Answers.Body: <p>Though not a direct answer to your question, please see the below answer for an alternative to using the HTML Snippet method for embedding CiviCRM forms on a WordPress page or in a WordPress widget:</p>
  
  <p><a href="https://civicrm.stackexchange.com/a/28900/521">https://civicrm.stackexchange.com/a/28900/521</a></p>
  
  <p>Short version recap: use Caldera Forms and Caldera Forms CiviCRM plugins.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-03-14T18:15:33.583Z
Answers.LastActivityDate: 2019-03-14T18:15:33.583Z
Answers.UserDisplayName: Evan
Answers.Body: <p>Looking at the release notes for CiviCRM 4.7.11 there was a security issue that was fixed to do with these external snippets: <a href="https://civicrm.org/advisory/civi-sa-2016-17-manage-csrf-overrides-for-external-profile-forms" rel="nofollow">https://civicrm.org/advisory/civi-sa-2016-17-manage-csrf-overrides-for-external-profile-forms</a></p>
  
  <p>The release notes state, though, that existing installations should not have been affected by the update.</p>
  
  <p>I would recommend that you look in the settings (Administer => System Settings => Misc) for the QF key security on profile forms.</p>
  
  <p>If this setting has been enabled then it sounds like a bug - as the release notes suggest it should not have been enabled when upgrading an existing installation. If so then report it on the issue log and comment back here with a link =]</p>
  
  <p>It is certainly worth reviewing that security issue though, which discusses the implications of using HTML snippets (and offers some preferable alternatives).</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-10-07T11:28:16.897Z
Answers.Text: Yes, that it exactly the issue. I've changed that now and it's fixed, albeit with lesser security as a result. I'll have to look up now how to stop malicious form POST attacks.   Thanks @John !
Answers.UserDisplayName: Vshura
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-10-07T14:47:37.143Z
Answers.Text: @Vshura if the setting was automatically applied during the update then can you open an issue on the issue queue? https://issues.civicrm.org/jira/secure/Dashboard.jspa . This may have affected other organisations as well. But I'm glad this helped solve the issue.
Answers.UserDisplayName: John
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-10-10T11:49:35.200Z
Answers.Text: Hi @John. No, I'm pretty sure it was something I turned on after a security alert with the update to 4.7.11, rather than something that automatically changed. Thanks again.
Answers.UserDisplayName: Vshura
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-10-06T23:23:16.910Z
Answers.LastActivityDate: 2016-10-06T23:23:16.910Z
Answers.UserDisplayName: John
Body: <p>For a long time I was using a CiviCRM form for signing up people to our mailing lists, and doing it using html for the form on a non-CiviCRM page. </p>
  
  <p>I have a memory that there used to be an option in the CiviCRM Profile Settings page to export a html snippet you could cut and paste in this manner. This no longer seems to be there.</p>
  
  <p>The problem is that it has stopped working of late - when I upgraded from 4.7.8 to 4.7.11, though I'm only noticing now. When I submit the form using the CiviCRM page </p>
  
  <p><code>&lt;CiviCRM Install&gt;/?page=CiviCRM&amp;q=civicrm%2Fprofile%2Fcreate&amp;gid=15&amp;reset=1</code></p>
  
  <p>it works fine. But when I go to the non-CiviCRM page, which worked previously, it no longer works, and I get the following error:</p>
  
  <blockquote>
    <p>Sorry but we are not able to provide this at the moment.
    We can't load the requested web page. This page requires cookies to be enabled in your browser settings. Please check this setting and enable cookies (if they are not enabled). Then try again. If this error persists, contact the site administrator for assistance.<br /><br />Site Administrators: This error may indicate that users are accessing this page using a domain or URL other than the configured Base URL. EXAMPLE: Base URL is <a href="http://example.org" rel="nofollow">http://example.org</a>, but some users are accessing the page via <a href="http://www.example.org" rel="nofollow">http://www.example.org</a> or a domain alias like <a href="http://myotherexample.org" rel="nofollow">http://myotherexample.org</a>.<br /><br />Error type: Could not find a valid session key.`</p>
  </blockquote>
  
  <p>Any ideas? I've checked all the Resource URLS and they seem fine. I've checked the html code and, again, it works fine on the CiviCRM generated page but not on the static HTML page.</p>
  
  <p>I'm using 4.7.12 on Wordpress 4.6.1.</p>
  
Tags: <wordpress><forms><html><form-snippets>
Title: Using HTML snippets for Forms no longer an option?
ThreadText: # Using HTML snippets for Forms no longer an option?
  
  (Asked by: username_0 on 2016-10-06)
  
  For a long time I was using a CiviCRM form for signing up people to our mailing lists, and doing it using html for the form on a non-CiviCRM page.
  
  I have a memory that there used to be an option in the CiviCRM Profile Settings page to export a html snippet you could cut and paste in this manner. This no longer seems to be there.
  
  The problem is that it has stopped working of late - when I upgraded from 4.7.8 to 4.7.11, though I'm only noticing now. When I submit the form using the CiviCRM page
  
  `<CiviCRM Install>/?page=CiviCRM&q=civicrm%2Fprofile%2Fcreate&gid=15&reset=1`
  
  it works fine. But when I go to the non-CiviCRM page, which worked previously, it no longer works, and I get the following error:
  
  > Sorry but we are not able to provide this at the moment.
  > We can't load the requested web page. This page requires cookies to be enabled in your browser settings. Please check this setting and enable cookies (if they are not enabled). Then try again. If this error persists, contact the site administrator for assistance.  
  >   
  > Site Administrators: This error may indicate that users are accessing this page using a domain or URL other than the configured Base URL. EXAMPLE: Base URL is <http://example.org>, but some users are accessing the page via <http://www.example.org> or a domain alias like <http://myotherexample.org>.  
  >   
  > Error type: Could not find a valid session key.`
  
  Any ideas? I've checked all the Resource URLS and they seem fine. I've checked the html code and, again, it works fine on the CiviCRM generated page but not on the static HTML page.
  
  I'm using 4.7.12 on Wordpress 4.6.1.
  
  **Tags:** wordpress, forms, html, form-snippets
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2016-10-06. Score: 4 | Accepted answer
  
  Looking at the release notes for CiviCRM 4.7.11 there was a security issue that was fixed to do with these external snippets: <https://civicrm.org/advisory/civi-sa-2016-17-manage-csrf-overrides-for-external-profile-forms>
  
  The release notes state, though, that existing installations should not have been affected by the update.
  
  I would recommend that you look in the settings (Administer => System Settings => Misc) for the QF key security on profile forms.
  
  If this setting has been enabled then it sounds like a bug - as the release notes suggest it should not have been enabled when upgrading an existing installation. If so then report it on the issue log and comment back here with a link =]
  
  It is certainly worth reviewing that security issue though, which discusses the implications of using HTML snippets (and offers some preferable alternatives).
  
  > **Comments:**
  > **username_0**: Yes, that it exactly the issue. I've changed that now and it's fixed, albeit with lesser security as a result. I'll have to look up now how to stop malicious form POST attacks.   Thanks @username_2 !  
  > **username_2**: @username_0 if the setting was automatically applied during the update then can you open an issue on the issue queue? https://issues.civicrm.org/jira/secure/Dashboard.jspa . This may have affected other organisations as well. But I'm glad this helped solve the issue.  
  > **username_0**: Hi @username_2. No, I'm pretty sure it was something I turned on after a security alert with the update to 4.7.11, rather than something that automatically changed. Thanks again.  
  
  ---
  
  ### Answer by username_1 on 2019-03-14. Score: 0
  
  Though not a direct answer to your question, please see the below answer for an alternative to using the HTML Snippet method for embedding CiviCRM forms on a WordPress page or in a WordPress widget:
  
  <https://civicrm.stackexchange.com/a/28900/521>
  
  Short version recap: use Caldera Forms and Caldera Forms CiviCRM plugins.
  
  
  ---
  
  