From 47c31cee14cbf62d98510b11b8e32d6cbd5dc221 Mon Sep 17 00:00:00 2001
From: Dhanuka Gunarathna <nuwan.dhanuka@gmail.com>
Date: Thu, 4 Jun 2026 15:24:22 +0200
Subject: [PATCH] Nonce verification sniff documentation

---
 .../Security/NonceVerificationStandard.xml    | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 WordPress/Docs/Security/NonceVerificationStandard.xml

diff --git a/WordPress/Docs/Security/NonceVerificationStandard.xml b/WordPress/Docs/Security/NonceVerificationStandard.xml
new file mode 100644
index 0000000000..6881033916
--- /dev/null
+++ b/WordPress/Docs/Security/NonceVerificationStandard.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0"?>
+<documentation xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://phpcsstandards.github.io/PHPCSDevTools/phpcsdocs.xsd"
+    title="Nonce Verification"
+    >
+    <standard>
+    <![CDATA[
+    When processing form data, the nonce value must be verified before processing the form data. Nonce verification will protect your website from Cross-Site Request Forgery (CSRF) attacks.
+    ]]>
+    </standard>
+    <code_comparison>
+        <code title="Valid: The nonce value is verified before processing the form data.">
+        <![CDATA[
+if (
+    <em>wp_verify_nonce</em>(
+        $_POST['foo_nonce'],
+        'foo_action'
+    )
+) {
+    $foo = sanitize_text_field(
+        wp_unslash( $_POST['foo'] )
+    );
+}
+        ]]>
+        </code>
+        <code title="Invalid: The form data is processed without verifying the nonce value.">
+        <![CDATA[
+if ( isset( $_POST['foo'] ) ) {
+    $foo = sanitize_text_field(
+        wp_unslash( $_POST['foo'] )
+    );
+}
+        ]]>
+        </code>
+    </code_comparison>
+</documentation>