In Craft 3 the csrf token validation in the `general.php` config is set to true by default. In order to request your controller with post requests you have to turn it off or include the token https://docs.craftcms.com/v3/changes-in-craft-3.html#csrf-token-params {% set csrfTokenName = craft.app.config.general.csrfTokenName %} {% set csrfToken = craft.app.request.csrfToken %} <input type="hidden" name="{{ csrfTokenName }}" value="{{ csrfToken }}">