🚀 Ace Your IT Interviews Programming · Cloud · Data Engineering · ERP & More

Explore Interview Topics →

WordPress AJAX Returns -1 & Action Not Firing – Complete Fix

⚡ Developer Guide Updated August 23, 2026 ⏱ 12 min read

Two of the most frustrating WordPress AJAX issues: the dreaded -1 response and the silent failure where your action simply doesn't fire. This guide covers both, with step‑by‑step fixes, code examples, and debugging strategies.

📑 Contents

• 1. Introduction
• 2. AJAX in WordPress
• 3. Understanding -1 Error
• 4. What is a Nonce?
• 5. Common Causes of -1
• 6. Fixing -1 (Step‑by‑Step)
• 7. Action Not Firing – Complete Fix
• 8. Code Examples
• 9. Best Practices
• 10. FAQ

🌍 World Newspaper Hub 500+ Global Newspapers 📘 Free IT Tutorials JavaScript, Python, Cloud & more 🛠️ 100+ Free Tools Dev, SEO, daily tasks 📚 eBook Collection Free for download 🇧🇩 Free Question Bank BCS, HSC, SSC & more 🖼️ AI Background Remover Free & instant 🏷️ Barcode & Label Generator QR, A4 sheets 📱 QR Code Generator Custom & free 🤖 AI Prompt Generator 40+ professional types 🎓 IT Career Training Bangladesh

1. Introduction

WordPress AJAX is a powerful tool, but it can be notoriously finicky. Two common pain points are: the -1 response (usually a nonce verification failure) and the action not firing at all (often due to hook registration or permission issues). This article tackles both, providing you with a complete diagnostic and resolution workflow.

💡 Goal: By the end of this guide, you'll be able to identify and fix any AJAX issue in WordPress, whether it's a security block or a silent no‑op.

2. AJAX in WordPress

WordPress routes all AJAX requests through admin-ajax.php. Your JavaScript sends an action parameter, and WordPress looks for a hook named wp_ajax_{action} (for logged‑in users) or wp_ajax_nopriv_{action} (for guests). If the hook is found, your callback runs.

When something breaks, you might get -1 (security failure) or simply nothing (action not firing). We'll address both scenarios.

3. Understanding the -1 Error

The -1 response is WordPress's default "access denied" signal. It appears when:

• Nonce verification fails
• Action hook is not registered (or misspelled)
• User lacks required permissions
• Authentication check fails

⚠️ Most common: Nonce mismatch. Always start there.

4. What is a Nonce?

A nonce (number used once) is a security token that protects against CSRF attacks. WordPress generates nonces with wp_create_nonce() and verifies them with check_ajax_referer() or wp_verify_nonce().

🔐 Nonce Flow:
Create → Pass to JS → Send with request → Verify on server

5. Common Causes of -1

• Missing nonce in the AJAX data.
• Action name mismatch between wp_create_nonce() and check_ajax_referer().
• Expired nonce (default 12‑24 hours).
• User logged out – nonces are user‑specific.
• Cached nonce – JavaScript uses old value after login.
• Wrong hook (e.g., using nopriv for logged‑in users).

6. Fixing -1 – Step‑by‑Step

Step 1: Generate the Nonce in PHP

// functions.php
add_action('wp_enqueue_scripts', 'my_ajax_enqueue');
function my_ajax_enqueue() {
    wp_enqueue_script('my-ajax-js', get_template_directory_uri() . '/js/my-ajax.js', ['jquery'], null, true);
    wp_localize_script('my-ajax-js', 'my_ajax_obj', [
        'ajax_url' => admin_url('admin-ajax.php'),
        'nonce'    => wp_create_nonce('my_ajax_nonce_action')
    ]);
}

Step 2: Send the Nonce in JavaScript

// my-ajax.js
jQuery(document).ready(function($) {
    $('#my-button').on('click', function() {
        $.ajax({
            url: my_ajax_obj.ajax_url,
            type: 'POST',
            data: {
                action: 'my_ajax_action',
                _wpnonce: my_ajax_obj.nonce,
                // other data
            },
            success: function(response) { console.log(response); }
        });
    });
});

Step 3: Verify the Nonce in the Callback

add_action('wp_ajax_my_ajax_action', 'my_ajax_callback');
add_action('wp_ajax_nopriv_my_ajax_action', 'my_ajax_callback');

function my_ajax_callback() {
    check_ajax_referer('my_ajax_nonce_action', '_wpnonce');
    // your logic
    wp_send_json_success('OK');
}

Step 4: Debug with Detailed Messages

function my_ajax_callback() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'my_ajax_nonce_action')) {
        wp_send_json_error('Nonce verification failed', 403);
        return;
    }
    // ...
}

✅ Pro Tip: Use wp_send_json_error() with clear messages to pinpoint where the failure occurs.

7. WordPress AJAX Action Not Firing – Complete Fix

Sometimes your AJAX request doesn't return -1; it just returns 0 or nothing, and your callback never runs. This usually means the action hook isn't being triggered.

Common Reasons Why an AJAX Action Doesn't Fire

• Wrong action parameter – The action sent in the request doesn't match the hook name.
• Missing hook registration – You forgot to add add_action('wp_ajax_...') or wp_ajax_nopriv.
• Hook added too late – If the hook is registered after the AJAX request is processed (e.g., in a shortcode that isn't executed).
• Plugin/theme conflict – Another plugin removes your hook or interferes.
• User permissions – The callback checks for a capability that the user doesn't have, and exits early.
• Die or exit in callback – If your callback calls wp_die() or exit before sending a response, it may appear as if nothing happened.
• JavaScript errors – The request might not even be sent due to JS errors.

Step‑by‑Step Debugging for Action Not Firing

1. Verify the Action Name

The action parameter in your JavaScript must exactly match the hook suffix. For example, if your hook is wp_ajax_my_custom_action, then your JS must send action: 'my_custom_action'. Case‑sensitive!

2. Check Hook Registration

Ensure both wp_ajax_{action} and wp_ajax_nopriv_{action} are added if you want to support both logged‑in and guest users.

add_action('wp_ajax_my_custom_action', 'my_callback');
add_action('wp_ajax_nopriv_my_custom_action', 'my_callback');

3. Confirm the Hook is Executed

Temporarily add an error_log() at the top of your callback to see if it's called at all. If the log shows nothing, the hook isn't firing.

function my_callback() {
    error_log('AJAX callback fired!');
    // ... rest
}

4. Check for Early Exit or Die

If your callback contains wp_die() or exit without sending a proper JSON response, the browser might not receive any data. Use wp_send_json_success() or wp_send_json_error() which handle the die for you.

5. Inspect the Request in Browser DevTools

Open the Network tab, find the request to admin-ajax.php, and check the payload. Ensure the action parameter is present and correct. Also check the response – often you'll see a 0 or a PHP warning that hints at the issue.

6. Verify User Capabilities

If your callback checks for current_user_can('manage_options') and the user doesn't have that capability, the function may return early. Ensure the user has the required role or use current_user_can() appropriately.

7. Check for Hook Priority or Overrides

Sometimes a plugin runs remove_action() on your hook. Search your codebase for remove_action('wp_ajax_my_custom_action'). Also, ensure your add_action is called at the right time (e.g., in a plugin file that is loaded, not inside a conditional that only runs on certain pages).

8. Test with a Minimal Example

Create a simple test hook and callback to rule out interference from other code. If the test works, the problem is in your specific implementation.

🔍 Quick Check: If your AJAX request returns 0, it often means the wp_ajax_{action} hook is not registered, or the callback didn't output anything. Use the debugging steps above to find the root cause.

8. Complete Code Example (Both Issues Covered)

Below is a fully functional example that includes proper nonce handling and robust action registration, preventing both -1 and "action not firing" issues.

// ==============================
// PHP (functions.php or plugin)
// ==============================
add_action('wp_enqueue_scripts', 'fl365_ajax_enqueue');
function fl365_ajax_enqueue() {
    wp_enqueue_script('fl365-ajax', get_template_directory_uri() . '/js/fl365-ajax.js', ['jquery'], '1.0', true);
    wp_localize_script('fl365-ajax', 'fl365_ajax', [
        'ajax_url' => admin_url('admin-ajax.php'),
        'nonce'    => wp_create_nonce('fl365_ajax_nonce'),
    ]);
}

// Register hooks for both logged-in and guest
add_action('wp_ajax_fl365_ajax_action', 'fl365_ajax_handler');
add_action('wp_ajax_nopriv_fl365_ajax_action', 'fl365_ajax_handler');

function fl365_ajax_handler() {
    // Verify nonce – returns -1 on fail if not handled
    if (!check_ajax_referer('fl365_ajax_nonce', '_wpnonce', false)) {
        wp_send_json_error(['message' => 'Nonce verification failed'], 403);
        return;
    }

    // Check user capability (optional)
    if (!current_user_can('read')) {
        wp_send_json_error(['message' => 'Insufficient permissions'], 403);
        return;
    }

    // Your business logic
    $data = sanitize_text_field($_POST['data'] ?? '');
    wp_send_json_success(['message' => 'Received: ' . $data]);
}

// ==============================
// JavaScript (fl365-ajax.js)
// ==============================
jQuery(document).ready(function($) {
    $('#fl365-btn').on('click', function() {
        $.ajax({
            url: fl365_ajax.ajax_url,
            type: 'POST',
            data: {
                action: 'fl365_ajax_action', // must match hook suffix
                _wpnonce: fl365_ajax.nonce,
                data: 'Hello from frontend!'
            },
            success: function(res) {
                if (res.success) {
                    alert('✅ ' + res.data.message);
                } else {
                    alert('❌ ' + res.data.message);
                }
            },
            error: function(xhr) {
                console.error('AJAX error:', xhr.responseText);
            }
        });
    });
});

9. Best Practices

• Always use nonces – never skip verification.
• Register both wp_ajax and wp_ajax_nopriv if you need both user states.
• Use descriptive action names to avoid collisions.
• Sanitize and validate all input – never trust user data.
• Return structured JSON with wp_send_json_success/error.
• Log errors to error_log for debugging.
• Test with different user roles and guest sessions.
• Cache nonces appropriately – refresh on login.

10. Frequently Asked Questions

Click a question to expand the answer.

🎯 Land Your Dream IT Job Expert interview prep · Programming · Cloud · Data · ERP

Start Preparing Now →

FreeLearning365.com — Learn free · Build skills · Grow your career.
📧 FreeLearning365.com@gmail.com