Joomla 3.9.23

I am also using RSFormPro for user registration (I have opened a ticket with their support also).

When a user registers on my site they receive an email with a link to verify their account, when clicked, they are redirected to ,registration/staff/registration-messase where a html message (configured in rsform pro) is displayed. Then another email is sent to an administrator containing a link to approve this users account.

The issue i'm having is that some users are seeing an error when clicking the verification message in the email, the message is;

403 Verification code not found.

The menu item registration/staff is set to public im not sure if this makes any difference, should it be set to guest?

I have received a copy of the emails and tried clicking the link myself, same error. I have checked the joomla user manager and can see the users are there, just not enabled or activated.

So, why am I seeing this 403 error?

Is it because the link has already been clicked? Clicking this link more than once results in this error. Users are insisting they are clicking it just once. Which must be true because the second email to admin is being sent.

As I understand this link is a 'one time only' link, and should only display the 403 error in the event that the user has already clicked the link?

How can I troubleshoot / investigate?

  • 403 error means that the access is forbidden. Usually it's either blocked by a firewall (e.g. admin tools, RSfirewall, or mod_security on the server), or by rules in your .htaccess file. See what the activation link looks like and then allow that link in your .htaccess and/or check your firewall logs and disable any rules that could block that request.
    – FFrewin
    Dec 17, 2020 at 14:07
  • 1
    Did you solve this one? I just got a call to troubleshoot a similar issue on another website. In my case it was caused by Admin Tools system plugin - the setting to Delete Inactive Users. @Robbie Jackson was right - because the 403 comes from Joomla - because there is no such a user in the database. The admin tools plugin deletes the user right after his creation. I have reported this to Akeeba - and for the time being I set the setting to never delete users.
    – FFrewin
    Jan 25, 2021 at 13:26
  • Thanks for this @FFrewin I do have admin tools but not the pro version, so not sure if this would apply to my site? I never did get it sorted.. I haven't been able to replicate the issue locally so there's a chance it's a user issue, they could be clicking the email activation link twice which would display the 403. Would be nice if this message could be easily changed to already activated rather than a 403.
    – jonboy
    Jan 26, 2021 at 10:18
  • @johboy: First check if after creating a new user account - that new user exists in the users list in backend. In my case it was also deleting any users I was creating in the backend. So try it from the backend and see if the new user is saved or not. For your localhost - if you haven't AdminTools or if it's disabled then it shouldn't happen. The setting to check is in the Admin Tools system plugin -> Delete inactive users. It affects admin tools version 5.9.1 - But me too - not sure if this is a setting that exists in the free version - but I guess it does. Let me know what you find with this
    – FFrewin
    Jan 26, 2021 at 12:22
  • @FFrewin I'm getting more reports of the same issue, on two different sites (both using rsform). I have been able to replicate the issue, register > clicking verification link once results in a 403, however the user account is still still being activated. I think it's only being reported sometimes, but happening every time. After clicking verification link users should be directed to a 'thank you' message configured in a hidden menu item (rsform settings) - I wonder could the hidden menu item be the cause? Access is set to public so doubt it. Will have to investigate further!
    – jonboy
    Feb 25, 2021 at 9:08

2 Answers 2


I suspect that because you've got the 403 error message "Verification code not found" that the request is actually being rejected by Joomla itself. The language string COM_USERS_ACTIVATION_TOKEN_NOT_FOUND is set on my instance to "Verification code not found. Check if your account is already activated and try to log in.".

Looking at the Joomla code in com_users/controllers/registration.php in the activate() function this error is raised if the $model->getUserIdFromToken($token) call does not return a user to activate.

To find the user to activate the Joomla registration model (com_users/models/registration.php) does a SQL query:

        ->where($db->quoteName('activation') . ' = ' . $db->quote($token))
        ->where($db->quoteName('block') . ' = ' . 1)
        ->where($db->quoteName('lastvisitDate') . ' = ' . $db->quote($db->getNullDate()));

so you'll get the error if this query returns no rows.

I suggest you try doing this SQL query directly on your database and see if it returns the row that you expect (whenever you're in the middle of registering a new user).

If you're using RSFormPro for the registration form are you sure you're setting all the database fields in the users record correctly?

I guess the other alternative is to check if the admin is setting the user to Enabled before they've even confirmed the account using the link.

  • This is great, thanks.for such a detailed answer! I will definitely run that query tomorrow. Updated my question, not sure if the menu item permissions would matter?
    – jonboy
    Dec 17, 2020 at 21:22
  • I don't think that the permissions matter here. The user isn't logged in at that stage, so both public and guest will be visible. Items with Public access can be viewed by anyone, whether they're logged in or not. Items with Guest access can be viewed by anyone who isn't logged in, but won't be seen by users who are logged in. So for example you can set up an article custom field with Guest access which is a fixed text field "Please login to view details" and have other fields which are protected. Then when the user logs in they see the other fields, but the "Please login" field isn't shown. Dec 17, 2020 at 22:38

A 403 error indicates that the access is forbidden.

Usually it's either blocked by a firewall (e.g. admin tools, RSfirewall, or mod_security on the server), or by rules in your .htaccess file.

See what the activation link looks like and then allow that link in your .htaccess and/or check your firewall logs and disable any rules that could block that request.

  • If this happens sometimes, then the htaccess possibility is eliminated, as a restrictive rule in it should always take place - unless there is something variant on the activation link. Is it the default activation link from from the Joomla workflow, or something else that you generate via RSForm pro? The Firewall idea could still be relevant as it may allow up to some events before it enforce the block ... But, yes it's kinda weird that sometimes it happens and others not - hard to say much more with this little information... It needs troubleshooting and steady examination... @jonboy
    – FFrewin
    Dec 17, 2020 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.