WordPress Meta Box Example: Save Post Metadata Safely

Last reviewed: April 24, 2026

Meta boxes are still common in WordPress editorial workflows because they let teams attach structured data to posts without building a full custom admin screen. The risk is that developers often treat a meta box like a simple form field and forget that save_post runs in many contexts, including autosaves, revisions, quick edits, and bulk operations.

This guide shows a safe pattern for adding a post-level status note with a meta box, then saving it with nonce checks, capability checks, autosave protection, and tight sanitization.

Register the meta box

<?php
add_action( 'add_meta_boxes', 'vulnwp_register_status_note_meta_box' );

function vulnwp_register_status_note_meta_box() {
	add_meta_box(
		'vulnwp_status_note',
		__( 'Status Note', 'vulnwp' ),
		'vulnwp_render_status_note_meta_box',
		'post',
		'side',
		'default'
	);
}

Keep the box attached to the smallest relevant post type. If only blog posts need the field, do not register it globally for every post object in wp-admin.

Render the field and nonce

function vulnwp_render_status_note_meta_box( WP_Post $post ) {
	$value = get_post_meta( $post->ID, '_vulnwp_status_note', true );

	wp_nonce_field( 'vulnwp_save_status_note', 'vulnwp_status_note_nonce' );
	?>
	<p>
		<label for="vulnwp-status-note">Editorial note</label>
		<textarea id="vulnwp-status-note" name="vulnwp_status_note" rows="5" style="width:100%;"><?php echo esc_textarea( $value ); ?></textarea>
	</p>
	<?php
}

The nonce proves the save request came from your edit screen. esc_textarea() protects the existing value when it is rendered back into the form.

Save the field safely

add_action( 'save_post_post', 'vulnwp_save_status_note_meta_box' );

function vulnwp_save_status_note_meta_box( $post_id ) {
	if ( ! isset( $_POST['vulnwp_status_note_nonce'] ) ) {
		return;
	}

	if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['vulnwp_status_note_nonce'] ) ), 'vulnwp_save_status_note' ) ) {
		return;
	}

	if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
		return;
	}

	if ( wp_is_post_revision( $post_id ) ) {
		return;
	}

	if ( ! current_user_can( 'edit_post', $post_id ) ) {
		return;
	}

	$value = isset( $_POST['vulnwp_status_note'] )
		? sanitize_textarea_field( wp_unslash( $_POST['vulnwp_status_note'] ) )
		: '';

	if ( '' === $value ) {
		delete_post_meta( $post_id, '_vulnwp_status_note' );
		return;
	}

	update_post_meta( $post_id, '_vulnwp_status_note', $value );
}

Using save_post_post keeps the callback focused on standard posts. That is cleaner than hooking the generic save_post action and branching inside the callback for every post type.

Register the meta key if the value matters elsewhere

If the field should be exposed to the REST API or validated centrally, register the meta key explicitly. That makes intent clearer and avoids loose custom field handling later.

add_action( 'init', 'vulnwp_register_status_note_meta' );

function vulnwp_register_status_note_meta() {
	register_post_meta(
		'post',
		'_vulnwp_status_note',
		array(
			'single'            => true,
			'type'              => 'string',
			'sanitize_callback' => 'sanitize_textarea_field',
			'show_in_rest'      => false,
			'auth_callback'     => function() {
				return current_user_can( 'edit_posts' );
			},
		)
	);
}

Production checklist

• Use a nonce for every meta box save.
• Skip autosaves and revisions.
• Check the correct edit capability for the target post.
• Use the narrowest save hook you can.
• Delete empty metadata instead of storing empty strings forever.
• Register the meta key if other code depends on it.

Common mistakes

• Saving on every save_post run without guards. That catches autosaves and revisions unexpectedly.
• Trusting $_POST blindly. The edit screen is not a trust boundary.
• Printing raw meta values back into the form. Always escape on output.
• Using public meta keys without a reason. Internal values are usually better prefixed and private.
• Mixing UI logic and persistence logic. Keep rendering and saving separate.

Related reading

If the field should become structured REST data, pair this with the register_post_meta example. If the value is later used in front-end markup, combine it with the shortcode output guide so rendering stays escaped.

References and further reading

• WordPress Code Reference: add_meta_box()
• WordPress Code Reference: save_post
• WordPress Code Reference: register_post_meta()