10.4 CSRF Protection
Cross-Site Request Forgery (CSRF) attacks trick users into performing actions they didn’t intend. Both WordPress and Laravel provide built-in CSRF protection that we implement consistently across all forms and state-changing requests.
WordPress nonces provide CSRF protection for forms and AJAX requests. We include nonces in all forms that modify data and verify them before processing submissions.
1
Laravel’s CSRF protection works automatically for all forms, but we ensure proper implementation in our Blade templates and AJAX requests.
```php<form method="POST" action=""> @csrf @method(‘PUT’)
1
2
<input type="text" name="site_title" value="">
<button type="submit">Save Settings</button>
</form>
1
2
```javascript