I've just tried to update my site from Joomla 3.6.0 to 3.6.1 and I get the following error message:

The most recent request was denied because it contained an invalid security token. Please refresh the page and try again.

How can I successfully install the update?


If you don't have Akeeba Backup installed:

  • Go back to the Joomla Update page
  • Upload and install the Joomla 3.6.1 Update Package using the "Upload & Update" tab
  • Go to Extensions >> Manage >> Database
  • You may see a message that the database is out of date. If so, click on the Fix button in the toolbar.

If you have Akeeba Backup installed:

  • Go to the Plugin Manager
  • Disable the System - Backup on upgrade plugin
  • Go back to the Joomla Update page
  • Upload and install the Joomla 3.6.1 Update Package using the "Upload & Update" tab
  • Go to Extensions >> Manage >> Database
  • You may see a message that the database is out of date. If so, click on the Fix button in the toolbar.
  • Thanks - I disabled the Akeeba Backup and ran the auto update. Worked. – Gerfried Sep 3 '16 at 1:06

Details about this issue can now be found in the Joomla Docs:

What is the cause?
3.6.1 introduced a CSRF token check to the update component as an extra level of security. 3.6.0 down to 2.5.4 (every version with the update component) will hit the issue with the CSRF token because those versions don't generate the needed code to pass the check. Future updates will work correctly

Lodder's solutions works perfectly. Using third-party update services like MyJoomla or Watchful.li should not cause any issues


I also had the same error message after upgrading 3.6.0 -> 3.6.1: 0 Failed to start the session: already started by PHP ($_SESSION is set).

To resolve, you need to use PHP Selector and change from 5.3 (it's a PHP 5.3 issue; will be fixed in Joomla 3.6.2). I change from 5.3 --> 5.6 and am now able to login the administration.

Hope helps


If people can't log into the back-end, there is an additional fix on github here: https://github.com/joomla/joomla-cms/pull/11430/files

You must change the following lines on libraries/joomla/session/handler/native.php

private $started; to private $started=false; and private $closed; to private $closed=false;

Add the line $this->closed = true; after session_write_close(); (line 153)

From the sites I have patched today, this seems to be a PHP 5.3 issue.

  • modifying core files is not a good idea. – Joomler Aug 4 '16 at 17:17
  • 1
    @joomler It's a bad idea for any permanent changes, but this is a temporary fix for a bug that can be over-written on future patches without concern, assuming Joomla will fix such bugs in future patches (they still say they support 5.3). If you want to run Joomla on PHP 5.3, then it seems to be the only way to fix this bug. Upgrading PHP is more sensible, but that's not always quick/easy. On github, the bug fix was written by one of Joomla's Leadership Team, so the next patch is likely to include this change anyway. – Richard B Aug 4 '16 at 17:49
  • 1
    @Joomler - This commit was merged and added to the v3.6.1 milestone so all ok ;) – Lodder Aug 5 '16 at 22:36
  • yep, that looks good :) – Joomler Aug 6 '16 at 4:11

It appears that I have clicked that update button little to fast... again...

If I have read official Release News The Joomla! 3.6.1 Update a little bit more carefully, I would have learned following from the third paragraph:

Updating from Joomla! 3.6.0

Update the Joomla! Update Component through the Extension Manager. Then use the Joomla! Update component to update to the latest 3.6.x version.

So I have tested this statement on second test site, and sure enough: After I clicked on extensions Updates are available! quickicon in control panel, among other updates there was that important one: Joomla! Update Component Update 3.6.1

I have updated that one first, and then went back to Joomla Update component and clicked on that blue button 'Install the update', this time without any problems or error messages.

Later on I have seen few tweets from Joomla PLT members, referring to official Joomla Github Release Joomla 3.6.1 which helps a little bit further:

IMPORTANT! Due to a security update in this release please upgrade to Joomla 3.6.0 first then install this new version of the Joomla Update Component through Extension Manager before continuing upgrading Joomla as normal**

There are also download links to all important packages in questions, even to that Joomla Update Component update itself com_joomlaupdate-3.6.1.zip, just in case that for some reason that update doesn't appear in your Extensions Update component on your site.

Moral of the story: RTFM!

EDIT: The good folks from JoomlaShack (ex-Alledia) just published What to Know About Updating to Joomla 3.6.2

enter image description here

protected by FFrewin Aug 14 '16 at 6:34

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.