diff --git a/clone.module b/clone.module
index 9872c03..64d782d 100644
--- a/clone.module
+++ b/clone.module
@@ -43,9 +43,9 @@ function clone_menu() {
     'file' => 'clone.pages.inc',
     'description' => 'Allows users to clone (copy then edit) an existing node.',
   );
-  $items['node/%node/clone'] = array(
+  $items['node/%node/clone/%clone_token'] = array(
     'access callback' => 'clone_access_cloning',
-    'access arguments' => array(1),
+    'access arguments' => array(1, TRUE, 3),
     'page callback' => 'clone_node_check',
     'page arguments' => array(1),
     'title' => 'Clone content',
@@ -59,8 +59,22 @@ function clone_menu() {
   return $items;
 }
 
-function clone_access_cloning($node) {
+function clone_token_to_arg($arg = NULL, $map = NULL, $index = NULL) {
+  // Supply CSRF token if needed.
+  if (variable_get('clone_nodes_without_confirm', FALSE)) {
+    return drupal_get_token('clone_access_cloning');
+  }
+  return 'confirm';
+}
+
+function clone_access_cloning($node, $check_token = FALSE, $token = FALSE) {
   global $user;
+  // Check CSRF token if needed.
+  if ($check_token) {
+    if (!$token || $token !== clone_token_to_arg()) {
+      return FALSE;
+    }
+  }
   // Check basic permissions first.
   $access = clone_is_permitted($node->type) && (user_access('clone node') || ($user->uid && ($node->uid == $user->uid) && user_access('clone own nodes')));
   // Make sure the user can view the original node content, and create a new one..
@@ -124,7 +138,7 @@ function clone_views_api() {
 function clone_admin_paths() {
   if (variable_get('node_admin_theme')) {
     $paths = array(
-      'node/*/clone' => TRUE,
+      'node/*/clone/*' => TRUE,
     );
     return $paths;
   }
@@ -161,7 +175,7 @@ function clone_form_node_admin_content_alter(&$form, $form_state, $form_id) {
     if (clone_access_cloning($node)) {
       $row['operations']['data']['#links']['clone'] = array(
         'title' => t('clone'),
-        'href' => 'node/' . $nid . '/clone',
+        'href' => 'node/' . $nid . '/clone/' . clone_token_to_arg(),
         'query' => $destination,
       );
     }
diff --git a/clone.pages.inc b/clone.pages.inc
index 14add8a..b1b2f03 100644
--- a/clone.pages.inc
+++ b/clone.pages.inc
@@ -24,7 +24,7 @@ function clone_settings($form, &$form_state) {
     '#title' => t('Confirmation mode when using the "Save as a new node then edit" method'),
     '#default_value' => (int)variable_get('clone_nodes_without_confirm', 0),
     '#options' => array(t('Require confirmation (recommended)'), t('Bypass confirmation')),
-    '#description' => t('A new node may be saved immediately upon clicking the "clone" tab when viewing a node, bypassing the normal confirmation form.'),
+    '#description' => t('A new node may be saved immediately upon clicking the "clone" link when viewing a node, bypassing the normal confirmation form.'),
   );
   $form['basic']['clone_menu_links'] = array(
     '#type' => 'radios',
diff --git a/views/views_handler_field_node_link_clone.inc b/views/views_handler_field_node_link_clone.inc
index 3fd9b82..5f163cd 100644
--- a/views/views_handler_field_node_link_clone.inc
+++ b/views/views_handler_field_node_link_clone.inc
@@ -20,7 +20,7 @@ class views_handler_field_node_link_clone extends views_handler_field_node_link
     }
 
     $this->options['alter']['make_link'] = TRUE;
-    $this->options['alter']['path'] = "node/{$node->nid}/clone";
+    $this->options['alter']['path'] = "node/{$node->nid}/clone/" . clone_token_to_arg();
     $this->options['alter']['query'] = drupal_get_destination();
 
     $text = !empty($this->options['text']) ? $this->options['text'] : t('clone');