Piwik + Wordpress: Cannot login to Piwik | Form security failed


Hi everybody!

I already tried to get help in the official Piwik forum. I have installed Wordpress on Cloudways and would like to use Piwik Analytics. I have succesfully installed Piwik in the public_html folder. Now when I try to log in to Piwik for the first time, I’m getting the following error message:

Form security failed. Please reload the form and check that your cookies are enabled. If you use a proxy server, you must configure Piwik to accept the proxy header that forwards the Host header. Also, check that your Referer header is sent correctly.

SSL is correctly setup for my wordpress site and is working.

I have adapted the config.ini.php of Piwik as follows:

proxy_client_headers[] = "HTTP_X_FORWARDED_FOR"
proxy_host_headers[] = "HTTP_X_FORWARDED_HOST"
salt = "37845hlhf070523fhlh235"
trusted_hosts[] = "xxx.com"
trusted_hosts[] = "www.xxx.com"

This is the .htaccess of my wordpress:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress

There is another .htaccess within the Piwik folder:

# This file is auto generated by Piwik, do not edit directly
# Please report any issue or improvement directly to the Piwik team.
# First, deny access to all files in this directory
<Files "*">
<IfModule mod_version.c>
	<IfVersion < 2.4>
		Order Deny,Allow
		Deny from All
	<IfVersion >= 2.4>
		Require all denied
<IfModule !mod_version.c>
	<IfModule !mod_authz_core.c>
		Order Deny,Allow
		Deny from All
	<IfModule mod_authz_core.c>
		Require all denied

Now, has anybody ever succesfully installed and operated Piwik on Cloudways? Is there anything obvious that I could try out to be able to login to Piwik?

Your help is much appreciated since I have not yet found anybody who would be able to help me and I don’t want to use GA.

Thank you!


Sorry no experience with Piwik, but I have experienced similar issue with other scripts where Varnish cache needed login specific cookies to be whitelisted.


I have exactly the same problem. I would like to migrate Piwik (now called Matomo) to Cloudways, but I cannot log in as admin in any browser, be it Windows or Linux. However, I can log in into the Android app, which means that Piwik is correctly installed.


I think now this issue is related to Cloudflare. I installed it now on a domain that is not behind CF and I can log in.

After reading this:

and this:

I selected Cloudflare WAF in the server settings, but it doesn’t help. Still can’t log in to the Piwik installation behind Cloudflare (which is in a subfolder of my WordPress site).