{"id":23771,"date":"2024-04-05T12:27:36","date_gmt":"2024-04-05T12:27:36","guid":{"rendered":"https:\/\/ecommerce.folio3.com\/blog\/?p=23771"},"modified":"2025-08-28T16:13:04","modified_gmt":"2025-08-28T16:13:04","slug":"how-to-fix-invalid-form-key-please-refresh-the-page-error-in-magento-2","status":"publish","type":"post","link":"https:\/\/ecommerce.folio3.com\/blog\/how-to-fix-invalid-form-key-please-refresh-the-page-error-in-magento-2\/","title":{"rendered":"How to fix \u201cInvalid form key. Please refresh the page.\u201d error in Magento 2"},"content":{"rendered":"

The “Invalid form key. Please refresh the page.” error in Magento 2 typically occurs due to issues when there’s a mismatch between the form key stored in the session and the form key submitted with a form request. Form keys are a security feature in Magento that assists with Cross-Site Request Forgery (CSRF) attacks by ensuring that form submissions originate from the same Magento instance.<\/span><\/p>\n

For every session, a one-of-a-kind unique form key is produced and inserted into the form as an invisible field. Also, the equivalent is coordinated with the client’s request to affirm the legitimacy of the request.<\/span><\/p>\n

Read Also:<\/strong> Magento 2 SOAP API – A Comprehensive Guide<\/a><\/p>\n

Invalid form key. Please refresh the page. Magento 2 It is one of the most simple errors you’ve probably encountered. It might appear when you:<\/span><\/p>\n

–<\/strong> install Magento 2 extensions<\/span><\/p>\n

–<\/strong> update Magento 2<\/span><\/p>\n

–<\/strong> create a localhost account\u00a0<\/span><\/p>\n

–<\/strong> add multiple child products in configurable product<\/span><\/p>\n

–<\/strong> add a lot of upsell and cross-sell products<\/span><\/p>\n

–<\/strong> try to save an attribute with many options<\/span><\/p>\n

\"Magento<\/p>\n

\"\"<\/a><\/p>\n

Three Main Reasons why the Magento 2 \u201cInvalid form key. Please refresh the page.\u201d error appears<\/b><\/h2>\n

Server Configuration Issues<\/b><\/h3>\n

Incorrect server configurations related to sessions, cookies, or security settings can also trigger form key validation errors.\u00a0<\/span><\/p>\n

For example, misconfigured PHP settings Magento platform has specific server requirements for PHP <\/span>max_input_vars<\/b> value. It is the maximum number of variables that the server can utilize for a single request to avoid over-burdening (this value is utilized mainly to safeguard your server from DDOS assaults).<\/span><\/p>\n

Naturally, it is set to <\/span>1000<\/b> which is inadequate for Magento and causes the error.<\/span><\/p>\n

Also ensure that your PHP settings are correctly configured, especially session.<\/span>cookie_domain<\/b> and session.<\/span>cookie_secure<\/b>.<\/span><\/p>\n

Base Url Setting<\/b><\/h3>\n

Likewise, you could get this issue on localhost. It shows up if you use “<\/span>localhost<\/b>” for the base URL rather than “<\/span>127.0.0.1<\/b>” and Magento simply doesn’t recognize it. It causes the cookie misrecognition and correspondingly Magento “Invalid form key. Please refresh the page.” error appears.<\/span><\/p>\n

Incorrect Form Key<\/b><\/h3>\n

You may also get this error on a storefront when you attempt to submit a form. This issue shows up on the off chance that you have an old version of Magento or an old form and not all javascript files are loaded for the mentioned activity to be performed (e.g. add to cart activity).<\/span><\/p>\n

Others<\/b><\/h3>\n

Session Issues<\/b><\/h4>\n

Problems with sessions, such as expired or invalidated sessions, can lead to key validation errors. Magento relies on sessions to manage form keys, so any issues with session management can cause this error.<\/span><\/p>\n

Caching Problems<\/b><\/h4>\n

Caching issues, especially if the full page cache (<\/span>FPC<\/b>) is enabled, can interfere with form key validation. Cached pages might contain outdated form keys or invalid session data, causing the error to occur.<\/span><\/p>\n

Third-Party Extensions or Custom Code<\/b><\/h4>\n

Sometimes, third-party extensions or custom code can conflict with Magento’s form key validation logic. If an extension modifies form submission behavior without handling form keys correctly, it can lead to the \u201c<\/span>Invalid form key. Please refresh the page.<\/b>\u201d error.<\/span><\/p>\n

\"\"<\/a><\/p>\n

Solutions for the \u201cInvalid form key. Please refresh the page.\u201d error in Magento 2<\/b><\/h2>\n

Solution 1: Increase the max_input_vars in PHP<\/strong><\/h3>\n

To increase the <\/span>max_input_vars<\/b> variable in PHP, you’ll need to modify your PHP configuration settings. Increasing it can be necessary when dealing with forms or data submissions that exceed the default limit.\u00a0<\/span><\/p>\n

Here’s how you can do it:<\/strong><\/b><\/p>\n

– Locate php.ini File:<\/b><\/h4>\n

Find the <\/span>php.ini<\/b> file used by <\/span>Apache<\/b>. The location of this file can vary depending on your server setup. Common locations include <\/span>\/etc\/php\/7.x\/apache2\/php.ini<\/b> on Linux servers.<\/span><\/p>\n

Find the <\/span>php.ini<\/b> file used by <\/span>PHP-FPM<\/b>. The location can vary but is often found at <\/span>\/etc\/php\/7.x\/fpm\/php.ini <\/b>on Linux servers.<\/span><\/b><\/p>\n

– Edit php.ini:<\/b><\/h4>\n

Open the <\/span>php.ini<\/b> file using a text editor (e.g., <\/span>nano<\/b>, <\/span>vim<\/b>, or <\/span>gedit<\/b>).<\/span><\/b><\/p>\n

– Find max_input_vars:<\/b><\/h4>\n

Search for the <\/span>max_input_vars<\/b> variable in the <\/span>php.ini<\/b> file. If it’s not there, you can add it under the appropriate section (e.g., <\/span>[PHP]<\/b> section).<\/span>
\n<\/b><\/p>\n

– Increase max_input_vars:<\/b><\/h4>\n

Set the value of <\/span>max_input_vars<\/b> to the desired limit. For example:<\/span><\/p>\n

max_input_vars = 3000<\/b><\/p>\n

The suggested value for Magento 2 <\/span>max_input_vars<\/b> is <\/span>10000<\/b>.<\/span><\/p>\n

– Save and Exit:<\/b><\/h4>\n

Save the changes to the php.ini file and exit the text editor.<\/span><\/b><\/p>\n

– Restart <\/b>WebServer<\/b>:<\/b><\/h4>\n

Restart the Apache to apply the changes. You can do this using the command:<\/span><\/p>\n

sudo service apache2 restart<\/b><\/p>\n

Restart PHP-FPM to apply the changes. You can do this using a command like:<\/span><\/p>\n

sudo service php7.x-fpm restart<\/b><\/p>\n

Solution 2: Change your base URL<\/strong><\/h3>\n

To change the base URL of your local environment to <\/span>127.0.0.1<\/b> in Magento 2, you need to update the configuration settings in the Magento database. You can do this via the command line or by directly modifying the database.<\/span><\/p>\n

Here are the steps:<\/strong><\/b><\/p>\n

– Access Your Magento Database:<\/b><\/h4>\n

Use a database management tool like phpMyAdmin or connect to your database using the command line.<\/span><\/b><\/p>\n

– <\/b>Find Your Core Configuration Data Table:<\/b><\/h4>\n

Look for the <\/span>core_config_data<\/b> table in your Magento database.<\/span><\/b><\/p>\n

– <\/b>Update Base URL Values:<\/b><\/h4>\n

Identify the rows with the paths <\/span>web\/unsecure\/base_url <\/b>and <\/span>web\/secure\/base_url<\/b>. These rows contain the base URLs for your Magento store.<\/span><\/p>\n

Update the value column for both rows to <\/span>http:\/\/127.0.0.1\/<\/b> for unsecure base URL and <\/span>https:\/\/127.0.0.1\/<\/b> for the secure base URL (if you’re using HTTPS in your local environment).<\/span><\/p>\n

You can run SQL queries like:<\/span><\/p>\n

UPDATE core_config_data SET value = ‘http:\/\/127.0.0.1\/’ WHERE path = ‘web\/unsecure\/base_url’;<\/b><\/p>\n

UPDATE core_config_data SET value = ‘https:\/\/127.0.0.1\/’ WHERE path = ‘web\/secure\/base_url’;<\/b><\/p>\n

You can also run the following command from the project root directory to change it:<\/span><\/p>\n

php bin\/magento setup:store-config:set –base-url=”http:\/\/127.0.0.1\/<\/b><\/p>\n

php bin\/magento setup:store-config:set –base-url-secure=”https:\/\/127.0.0.1\/<\/b><\/b><\/p>\n

– <\/b>Clear Magento Cache:<\/b><\/h4>\n

Clear the Magento cache to ensure the changes take effect. You can do this via the command line: <\/span>php bin\/magento cache:clean<\/b><\/p>\n

Solution 3: Consistently Update Magento<\/strong><\/h3>\n

If you experience the “Invalid form key. Please refresh the page.” error that shows up on a storefront in the latest version of Magento, request a developer investigate it. They need to alter the Add to Cart button layout to make it accessible only after all JS scripts are loaded.<\/span><\/p>\n

Note: on the off chance that you are utilizing a custom extension or theme, there could be a ton of reasons and correspondingly fixed courses to work on. Check with the theme or custom extension developers.<\/span><\/p>\n

Read Also:<\/strong> Ultimate Guide To Advanced Reporting And Analytics In Magento 2<\/a><\/p>\n

Conclusion<\/b><\/h2>\n

In conclusion, the “Invalid form key. Please refresh the page.” error in Magento 2 is a common issue that occurs due to various reasons such as expired form keys, session issues, incorrect server configurations, caching problems, browser settings, or conflicts with third-party extensions or custom code.<\/span><\/p>\n

We trust that you can solve the issue yourself by adhering to the step-by-step guidelines above.<\/span><\/p>\n

FAQ’s<\/b><\/h2>\n

Q: What is a form key?<\/b><\/h3>\n

A form key (also known as a CSRF token) is a randomly generated value that Magento embeds in forms to verify that the form submission originated from the same site and wasn’t forged by a malicious third party.<\/span><\/p>\n

Q: Why does the \u201cInvalid form key. Please refresh the page.\u201d error occur?<\/b><\/h3>\n

The error occurs when Magento receives a form submission without a valid or matching form key. This can happen due to various reasons such as expired sessions, browser issues, caching problems, incorrect server configurations, or custom code conflicts.<\/span><\/p>\n

\"\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

The “Invalid form key. Please refresh the page.” error in Magento 2 typically occurs due to issues when there’s a mismatch between the form key stored in the session and the form key submitted with a form request. Form keys are a security feature in Magento that assists with Cross-Site Request Forgery (CSRF) attacks by<\/p>\n","protected":false},"author":45,"featured_media":23775,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[297,298],"class_list":{"0":"post-23771","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-magento","8":"tag-fix-magento-2-error","9":"tag-invalid-form-key-please-refresh-the-page"},"acf":[],"featured_image_data":{"src":"https:\/\/ecommerce.folio3.com\/blog\/wp-content\/uploads\/2024\/04\/9170819.jpg","alt":"magento error","caption":""},"_links":{"self":[{"href":"https:\/\/ecommerce.folio3.com\/blog\/wp-json\/wp\/v2\/posts\/23771"}],"collection":[{"href":"https:\/\/ecommerce.folio3.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ecommerce.folio3.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ecommerce.folio3.com\/blog\/wp-json\/wp\/v2\/users\/45"}],"replies":[{"embeddable":true,"href":"https:\/\/ecommerce.folio3.com\/blog\/wp-json\/wp\/v2\/comments?post=23771"}],"version-history":[{"count":0,"href":"https:\/\/ecommerce.folio3.com\/blog\/wp-json\/wp\/v2\/posts\/23771\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ecommerce.folio3.com\/blog\/wp-json\/wp\/v2\/media\/23775"}],"wp:attachment":[{"href":"https:\/\/ecommerce.folio3.com\/blog\/wp-json\/wp\/v2\/media?parent=23771"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ecommerce.folio3.com\/blog\/wp-json\/wp\/v2\/categories?post=23771"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ecommerce.folio3.com\/blog\/wp-json\/wp\/v2\/tags?post=23771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}