I'm having problems with a freeform form since upgrading to EE2.8. It keeps giving the following error on submit

This form has expired. Please refresh and try again.

Template caching is off.

Running freeform 4.1.3

<h3>Name:</h3><p><input type="text" name="name" /></p>
<h3>Email:</h3><p><input type="text" name="email" /></p>
<h3>Questions or Comments:</h3><p><textarea name="comment" rows="6" ></textarea></p>
<p><input type="submit" name="submit" value="Send It" class="button" /></p>
  • Their last release was Oct 16 2013, sometimes third party vendors need time to catch up to the current expressionengine version. You might need to contact solspace to see if you can work it out with them until their next verson comes out. Commented Mar 3, 2014 at 20:03
  • 1
    Thanks Johnathan. I know it's early days but just wanted to double check and get this up here so it may be of help to others. Commented Mar 4, 2014 at 7:40
  • Did you ever get a response on this issue? 4.1.8 is having this issue with EE 2.8.1
    – Cogweb
    Commented Jun 6, 2014 at 11:17
  • This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question once you have enough reputation.
    – Max Lazar
    Commented Jun 6, 2014 at 11:49

3 Answers 3


This issue involves the changed security module within EE. Solspace are working on the proper solution however I have also advised them on how to fix this issue (in a different module, facebook connect).

To help them and the community, try this:

  1. Identify the action used to submit the freeform (refer to the exp_actions) table.
  2. Modify the action in exp_actions, and set the csrf_exempt column to 1 (true)

Try to submit your freeform, if it works then this is indeed the security model issue.

The above fix will work for you however it should be noted that this removes the freeform submission from the standard cross site scripting checks. You are relying on SolSpace's module to validate the submission.

As always, for production purposes I recommend you wait for SolSpace's official patch, but if the above method helps, please let SolSpace (and us) know!!

  • Thanks. It seems I've just come up against this issue with Freeform 4.1.8, even though solspace.com/software/compatibility says 4.1.6 or greater is EE 2.8.x compatible. I have posted a support ticket to Solspace and will report back. Commented May 22, 2014 at 15:41
  • Same issue and fix in FF 4.2.0 on EE 2.8.1. Thanks! Commented Jan 29, 2015 at 15:51

Freeform 4.1.3 is not compatible with EE 2.8. Solspace are working on an update.

Adjusting csft_exempt to 1 in the exp_actions table (Freeform - save_form ) got rid of the error so it looks like this has been caused by the security model issue.

  • Has this been fixed yet? Geting the exact same error in FF 4.2.0 on EE 2.8.1 Commented Jan 29, 2015 at 15:43

I received the form expired error message using Freeform 4.2.2 and EE 2.9.2. I added this to config.php:

$config['disable_csrf_protection'] = "y";

The form submitted, but I really didn't want to leave that setting there. I did a little more digging and found that I needed to add a CSRF Token to my form. So I added this hidden input within my freeform tags:

<input type="hidden" name="csrf_token" value="{csrf_token}">

I was then able to delete the config change above and the form submitted successfully.

  • FYI, This would work too for Freeform, as you're manually adding the value you need. My advise was based on the Facebook Connect module as I said which posts to facebook, not the EE site so I couldn't pass a csrf to facebook and back, leaving the only option of disabling the csrf for the particular call back...
    – Blatant
    Commented Apr 10, 2015 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.