---
title: "CSRF Token Protection - Convert Forms"
description: "Protects against cross-site request forgery (CSRF) attacks by ensuring that each form submission includes a valid security token."
url: "https://www.tassos.gr/docs/convert-forms/security/csrf-token"
date: "2026-11-06T10:43:19+00:00"
language: "en-GB"
---

[ Home ](https://www.tassos.gr/docs) / [ Convert Forms ](https://www.tassos.gr/docs/convert-forms) / [ Spam, Security & Compliance ](https://www.tassos.gr/docs/convert-forms/security)

#  CSRF Token Protection

##  Protects against cross-site request forgery (CSRF) attacks by ensuring that each form submission includes a valid security token.

 ![CSRF Token Protection](https://www.tassos.gr/images/2026/11/convert-forms-csrf-token-card.png)The CSRF token check makes every form submission prove it came from a page on your site. When it's on, Convert Forms only accepts a submission if it carries the visitor's Joomla security token, and it rejects everything else before any of your form's tasks run.

## [How it works](#how-it-works)

Joomla gives every visitor session a unique security token, also known as a CSRF token. When the check is on, Convert Forms reads that token from each submission and compares it with the visitor's session. It checks the same token on the requests some fields send in the background, like file uploads.

Many spam bots never load your page. They send their data straight to the form's submission URL, so they have no valid token, and the check blocks them.

The check is off by default and applies to every form on your site.

## [Enable the CSRF token check](#enable)

1. Log into your Joomla backend.
2. Go to Components → Convert Forms.
3. Click **Options** in the top-right toolbar.
4. Open the **Security** tab.
5. Set **Use Joomla! CSRF Token** to **Yes**.
6. Save.

Then submit a test entry from the front end to make sure the form still works.

 If your site uses full-page caching, like Joomla's Page Cache plugin or a proxy such as Cloudflare or Sucuri that caches whole pages, visitors can get a cached page that holds someone else's token. Their submissions then fail with an invalid security token error. Test the form after enabling the check, and see the troubleshooting section below if it fails.

## [Troubleshooting](#troubleshooting)

### [Visitors see an invalid security token error](#invalid-token)

The message *The most recent request was denied because it contained an invalid security token* means the token in the submission didn't match the visitor's session. It usually happens because:

- The Session Lifetime in Joomla's Global Configuration is too low, so the session expires while the visitor is still filling in the form. Raising it means fewer invalid token errors for real visitors.
- Joomla's Page Cache plugin is enabled. In most cases, disabling it fixes the error.
- You load the form with a module while Joomla's cache is on. Disable the module's Caching option.

If none of these helps, turn the check off again:

1. Log into your Joomla backend.
2. Go to Components → Convert Forms.
3. Click **Options** in the top-right toolbar.
4. Open the **Security** tab.
5. Set **Use Joomla! CSRF Token** to **No**.
6. Save.

For other ways to stop spam, see [Troubleshooting Spam Submissions](https://www.tassos.gr/docs/convert-forms/troubleshoot/spam-submissions).

 Last updated on Nov 6th 2026 09:11