After installing patch SUPEE-9767 the "Enable Form Key Validation On Checkout" warning appeared and from the link provided in that warning I was able to enable Form Key Validation.

But, after having some issues in the checkout process I would like to try to disable it and check if everything comes back to normal.

The big problem here is that I cannot find where the option is in the admin menu.

I seem to recall it was in:

System > Configuration > Advanced > Security > Enable Form Key Validation On Checkout

But if it was there, now it has disappeared. Do I recall it wrong or what might be the issue?

2 Answers 2


Close! It's under System > Configuration > Admin > Security > Enable Form Key Validation On Checkout

  • I enabled form key validation and now the checkout is broken. It will not advance past STEP 1 (billing info). v1.9.3.1
    – yldziner
    Commented Jun 3, 2017 at 19:37
  • @yldziner There's a bug in Magento: magento.stackexchange.com/questions/177035/….
    – Anitr
    Commented Jun 19, 2017 at 10:44
  • 1
    I'm not seeing that setting on the System->Configuration->Admin page (under Security or elsewhere on the page) in an install of v1.9.1.0. Was that added in a later version?
    – Tim Malone
    Commented Jun 26, 2017 at 3:56
  • 1
    I'm also not seeing this setting - although I've found it in other installations. I'm also running - Magento ver. Commented Jul 3, 2017 at 15:48
  • 1
    I too am not seeing the setting after the patch install from
    – Rebel
    Commented Jul 10, 2017 at 18:08

How I fix it on Magento with php70

  1. disable Form Key-just ignore the security message (if your theme does not support formkey -ask from whoever you bought it if theme supports formkey validation)
    To disable go to Configuration>GENERAL>WEB>Security>set to NO

  2. Fix your Session Cache Settings in Configuration>GENERAL>WEB>Session Cookie Management to:
    Cookie lifetime=3600 -default
    cookie path -leave empty
    cookie domain -leave empty
    use HTTP Only -set to YES (it's ok-because in url secure and unsecure i have https for both + ssl
    Cookie Restriction Mode -Set NO

  3. Clear Cache

  4. Clear Session logs (go to your public_html/var/session folder in hosting and delete everything ((your cron jobs should be set also for this folder -check with hosting

  5. clear browser cache
    login or do the checkout-is it working?
    If not -disable temporary any captcha plugin and test again

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.