diff --git a/views/admin.html b/views/admin.html
index 34184e0..80e1728 100644
--- a/views/admin.html
+++ b/views/admin.html
@@ -117,7 +117,12 @@
       status.style.color = 'var(--accent)';
 
       try {
-        const csrfToken = window.f0ckSession?.csrf_token || '{{ csrf_token }}';
+        const csrfToken = (window.f0ckSession && window.f0ckSession.csrf_token) || '{{ csrf_token }}';
+        if (!csrfToken || csrfToken.startsWith('{')) {
+          status.textContent = 'CSRF token missing. Please refresh the page.';
+          status.style.color = '#d9534f';
+          return;
+        }
         const res = await fetch('/admin/settings', {
           method: 'POST',
           headers: {
@@ -126,15 +131,20 @@
             'X-CSRF-Token': csrfToken
           },
           body: new URLSearchParams({
-            manual_approval: approvalToggle.checked ? 'on' : 'off',
+            manual_approval: approvalToggle ? (approvalToggle.checked ? 'on' : 'off') : 'off',
             ...(registrationToggle ? { registration_open: registrationToggle.checked ? 'on' : 'off' } : {}),
-            min_tags: minTagsInput.value,
-            trusted_uploads: trustedUploadsInput.value,
+            min_tags: minTagsInput ? minTagsInput.value : '3',
+            trusted_uploads: trustedUploadsInput ? trustedUploadsInput.value : '3',
             csrf_token: csrfToken
           }).toString()
         });
         
-        if (!res.ok) throw new Error('Server returned ' + res.status);
+        if (!res.ok) {
+          if (res.status === 403) {
+            throw new Error('CSRF validation failed or session expired. Please reload the page.');
+          }
+          throw new Error('Server returned ' + res.status);
+        }
         
         const data = await res.json();
         if (data.success) {