I updated from 2.1.0 to 2.8.1 and afterwards tried to login to the CP, got this error.

"This form has expired. Please refresh and try again."

Made sure there was no folders in the cache but I maybe something is stuck in the db. Not sure and need some help.

Any ideas?

2 Answers 2


Ok so after 5 hours of banging my head on the table and only getting a nasty bump on my forehead I have a fix that was a 1 second fix.

Basically I had to comment out like this //$config['cookie_prefix'] = ''; in config.php

This all started to happen after I moved from a Plesk environment to a Cpanel setup.

Originally I found the follow code from another answer dealing with not being able to login and it worked so I went through and commented out 1 item at a time. Leaving me with the answer and fix, here is that code. I hope it helps save someone else time and aggravation.

$config['cookie_domain'] = ""; $config['cookie_path'] = ""; $config['cookie_prefix'] = ""; $config['admin_session_type'] = "s"; $config['user_session_type'] = "c"; $config['require_ip_for_login'] = "n"; $config['require_ip_for_posting'] = "n"; $config['secure_forms'] = "n";

  • For me, the culprit was the cookie_domain config item, which was set to the live domain in the settings, so locally it borked out.
    – Low
    Commented Dec 10, 2015 at 14:18
  • Cookie Domain here too. Thanks for saving me the 5 hours.
    – forrest
    Commented Dec 18, 2018 at 3:26
  • Thank. It is working for me. Commented Mar 25, 2021 at 7:36

I would recommend against editing the config file. Instead, it appears you need to include the following line in any that is posting

<input type="hidden" name="XID" value="{XID_HASH}" />

I had the exact same issue when updating from 2.5.2 to 2.8.1. I added that line and all is good. A few simple AJAX POSTs I converted to GETs to also get around this issue.

I found this solution on this thread: http://ellislab.com/forums/viewthread/237658/

btw, just found more info. Security changed some more in 2.8 v 2.7. So if you want to disable "secure forms" you'll need to use this in config.php instead of what is posted elsewhere.

$config['disable_csrf_protection'] = "y";

More info here: http://ellislab.com/blog/entry/sessions-login-modals-and-secure-forms-in-expressionengine-2.8

  • 1
    I upgraded from 2.7 to 2.8 and had "This form has expired" error. Adding the above <input type="hidden" name="XID" value="{XID_HASH}" /> fixed it for me. I did not need to modify the config setting. Thanks. Commented May 30, 2014 at 5:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.