# Shorter Nonce Lifetime

> Makes WordPress security tokens (nonces) expire after 4 hours instead of up to 24, shrinking the window in which a leaked link can be reused.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, nonces, hardening
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/shorter-nonce-lifetime/

## Code

```php
// Lifetime in seconds. A nonce stays valid for between half and all of this time.
$wpide_nonce_life = 4 * HOUR_IN_SECONDS;

add_filter( 'nonce_life', function () use ( $wpide_nonce_life ) {
    return $wpide_nonce_life;
} );
```

## Notes

Pages left open longer than this may show "The link you followed has expired" on submit; cached pages with forms are affected too.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Shorter Nonce Lifetime" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/