civicrm 4.7.24 wordpress 4.9.5

When logged in I can access, edit and add to a multirecord profile eg enter image description here

When not logged in, using identical link (domain.org/civicrm/?page=CiviCRM&q=civicrm/profile/edit&gid=20&reset=1&id=NNNN&cs=c1ae6c62c8b56de0b98cc786cb7e96dc_1523257945_720)

the profile is displayed for the correct user (so the checksum is respected at this point) however the [view][edit][delete] buttons appear as 2 4 8 and (add new record) gives permission error

eg enter image description here

The only way I can get it to work is by enabling "edit all contacts" for anonymous users. No thanks!

Please note that it works fine when logged in as admin so please no suggestions relating to the format of the link or multrecord profiles

I am unable to test on demo site as mail is disabled so I can't generate checksum

3 Answers 3


I was having a bugger of a time troubleshooting a similar problem with the checksum capability for anonymous users. After trying and identifying many different potential causes such as:

  • cid versus id for the contact
  • the order of the checksum or contactid tokens
  • ACL permissions
  • whether SSL or non-SSL made a difference
  • update to CiviCRM 5.0 (currently on CiviCRM 4.7.30 with WP 4.9.5)

What fixed it was having %2F instead of the '/' in the query parameters of the URL. I needed to explicitly put the '%2F' (without the single quotes) in the URL instead of the '/'. For instance, in your example above the URL section:


should be changed to


NOW my mailings work with checksums! Wahoo! Hope this helps someone else on WordPress.


I believe that Civi ACLs are not intended to work for anonymous users.

I get similar behavior to your example with Civi 5.0.0 and Wordpress 4.8.6 using ACLs for a user to create a profile and access specific custom data records. A logged in user with these ACLs can access the profile and custom data, but the same user coming from a checksum token link cannot. In this case the user is coming in with the anonymous CMS role. If the Wordpress access control for the anonymous user has create profile and custom data checked, then it works from a checksum token, but that's too coarse permission in some cases. This statement comes from the online documentation:

Collecting data from anonymous visitors using profiles

If you have built profiles to collect data from anonymous visitors through online forms (e.g. event registration pages, contribution pages and standalone profile forms), the permission profile create will need to be given to the "anonymous" role. Furthermore, should the profile contain any custom fields, an additional permission will need to be given, depending on the circumstances. Read "Accessing custom data" below.

  • "If the Wordpress access control for the anonymous user has create profile and custom data checked, then it works from a checksum token" So are you saying you can get the checksum to work? I have both those permissions for anonymous user but to no avail. As I say the only permission that makes it work is "edit all contacts"
    – LesleyJill
    Commented Apr 27, 2018 at 2:49
  • In my configuration, the profile is called as a component of a contribution page, so I must have "make online contribution" also checked for the anon user, but those three permissions are the only ones. The URL looks like this in the browser address(abbreviated): new...ny.net/?page=CiviCRM&q=civicrm/contribute/… so its a bit different from the other answer's conditions. But this one works in 5.0. and the contact's info is prefilled and all fields are available.
    – PhilF
    Commented Apr 28, 2018 at 15:05
  • It didn't come through in the comment but the URL starts with "https://"
    – PhilF
    Commented Apr 28, 2018 at 15:12

Thanks for your help Phil and CB. I think maybe you're not using multi record custom fields? Having now duplicated this with Drupal I now suspect the add/edit functionality does not exist for MULTI-RECORD fields in public profiles. Makes sense really as although the checksummed profile displays OK to the anonymous user, the link to "add new record" ie "https://domain.com/index.php?q=civicrm/profile/edit&reset=1&id=2&multiRecord=add&gid=15&context=multiProfileDialog&onPopupClose=" no longer contains the checksum hence the permissions error. Hmm any developers out there like to give me a $quote?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.