For a long time I was using a CiviCRM form for signing up people to our mailing lists, and doing it using html for the form on a non-CiviCRM page.

I have a memory that there used to be an option in the CiviCRM Profile Settings page to export a html snippet you could cut and paste in this manner. This no longer seems to be there.

The problem is that it has stopped working of late - when I upgraded from 4.7.8 to 4.7.11, though I'm only noticing now. When I submit the form using the CiviCRM page

<CiviCRM Install>/?page=CiviCRM&q=civicrm%2Fprofile%2Fcreate&gid=15&reset=1

it works fine. But when I go to the non-CiviCRM page, which worked previously, it no longer works, and I get the following error:

Sorry but we are not able to provide this at the moment. We can't load the requested web page. This page requires cookies to be enabled in your browser settings. Please check this setting and enable cookies (if they are not enabled). Then try again. If this error persists, contact the site administrator for assistance.

Site Administrators: This error may indicate that users are accessing this page using a domain or URL other than the configured Base URL. EXAMPLE: Base URL is http://example.org, but some users are accessing the page via http://www.example.org or a domain alias like http://myotherexample.org.

Error type: Could not find a valid session key.`

Any ideas? I've checked all the Resource URLS and they seem fine. I've checked the html code and, again, it works fine on the CiviCRM generated page but not on the static HTML page.

I'm using 4.7.12 on Wordpress 4.6.1.

2 Answers 2


Looking at the release notes for CiviCRM 4.7.11 there was a security issue that was fixed to do with these external snippets: https://civicrm.org/advisory/civi-sa-2016-17-manage-csrf-overrides-for-external-profile-forms

The release notes state, though, that existing installations should not have been affected by the update.

I would recommend that you look in the settings (Administer => System Settings => Misc) for the QF key security on profile forms.

If this setting has been enabled then it sounds like a bug - as the release notes suggest it should not have been enabled when upgrading an existing installation. If so then report it on the issue log and comment back here with a link =]

It is certainly worth reviewing that security issue though, which discusses the implications of using HTML snippets (and offers some preferable alternatives).

  • 1
    Yes, that it exactly the issue. I've changed that now and it's fixed, albeit with lesser security as a result. I'll have to look up now how to stop malicious form POST attacks. Thanks @John !
    – Vshura
    Oct 7, 2016 at 11:28
  • @Vshura if the setting was automatically applied during the update then can you open an issue on the issue queue? issues.civicrm.org/jira/secure/Dashboard.jspa . This may have affected other organisations as well. But I'm glad this helped solve the issue.
    – John
    Oct 7, 2016 at 14:47
  • Hi @John. No, I'm pretty sure it was something I turned on after a security alert with the update to 4.7.11, rather than something that automatically changed. Thanks again.
    – Vshura
    Oct 10, 2016 at 11:49

Though not a direct answer to your question, please see the below answer for an alternative to using the HTML Snippet method for embedding CiviCRM forms on a WordPress page or in a WordPress widget:


Short version recap: use Caldera Forms and Caldera Forms CiviCRM plugins.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.