I have a profile page setup where users can view their own data and modify it if necessary.

They get emailed a link to the page with a checksum token, so they do NOT have to login.

The page works fine when the checksum is not expired.

Under Administer > System Settings > Misc you can adjust the lifespan of the token (default is 7 days).

Once the token expires, if the user clicks on the link, they are simply redirected to the home page of the site.

This is terrible user experience as they are not going to know why they can not access their profile anymore.

It would make a lot more sense that they stayed on the profile page they linked to, and then the profile page should generate an error saying something like "Sorry your checksum token has expired. You will need to get a new one to access this page."

This seems like basic functionality that should be included, or maybe I am just missing something?

2 Answers 2


I agree - that behaviour is not good. I think there is an extension that changes that but I can't find it just now. Maybe someone else can link to it. That said, the handling of checksums has changed recently with the 'authx' extension which may offer new options for handling expired checksums.

  • 1
    I am less sure that the default is that you get redirected to the home page, certainly this civicrm.stackexchange.com/questions/12138/… and other bits that google found, have folk complaining in a way that clearly means the user does stay on the intended page BUT i guess that would only be true if the profile/form was available to Anonymous, so maybe that is part of the issue. J?
    – petednz - fuzion
    Commented Jul 29, 2022 at 3:02

An extension could solve your issue : https://civicrm.org/extensions/form-access-restrictions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.