at the edge, and none of the cached ones carries a nonce. |
| WarningConfidence: Low | A cached page carries a form token A cached page has a nonce, but the copy is still young, so the plugin could not confirm yet whether it stays cached long enough to expire. |
| WarningConfidence: Medium | A cached page is old enough to worry about The cached copy is older than half of nonce_life. |
| WarningConfidence: Medium | APO is holding a page that carries a nonce Automatic Platform Optimization keeps HTML for up to 30 days, far longer than a nonce lasts. |
| FailedConfidence: High | A cached page carries an expired nonce The copy is older than nonce_life, so the form on it fails for every visitor who submits it. |
| Could not checkConfidence: Medium | This check could not be completed Every address answered with the WooCommerce Coming soon page ( maintenance). |
| Could not checkConfidence: Low | This check could not be completed No page could be read. |
| Not applicable | No cached page to check for an expired nonce No HTML is cached at the edge ( not_observed). |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
maintenance: The site is in maintenance mode or behind a coming soon page, so the pages read were not the real ones.not_observed: The plugin has not seen this happen on your site.loopback_failed: Your server could not reach its own site, so this check had nothing to read. The plugin links this result to its own guide: Your server could not reach its own site.blocked_by_config: WordPress itself refused the requests from your site to itself, so none was sent. WP_HTTP_BLOCK_EXTERNAL is on, and your own address is not let through. The plugin links this result to its own guide: WordPress blocks requests to your own site.not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- A contact form, comment form, newsletter signup or add to cart works for you but fails for visitors, often with a security or expired link error.
- Nothing in the server logs explains it, because the failing page never reached the server.
Why it happens
A nonce is written into the page when WordPress builds it. A cached copy keeps serving the same nonce, and once the copy is older than the nonce lasts, every submission from it is refused.
APO caches content for 30 days and invalidates it within 30 seconds of a change (Cloudflare: APO FAQ); a page that does not change keeps its old nonce.
Confirm it by hand
curl -sI "https://example.com/contact/" | grep -iE "cf-cache-status|^age"
curl -s "https://example.com/contact/" | grep -oE "_wpnonce[^>]{0,80}"A HIT with an age above 43200 seconds (half a day, with the default nonce_life) on a page with a nonce is the risk.
How to fix it
In Cloudflare: keep the Edge TTL of HTML shorter than half of nonce_life, or exclude pages with forms from the Cache Rule.
In WordPress: some form and shop plugins can load their nonce after the page loads instead of writing it into the HTML; check their settings. Purge the cache after any change.
Limitations
Only the sample pages are read, through the data center the server’s requests pass through. A form on another page is not seen.
Nonces that a plugin prints under other names are not recognised.
Right after a purge, every copy is young, so the result can only be the Low confidence Warning until the cache ages.
Related checks
- C3 Logged-in pages in the public cache: reads the same pages for signed in content.
- C7 Cached HTML without a purge: whether anything clears the cache.
- C4 REST API and Store API in the cache: nonces in cached API answers.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.