diff --git a/badges/backpacks.php b/badges/backpacks.php
index 7a18276336c..2685ca89e56 100644
--- a/badges/backpacks.php
+++ b/badges/backpacks.php
@@ -56,7 +56,7 @@ if ($action == 'delete' && $confirm && confirm_sesskey()) {
     } else {
         $msg = get_string('sitebackpacknotdeleted', 'badges');
     }
-} else if ($action == 'moveup' || $action == 'movedown') {
+} else if (($action == 'moveup' || $action == 'movedown') && confirm_sesskey()) {
     // If no backpack has been selected, there isn't anything to move.
     if (empty($id)) {
         redirect($url);
diff --git a/badges/templates/external_backpacks_page.mustache b/badges/templates/external_backpacks_page.mustache
index f6a8380fc07..96298b956c9 100644
--- a/badges/templates/external_backpacks_page.mustache
+++ b/badges/templates/external_backpacks_page.mustache
@@ -56,13 +56,13 @@
             <td> {{{backpackweburl}}} </td>
             <td>
                 {{#canmoveup}}
-                    <a href="{{baseurl}}?id={{id}}&action=moveup">{{#pix}}t/up, core,{{#str}}moveup{{/str}}{{/pix}}</a>
+                    <a href="{{baseurl}}?id={{id}}&sesskey={{sesskey}}&action=moveup">{{#pix}}t/up, core,{{#str}}moveup{{/str}}{{/pix}}</a>
                 {{/canmoveup}}
                 {{^canmoveup}}
                     {{#pix}}spacer, moodle{{/pix}}
                 {{/canmoveup}}
                 {{#canmovedown}}
-                    <a href="{{baseurl}}?id={{id}}&action=movedown">{{#pix}}t/down, core,{{#str}}movedown{{/str}}{{/pix}}</a>
+                    <a href="{{baseurl}}?id={{id}}&sesskey={{sesskey}}&action=movedown">{{#pix}}t/down, core,{{#str}}movedown{{/str}}{{/pix}}</a>
                 {{/canmovedown}}
                 {{^canmovedown}}
                     {{#pix}}spacer, moodle{{/pix}}