# Troubleshooting "BAD CSRF" error on initial site setup?

**URL:** https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059
**Category:** Self-hosting
**Created:** [September 12, 2018, 5:23pm UTC](https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059 "2018-09-12T17:23:19Z")
**Posts on this page:** 1
**Showing post:** 19

<div class="post-metadata">

### Author: ![fais3000](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fais3000/32/218714_2.png) [@fais3000](https://meta.discourse.org/u/fais3000)
#### Post date: [April 30, 2021, 6:48am UTC](https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059/19 "2021-04-30T06:48:09Z")

</div>

The other site was also on cloudflare but didn’t have caching enabled. The new site root has aggressive caching enabled via page rules, which would also apply to subfolders, hence the issue.

**Browser Cache TTL: a month, Always Online: On, Cache Level: Cache Everything, Edge Cache TTL: 2419200 seconds**

I also think following header is also critical.

```plaintext
        proxy_set_header X-Forwarded-Proto https;

```

---

_[View the full topic](https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059)._