"Invalid security token" when I save or log in

Why it happens

Every Joomla form carries a security token that belongs to your session. If the session expired, the cookie was lost, or a cached page served an old token, Joomla refuses the form to protect you from forged requests.

Fix it

1. Reload the page (to get a fresh token) and try again.
2. If it keeps happening: clear your browser cookies for the site.
3. Raise Session Lifetime in Global Configuration → System → Session (for example to 60 minutes) if you edit for a long time.
4. Make sure login pages and forms aren't page-cached: exclude them in the System - Page Cache plugin, or in your host's cache.
5. After a move, check cookie_domain and cookie_path in configuration.php are empty.

Good to know

• Two tabs with the same form, or the back button after logging out, also cause it. Just reload.