Support

The Invalid Token message comes from Joomla! core code. Depending on how you view it, it's a bug or a feature. It tries to protect the administrator login from Cross Site Request Forgery (CSRF) attacks by including a security token in each request. However, browser caching can ruin your day. Try cleaning your browser's cache and, if possible, your cookie cache as well. Then close (completely shut down) your browser and restart it. Trying to access your site again should allow you to login.

If this doesn't work, you can use phpMyAdmin to remove all records from the jos_session table (but NOT the table itself, only its contents!). Then, follow the clear cache / cookie cache chore and it's bound to work.

According to my tests, Chrome performs more aggressive caching and is more likely to cause such an issue than Firefox. If you're using Chrome, you can always try logging in with Firefox if nothing else works. I generally advise people to have a fresh installation of Portable Firefox at hand to troubleshoot such issues. Since PF doesn't store a permanent cache, shutting it down and restarting it allows you to conveniently get around such issues very quickly.

Hi!

I would suggest applying the .htaccess Maker anyway, then work your way through any necessary exclusions using our documentation's instructions. The reason is quite simple: the front-end protection feature of .htaccess Maker will protect your site against unauthorised access of potentially sensitive information not properly secured, as well as a host of direct attacks to arbitrary PHP files. Moreover, in the unlikely event an attacker manages to upload a site cracking script, it will prevent him from executing it, therefore nullifying his cracking attempt against your site.

If you want help with setting up exceptions, fire up a post mentioning the problem URL and I will visit the site, figure out what needs be done and tell you which exception you have to add to .htaccess Maker :)

Please send me a Personal Message with the following information:

1. URL to your site's administrator
2. A Super Administrator username and password
3. URLs to the pages which don't work properly
4. FTP connection information to your site (so that I can fix your site in case an error in .htaccess brings it down)
5. A link back to this thread so that I know what you're talking about (allows me to provide much faster support)

Thank you in advance!