[satorius99]

Ok, I tried updating this but no luck. Just to be clear, is this the token you mean? From the new thread non-vb page:

<input type="hidden" name="securitytoken" value="guest" />

--------------- Added [DATE]1215379840[/DATE] at [TIME]1215379840[/TIME] ---------------

I finally figured this out - I had changed the 'CSRF_PROTECTION' to false from the page with the form (the non-vb page), when it needed to be done on the receiving page (newthread.php). This was the line in question:

define('CSRF_PROTECTION', false);

I knew it would turn out to be a newbie mistake!

Thanks for your help.