when SOME people try and add their email to the mailing list they get this error:

The following errors were encountered

This form has expired. Please refresh and try again. Return to Previous Page

2 Answers 2



$config['disable_csrf_protection'] = 'y';

to your config.php and you're done.

  • This disables csrf protection on the entire site for one issue. I wouldn't say this is a solution. Sep 23, 2014 at 9:28

ExpressionEngine uses an anti CSRF technique where it assigns a value to a hidden field (i believe the field name is csrf_token (XID in version < 2.8.0) and assigns the same value to a session. At form processing stage it compares the two and if they dont match the form returns an error. I believe the error you are getting is the one that gets returned when this happens.

If the visitor is getting this error, the form might be cached at the server / network level, delivering them a stale CSRF token. Are all of the affected users on the same network? Corporate firewalls could be delivering stale pages, for instance.

  • some different users on different networks. It isn't happening to me but is for some. Jun 19, 2014 at 22:55
  • I am pretty sure it's what I have described above. I have had the same problem very recently with one of my clients.
    – Edd Aslin
    Jun 20, 2014 at 6:05
  • I do not see a solution in your comment above. What did you do to fix it? Jun 21, 2014 at 11:41
  • 1
    There should be a setting in config.php file. Something like 'csfr protection, true' - change it to false.
    – Edd Aslin
    Jun 21, 2014 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.