diff --git a/htdocs/media/xoops/xoops.js b/htdocs/media/xoops/xoops.js
index 08c3c16e4..8f584c95b 100644
--- a/htdocs/media/xoops/xoops.js
+++ b/htdocs/media/xoops/xoops.js
@@ -101,3 +101,14 @@ var Xoops = {
     }
 
 };
+
+// An admin toggle was refused by Security::requireAjaxToken(): its page token has
+// expired, so nothing was saved. Reload to show the real state and get a fresh
+// token, instead of leaving a changed icon or sorted list on screen.
+if (window.jQuery) {
+    jQuery(document).ajaxError(function (event, xhr) {
+        if (xhr.status === 403 && xhr.getResponseHeader('X-Xoops-Token') === 'rejected') {
+            window.location.reload();
+        }
+    });
+}
diff --git a/htdocs/modules/avatars/admin/avatar_custom.php b/htdocs/modules/avatars/admin/avatar_custom.php
index ae4db9f50..45e39c5ca 100644
--- a/htdocs/modules/avatars/admin/avatar_custom.php
+++ b/htdocs/modules/avatars/admin/avatar_custom.php
@@ -89,6 +89,7 @@
             }
         }
         $xoops->tpl()->assign('avatars_list', $avatar_list);
+        $xoops->tpl()->assign('token', $xoops->security()->createToken(3600));
         // Display Page Navigation
         if ($avatar_count > $nb_avatars) {
             $nav = new XoopsPageNav($avatar_count, $nb_avatars, $start, 'start', 'op=list');
@@ -212,16 +213,7 @@
         break;
 
     case "update_display":
-        $avatar_id = Request::getInt('avatar_id', 0);
-        if ($avatar_id > 0) {
-            $obj = $avatar_Handler->get($avatar_id);
-            $old = $obj->getVar('avatar_display');
-            $obj->setVar('avatar_display', !$old);
-            if ($avatar_Handler->insert($obj)) {
-                exit;
-            }
-            echo $obj->getHtmlErrors();
-        }
+        avatars_updateDisplay($avatar_Handler);
         break;
 }
 $xoops->footer();
diff --git a/htdocs/modules/avatars/admin/avatar_system.php b/htdocs/modules/avatars/admin/avatar_system.php
index 43a019710..84434bd9d 100644
--- a/htdocs/modules/avatars/admin/avatar_system.php
+++ b/htdocs/modules/avatars/admin/avatar_system.php
@@ -84,6 +84,7 @@
             $avatar_list[$i]['count'] = count($avatar_Handler->getUser($avatars_arr[$i]));
         }
         $xoops->tpl()->assign('avatars_list', $avatar_list);
+        $xoops->tpl()->assign('token', $xoops->security()->createToken(3600));
         // Display Page Navigation
         if ($avatar_count > $nb_avatars) {
             $nav = new XoopsPageNav($avatar_count, $nb_avatars, $start, 'start', 'op=list');
@@ -219,16 +220,7 @@
         break;
 
     case "update_display":
-        $avatar_id = Request::getInt('avatar_id', 0);
-        if ($avatar_id > 0) {
-            $obj = $avatar_Handler->get($avatar_id);
-            $old = $obj->getVar('avatar_display');
-            $obj->setVar('avatar_display', !$old);
-            if ($avatar_Handler->insert($obj)) {
-                exit;
-            }
-            echo $obj->getHtmlErrors();
-        }
+        avatars_updateDisplay($avatar_Handler);
         break;
 }
 $xoops->footer();
diff --git a/htdocs/modules/avatars/admin/header.php b/htdocs/modules/avatars/admin/header.php
index 669349be3..061f3acb5 100644
--- a/htdocs/modules/avatars/admin/header.php
+++ b/htdocs/modules/avatars/admin/header.php
@@ -19,4 +19,29 @@
  * @author          Mage Grégory (AKA Mage)
  * @version         $Id$
  */
+
+use Xmf\Request;
+use Xoops\Core\Kernel\XoopsPersistableObjectHandler;
+
 require_once dirname(dirname(dirname(__DIR__))) . '/include/cp_header.php';
+
+/**
+ * AJAX toggle of an avatar's display flag, shared by the system and custom avatar pages
+ *
+ * @param XoopsPersistableObjectHandler $avatarHandler avatar handler
+ *
+ * @return void
+ */
+function avatars_updateDisplay(XoopsPersistableObjectHandler $avatarHandler): void
+{
+    Xoops::getInstance()->security()->requireAjaxToken();
+    $avatar_id = Request::getInt('avatar_id', 0, 'POST');
+    $obj = $avatar_id > 0 ? $avatarHandler->get($avatar_id) : null;
+    if (is_object($obj)) {
+        $obj->setVar('avatar_display', !$obj->getVar('avatar_display'));
+        if ($avatarHandler->insert($obj)) {
+            exit;
+        }
+        echo $obj->getHtmlErrors();
+    }
+}
diff --git a/htdocs/modules/avatars/templates/admin/avatars_admin_custom.tpl b/htdocs/modules/avatars/templates/admin/avatars_admin_custom.tpl
index 7ccfcd2a3..496159f4f 100644
--- a/htdocs/modules/avatars/templates/admin/avatars_admin_custom.tpl
+++ b/htdocs/modules/avatars/templates/admin/avatars_admin_custom.tpl
@@ -27,7 +27,7 @@
                     <div class="xo-actions txtcenter">
                     <div class="spacer bold"><{$avatar.avatar_name}></div>
                     <img id="loading_avt<{$avatar.avatar_id}>" src="<{xoAppUrl 'media/xoops/images/spinner.gif'}>" style="display:none;" alt="<{translate key='LOADING'}>" />
-                    <img class="cursorpointer xo-tooltip" id="avt<{$avatar.avatar_id}>" onclick="Xoops.changeStatus( 'avatar_custom.php', { op: 'update_display', avatar_id: <{$avatar.avatar_id}> }, 'avt<{$avatar.avatar_id}>', 'avatar_custom.php' )" src="<{if $avatar.avatar_display}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>"
+                    <img class="cursorpointer xo-tooltip" id="avt<{$avatar.avatar_id}>" onclick="Xoops.changeStatus( 'avatar_custom.php', { op: 'update_display', avatar_id: <{$avatar.avatar_id}>, XOOPS_TOKEN_REQUEST: '<{$token}>' }, 'avt<{$avatar.avatar_id}>', 'avatar_custom.php' )" src="<{if $avatar.avatar_display}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>"
                          alt="<{if $avatar.avatar_display}><{translate key='DISPLAY_IN_FORM'}><{else}><{translate key='DO_NOT_DISPLAY_IN_FORM'}><{/if}>"
                          title="<{if $avatar.avatar_display}><{translate key='DISPLAY_IN_FORM'}><{else}><{translate key='DO_NOT_DISPLAY_IN_FORM'}><{/if}>" />
                     <a class="xo-tooltip" href="<{$xoops_url}>/userinfo.php?uid=<{$avatar.user}>" title="<{translate key='USERS' dirname='avatars'}>">
diff --git a/htdocs/modules/avatars/templates/admin/avatars_admin_system.tpl b/htdocs/modules/avatars/templates/admin/avatars_admin_system.tpl
index 7cc7c5890..3cd6e15a6 100644
--- a/htdocs/modules/avatars/templates/admin/avatars_admin_system.tpl
+++ b/htdocs/modules/avatars/templates/admin/avatars_admin_system.tpl
@@ -27,7 +27,7 @@
                     <div class="xo-actions txtcenter">
                         <div class="spacer bold"><{$avatar.avatar_name}></div>
                         <img id="loading_avt<{$avatar.avatar_id}>" src="<{xoAppUrl 'media/xoops/images/spinner.gif'}>" style="display:none;" alt="<{translate key='LOADING'}>" />
-                        <img class="cursorpointer" id="avt<{$avatar.avatar_id}>" onclick="Xoops.changeStatus( 'avatar_system.php', { op: 'update_display', avatar_id: <{$avatar.avatar_id}> }, 'avt<{$avatar.avatar_id}>', 'avatar_system.php' )" src="<{if $avatar.avatar_display}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>"
+                        <img class="cursorpointer" id="avt<{$avatar.avatar_id}>" onclick="Xoops.changeStatus( 'avatar_system.php', { op: 'update_display', avatar_id: <{$avatar.avatar_id}>, XOOPS_TOKEN_REQUEST: '<{$token}>' }, 'avt<{$avatar.avatar_id}>', 'avatar_system.php' )" src="<{if $avatar.avatar_display}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>"
                              alt="<{if $avatar.avatar_display}><{translate key='DISPLAY_IN_FORM'}><{else}><{translate key='DO_NOT_DISPLAY_IN_FORM'}><{/if}>" title="<{if $avatar.avatar_display}><{translate key='DISPLAY_IN_FORM'}><{else}><{translate key='DO_NOT_DISPLAY_IN_FORM'}><{/if}>" />
                         <img class="cursorhelp xo-tooltip" src="<{xoAdminIcons 'forum.png'}>" alt="<{$avatar.count}> <{translate key='USERS' dirname='avatars'}>" title="<{$avatar.count}> <{translate key='USERS' dirname='avatars'}>" />
                         <a class="xo-tooltip" href="avatar_system.php?op=edit&amp;avatar_id=<{$avatar.avatar_id}>" title="<{translate key='A_EDIT'}>">
diff --git a/htdocs/modules/images/admin/header.php b/htdocs/modules/images/admin/header.php
index 661a41899..5300977aa 100644
--- a/htdocs/modules/images/admin/header.php
+++ b/htdocs/modules/images/admin/header.php
@@ -43,11 +43,8 @@
 
 // check WRITE right by category before continue
 // (op names must match the controllers: categories.php and images.php)
-// the AJAX display toggle keeps its token valid for the next click on the same page
-if ($op === 'display' && ('POST' !== Request::getMethod() || !$xoops->security()->check(false))) {
-    // non-2xx so Xoops.changeStatus() does not flip the icon
-    http_response_code(403);
-    exit();
+if ($op === 'display') {
+    $xoops->security()->requireAjaxToken();
 }
 $write_cats = array();
 if ($redirect === 'categories.php' && $imgcat_id > 0 && in_array($op, array('edit', 'save', 'del', 'display'), true)) {
diff --git a/htdocs/modules/page/admin/content.php b/htdocs/modules/page/admin/content.php
index 31d4c32db..ceda7aa08 100644
--- a/htdocs/modules/page/admin/content.php
+++ b/htdocs/modules/page/admin/content.php
@@ -33,6 +33,7 @@
 
     case 'list':
     default:
+        $xoops->tpl()->assign('token', $xoops->security()->createToken(3600));
         $admin_page->addTips(PageLocale::CONTENT_TIPS);
         $admin_page->addItemButton(PageLocale::A_ADD_CONTENT, 'content.php?op=new', 'add');
         $admin_page->renderTips();
@@ -206,6 +207,7 @@
         break;
 
     case 'update_status':
+        $xoops->security()->requireAjaxToken();
         $content_id = Request::getInt('content_id', 0);
         if ($content_id > 0) {
             $obj = $content_Handler->get($content_id);
@@ -219,6 +221,7 @@
         break;
 
     case 'update_display':
+        $xoops->security()->requireAjaxToken();
         $content_id = Request::getInt('content_id', 0);
         if ($content_id > 0) {
             $obj = $content_Handler->get($content_id);
diff --git a/htdocs/modules/page/admin/permissions.php b/htdocs/modules/page/admin/permissions.php
index 71882248b..7565e75cd 100644
--- a/htdocs/modules/page/admin/permissions.php
+++ b/htdocs/modules/page/admin/permissions.php
@@ -96,12 +96,7 @@
         break;
 
     case 'update_view':
-        // keep the token valid for the next toggle on the same page
-        if ('POST' !== Request::getMethod() || !$xoops->security()->check(false)) {
-            // non-2xx so Xoops.changeStatus() does not flip the icon
-            http_response_code(403);
-            exit();
-        }
+        $xoops->security()->requireAjaxToken();
         $content_id = Request::getInt('content_id', 0, 'POST');
         $group = Request::getInt('group', 0, 'POST');
         $status = Request::getString('status', '', 'POST');
diff --git a/htdocs/modules/page/admin/related.php b/htdocs/modules/page/admin/related.php
index 278d60778..37121db57 100644
--- a/htdocs/modules/page/admin/related.php
+++ b/htdocs/modules/page/admin/related.php
@@ -33,6 +33,7 @@
 
     case 'list':
     default:
+        $xoops->tpl()->assign('token', $xoops->security()->createToken(3600));
         $admin_page->addTips(PageLocale::RELATED_TIPS);
         $admin_page->addItemButton(PageLocale::A_ADD_RELATED, 'related.php?op=new', 'add');
         $admin_page->renderTips();
@@ -178,19 +179,7 @@
         break;
 
     case 'update_status':
-        $related_id = Request::getInt('related_id', 0);
-        if ($related_id > 0) {
-            $obj = $related_Handler->get($related_id);
-            $old = $obj->getVar('related_domenu');
-            $obj->setVar('related_domenu', !$old);
-            if ($related_Handler->insert($obj)) {
-                exit;
-            }
-            echo $obj->getHtmlErrors();
-        }
-        break;
-
-    case 'view':
+        $xoops->security()->requireAjaxToken();
         $related_id = Request::getInt('related_id', 0);
         if ($related_id > 0) {
             $obj = $related_Handler->get($related_id);
diff --git a/htdocs/modules/page/templates/admin/page_admin_content.tpl b/htdocs/modules/page/templates/admin/page_admin_content.tpl
index 72577d44e..e9976c5f0 100644
--- a/htdocs/modules/page/templates/admin/page_admin_content.tpl
+++ b/htdocs/modules/page/templates/admin/page_admin_content.tpl
@@ -32,11 +32,11 @@
             <td class="txtleft width35"><{$pagecontent.content_title}></td>
             <td class="xo-actions txtcenter width15">
                 <img id="loading_display<{$pagecontent.content_id}>" src="<{xoAppUrl 'media/xoops/images/spinner.gif'}>" style="display:none;" alt="<{translate key="LOADING"}>" />
-                <img class="cursorpointer" id="display<{$pagecontent.content_id}>" onclick="Xoops.changeStatus( 'pagecontent.php', { op: 'update_display', content_id: <{$pagecontent.content_id}> }, 'display<{$pagecontent.content_id}>', 'content.php' )" src="<{if $pagecontent.content_maindisplay}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{if $pagecontent.content_maindisplay}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" title="<{if $pagecontent.content_maindisplay}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" />
+                <img class="cursorpointer" id="display<{$pagecontent.content_id}>" onclick="Xoops.changeStatus( 'content.php', { op: 'update_display', content_id: <{$pagecontent.content_id}>, XOOPS_TOKEN_REQUEST: '<{$token}>' }, 'display<{$pagecontent.content_id}>', 'content.php' )" src="<{if $pagecontent.content_maindisplay}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{if $pagecontent.content_maindisplay}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" title="<{if $pagecontent.content_maindisplay}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" />
             </td>
             <td class="xo-actions txtcenter width5">
                 <img id="loading_sml<{$pagecontent.content_id}>" src="<{xoAppUrl 'media/xoops/images/spinner.gif'}>" style="display:none;" alt="<{translate key="LOADING"}>" />
-                <img class="cursorpointer" id="sml<{$pagecontent.content_id}>" onclick="Xoops.changeStatus( 'content.php', { op: 'update_status', content_id: <{$pagecontent.content_id}> }, 'sml<{$pagecontent.content_id}>', 'content.php' )" src="<{if $pagecontent.content_status}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{if $pagecontent.content_status}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" title="<{if $pagecontent.content_status}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" />
+                <img class="cursorpointer" id="sml<{$pagecontent.content_id}>" onclick="Xoops.changeStatus( 'content.php', { op: 'update_status', content_id: <{$pagecontent.content_id}>, XOOPS_TOKEN_REQUEST: '<{$token}>' }, 'sml<{$pagecontent.content_id}>', 'content.php' )" src="<{if $pagecontent.content_status}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{if $pagecontent.content_status}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" title="<{if $pagecontent.content_status}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" />
             </td>
             <td class="txtcenter width5"><{$pagecontent.content_weight}></td>
             <td class="txtcenter width5"><{$pagecontent.content_hits}></td>
diff --git a/htdocs/modules/page/templates/admin/page_admin_related.tpl b/htdocs/modules/page/templates/admin/page_admin_related.tpl
index a2efe9c80..b7c0cf82e 100644
--- a/htdocs/modules/page/templates/admin/page_admin_related.tpl
+++ b/htdocs/modules/page/templates/admin/page_admin_related.tpl
@@ -34,7 +34,7 @@
                 <td class="txtcenter width15"><{$item_r.navigation}></td>
                 <td class="xo-actions txtcenter width5">
                     <img id="loading_sml<{$item_r.related_id}>" src="<{xoAppUrl 'media/xoops/images/spinner.gif'}>" style="display:none;" alt="<{translate key="LOADING"}>" />
-                    <img class="cursorpointer" id="sml<{$item_r.related_id}>" onclick="Xoops.changeStatus( 'related.php', { op: 'update_status', related_id: <{$item_r.related_id}> }, 'sml<{$item_r.related_id}>', 'related.php' )" src="<{if $item_r.related_domenu}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{if $item_r.related_domenu}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" title="<{if $item_r.related_domenu}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" />
+                    <img class="cursorpointer" id="sml<{$item_r.related_id}>" onclick="Xoops.changeStatus( 'related.php', { op: 'update_status', related_id: <{$item_r.related_id}>, XOOPS_TOKEN_REQUEST: '<{$token}>' }, 'sml<{$item_r.related_id}>', 'related.php' )" src="<{if $item_r.related_domenu}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{if $item_r.related_domenu}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" title="<{if $item_r.related_domenu}><{translate key="A_DISABLE"}><{else}><{translate key="A_ENABLE"}><{/if}>" />
                 </td>
                 <td class="xo-actions txtcenter width10">
                     <a href="related.php?op=edit&amp;related_id=<{$item_r.related_id}>" title="<{translate key="A_EDIT"}>">
diff --git a/htdocs/modules/profile/admin/deactivate.php b/htdocs/modules/profile/admin/deactivate.php
index 3c2aa800e..0751e07fd 100644
--- a/htdocs/modules/profile/admin/deactivate.php
+++ b/htdocs/modules/profile/admin/deactivate.php
@@ -10,6 +10,7 @@
 */
 
 use Xoops\Core\FixedGroups;
+use Xoops\Core\Request;
 
 /**
  * Extended User Profile
@@ -25,11 +26,18 @@
 $xoops = Xoops::getInstance();
 $xoops->header();
 
-if (!isset($_REQUEST['uid'])) {
+if ('POST' !== Request::getMethod() || !$xoops->security()->check()) {
+    $xoops->redirect('index.php', 3, implode('<br />', $xoops->security()->getErrors()));
+}
+$uid = Request::getInt('uid', 0, 'POST');
+// exact "0" or "1" only: getInt() would turn "0.5" or "abc" into a valid level
+$level = Request::getString('level', '', 'POST');
+if (0 === $uid || !in_array($level, ['0', '1'], true)) {
     $xoops->redirect("index.php", 2, _PROFILE_AM_NOSELECTION);
 }
+$level = (int) $level;
 $member_handler = $xoops->getHandlerMember();
-$user = $member_handler->getUser($_REQUEST['uid']);
+$user = $member_handler->getUser($uid);
 if (!$user || $user->isNew()) {
     $xoops->redirect("index.php", 2, _PROFILE_AM_USERDONEXIT);
 }
@@ -37,15 +45,15 @@
 if (in_array(FixedGroups::ADMIN, $user->getGroups())) {
     $xoops->redirect("index.php", 2, _PROFILE_AM_CANNOTDEACTIVATEWEBMASTERS);
 }
-$user->setVar('level', $_REQUEST['level']);
+$user->setVar('level', $level);
 if ($member_handler->insertUser($user)) {
-    if ($_REQUEST['level'] == 1) {
+    if (1 === $level) {
         $message = _PROFILE_AM_USER_ACTIVATED;
     } else {
         $message = _PROFILE_AM_USER_DEACTIVATED;
     }
 } else {
-    if ($_REQUEST['level'] == 1) {
+    if (1 === $level) {
         $message = _PROFILE_AM_USER_NOT_ACTIVATED;
     } else {
         $message = _PROFILE_AM_USER_NOT_DEACTIVATED;
diff --git a/htdocs/modules/profile/admin/step.php b/htdocs/modules/profile/admin/step.php
index e64fedfb2..f22842fcc 100644
--- a/htdocs/modules/profile/admin/step.php
+++ b/htdocs/modules/profile/admin/step.php
@@ -39,6 +39,7 @@
 switch ($op) {
     case "list":
     default:
+        $xoops->tpl()->assign('token', $xoops->security()->createToken(3600));
         // Add Scripts
         $xoops->theme()->addScript('media/xoops/xoops.js');
         $admin_page->addItemButton(XoopsLocale::A_ADD . ' ' . _PROFILE_AM_STEP, 'step.php?op=new', 'add');
@@ -123,6 +124,7 @@
         break;
 
     case "step_update":
+        $xoops->security()->requireAjaxToken();
         $id = Request::getInt('id', 0, 'post');
         if ($id > 0) {
             $obj = $regstep_Handler->get($id);
diff --git a/htdocs/modules/profile/templates/admin/steplist.tpl b/htdocs/modules/profile/templates/admin/steplist.tpl
index 95649e99b..02441db4e 100644
--- a/htdocs/modules/profile/templates/admin/steplist.tpl
+++ b/htdocs/modules/profile/templates/admin/steplist.tpl
@@ -26,7 +26,7 @@
             <td class="xo-actions txtcenter width10">
                 <img id="loading_sml{$step.step_id}" src="{xoAppUrl 'media/xoops/images/spinner.gif'}" style="display:none;" alt="{translate key='LOADING'}" />
                 <img class="cursorpointer" id="sml{$step.step_id}"
-                     onclick="Xoops.changeStatus( 'step.php', { op: 'step_update', id: {$step.step_id} }, 'sml{$step.step_id}', 'step.php' )"
+                     onclick="Xoops.changeStatus( 'step.php', { op: 'step_update', id: {$step.step_id}, XOOPS_TOKEN_REQUEST: '{$token}' }, 'sml{$step.step_id}', 'step.php' )"
                      src="{if $step.step_save}{xoAdminIcons 'success.png'}{else}{xoAdminIcons 'cancel.png'}{/if}"
                      alt="{if $step.step_save}{translate key='NO'}{else}{translate key='YES'}{/if}"
                      title="{if $step.step_save}{translate key='NO'}{else}{translate key='YES'}{/if}"/>
diff --git a/htdocs/modules/profile/templates/profile_userinfo.tpl b/htdocs/modules/profile/templates/profile_userinfo.tpl
index 8663bb654..39f2a9da2 100644
--- a/htdocs/modules/profile/templates/profile_userinfo.tpl
+++ b/htdocs/modules/profile/templates/profile_userinfo.tpl
@@ -48,6 +48,7 @@
         <form method="post" action="{$xoops_url}/modules/{$xoops_dirname}/admin/deactivate.php">
         <input class="btn btn-default" type="button" value="{$lang_editprofile}" onclick="location='{$xoops_url}/modules/{$xoops_dirname}/admin/user.php?op=edit&amp;id={$user_uid}'" />
         <input type="hidden" name="uid" value="{$user_uid}" />
+        {$token}
         {if $userlevel == 1}
             <input type="hidden" name="level" value="0" />
             <input class="btn btn-default" type="button" value="{$smarty.const._PROFILE_MA_DEACTIVATE}" onclick="submit();" />
diff --git a/htdocs/modules/profile/user.php b/htdocs/modules/profile/user.php
index ca99433a2..b2fa2cb47 100644
--- a/htdocs/modules/profile/user.php
+++ b/htdocs/modules/profile/user.php
@@ -105,6 +105,9 @@
             echo $xoops->confirm(array('op' => 'delete', 'ok' => 1), 'user.php', XoopsLocale::Q_ARE_YOU_SURE_TO_DELETE_ACCOUNT . '<br/>' . XoopsLocale::THIS_WILL_REMOVE_ALL_YOUR_INFO);
             include __DIR__ . '/footer.php';
         } else {
+            if (!$xoops->security()->check()) {
+                $xoops->redirect('user.php', 3, implode('<br />', $xoops->security()->getErrors()));
+            }
             $del_uid = $xoops->user->getVar("uid");
             if (false != $xoops->getHandlerMember()->deleteUser($xoops->user)) {
                 $xoops->getHandlerOnline()->destroy($del_uid);
diff --git a/htdocs/modules/profile/userinfo.php b/htdocs/modules/profile/userinfo.php
index 9b0582f10..42cfd43b2 100644
--- a/htdocs/modules/profile/userinfo.php
+++ b/htdocs/modules/profile/userinfo.php
@@ -117,6 +117,7 @@
     $xoops->tpl()->assign('lang_editprofile', XoopsLocale::EDIT_PROFILE);
     $xoops->tpl()->assign('lang_deleteaccount', XoopsLocale::DELETE_ACCOUNT);
     $xoops->tpl()->assign('userlevel', $thisUser->isActive());
+    $xoops->tpl()->assign('token', $xoops->security()->getTokenHTML());
 }
 
 // Let extensions add navigation button
diff --git a/htdocs/modules/smilies/admin/smilies.php b/htdocs/modules/smilies/admin/smilies.php
index 5b43916ca..978e7f23d 100644
--- a/htdocs/modules/smilies/admin/smilies.php
+++ b/htdocs/modules/smilies/admin/smilies.php
@@ -45,6 +45,7 @@
 switch ($op) {
     case 'list':
     default:
+        $xoops->tpl()->assign('token', $xoops->security()->createToken(3600));
         $admin_page->addTips(_AM_SMILIES_TIPS);
         $admin_page->addItemButton(_AM_SMILIES_ADD, 'smilies.php?op=add', 'add');
         $admin_page->renderTips();
@@ -162,6 +163,7 @@
 
     case 'smilies_update_display':
         $xoops->logger()->quiet();
+        $xoops->security()->requireAjaxToken();
         $smiley_id = Request::getInt('smiley_id', 0);
         if ($smiley_id > 0) {
             $obj = $helper->getHandlerSmilies()->get($smiley_id);
diff --git a/htdocs/modules/smilies/templates/admin/smilies_smilies.tpl b/htdocs/modules/smilies/templates/admin/smilies_smilies.tpl
index ce1b93991..4b837ce31 100644
--- a/htdocs/modules/smilies/templates/admin/smilies_smilies.tpl
+++ b/htdocs/modules/smilies/templates/admin/smilies_smilies.tpl
@@ -32,7 +32,7 @@
                 <td class="txtleft">{$smiley.smiley_emotion}</td>
                 <td class="xo-actions txtcenter width5">
                     <img id="loading_sml{$smiley.smiley_id}" src="{xoAppUrl 'media/xoops/images/spinner.gif'}" style="display:none;" alt="{translate key='LOADING'}" />
-                    <img class="cursorpointer" id="sml{$smiley.smiley_id}" onclick="Xoops.changeStatus( 'smilies.php', { op: 'smilies_update_display', smiley_id: {$smiley.smiley_id} }, 'sml{$smiley.smiley_id}', 'smilies.php' )" src="{if $smiley.smiley_display}{xoAdminIcons 'success.png'}{else}{xoAdminIcons 'cancel.png'}{/if}" alt="{if $smiley.smiley_display}{$smarty.const._AM_SMILIES_OFF}{else}{$smarty.const._AM_SMILIES_ON}{/if}" title="{if $smiley.smiley_display}{$smarty.const._AM_SMILIES_OFF}{else}{$smarty.const._AM_SMILIES_ON}{/if}" />
+                    <img class="cursorpointer" id="sml{$smiley.smiley_id}" onclick="Xoops.changeStatus( 'smilies.php', { op: 'smilies_update_display', smiley_id: {$smiley.smiley_id}, XOOPS_TOKEN_REQUEST: '{$token}' }, 'sml{$smiley.smiley_id}', 'smilies.php' )" src="{if $smiley.smiley_display}{xoAdminIcons 'success.png'}{else}{xoAdminIcons 'cancel.png'}{/if}" alt="{if $smiley.smiley_display}{$smarty.const._AM_SMILIES_OFF}{else}{$smarty.const._AM_SMILIES_ON}{/if}" title="{if $smiley.smiley_display}{$smarty.const._AM_SMILIES_OFF}{else}{$smarty.const._AM_SMILIES_ON}{/if}" />
                 </td>
                 <td class="xo-actions txtcenter width10">
                     <a href="smilies.php?op=edit&amp;smiley_id={$smiley.smiley_id}" title="{$smarty.const._AM_SMILIES_EDIT}">
diff --git a/htdocs/modules/system/admin.php b/htdocs/modules/system/admin.php
index 295ff18ca..d5b551ead 100644
--- a/htdocs/modules/system/admin.php
+++ b/htdocs/modules/system/admin.php
@@ -81,6 +81,7 @@
     $op = Request::getString('op', '');
     if ($op === 'system_activate') {
         \Xoops::getInstance()->logger()->quiet();
+        $xoops->security()->requireAjaxToken();
         $part = Request::getString('type', '');
         $config_handler = $xoops->getHandlerConfig();
 
@@ -102,6 +103,7 @@
     // Define scripts
     $xoops->theme()->addBaseScriptAssets('@jquery');
     $xoops->theme()->addBaseScriptAssets('modules/system/js/admin.js');
+    system_addAjaxToken();
     // Define Breadcrumb and tips
     $admin_page = new \Xoops\Module\Admin();
     $admin_page->addBreadcrumbLink(SystemLocale::CONTROL_PANEL, \XoopsBaseConfig::get('url') . '/admin.php', true);
diff --git a/htdocs/modules/system/admin/blocksadmin/main.php b/htdocs/modules/system/admin/blocksadmin/main.php
index e28867715..bf581f6e4 100644
--- a/htdocs/modules/system/admin/blocksadmin/main.php
+++ b/htdocs/modules/system/admin/blocksadmin/main.php
@@ -54,8 +54,8 @@
     'selvis' => -1
 );
 foreach ($sel as $key => $value) {
-    $_{$key} = isset($_COOKIE[$key]) ? (int)($_COOKIE[$key]) : $value;
-    ${$key} = Request::getInt($key, $_{$key}, $method);
+    $default = isset($_COOKIE[$key]) ? (int)($_COOKIE[$key]) : $value;
+    ${$key} = Request::getInt($key, $default, $method);
     setcookie($key, ${$key});
 }
 
@@ -81,6 +81,7 @@
         // Define scripts
         $xoops->theme()->addScript('modules/system/js/admin.js');
         $xoops->theme()->addScript('modules/system/js/blocks.js');
+        system_addAjaxToken();
         // Define Breadcrumb and tips
         $admin_page = new \Xoops\Module\Admin();
         $admin_page->addBreadcrumbLink(SystemLocale::CONTROL_PANEL, \XoopsBaseConfig::get('url') . '/admin.php', true);
@@ -203,6 +204,7 @@
         $xoops->theme()->addScript('media/jquery/plugins/jquery.form.js');
         $xoops->theme()->addScript('modules/system/js/admin.js');
         $xoops->theme()->addScript('modules/system/js/blocks.js');
+        system_addAjaxToken();
         // Define Breadcrumb and tips
         $admin_page = new \Xoops\Module\Admin();
         $admin_page->addBreadcrumbLink(SystemLocale::CONTROL_PANEL, \XoopsBaseConfig::get('url') . '/admin.php', true);
@@ -223,6 +225,7 @@
         break;
 
     case 'display':
+        $xoops->security()->requireAjaxToken();
         // Initialize blocks handler
         $block_handler = $xoops->getHandlerBlock();
         // Get variable
@@ -238,6 +241,7 @@
         break;
 
     case 'drag':
+        $xoops->security()->requireAjaxToken();
         // Initialize blocks handler
         $block_handler = $xoops->getHandlerBlock();
         // Get variable
@@ -253,6 +257,7 @@
         break;
 
     case 'order':
+        $xoops->security()->requireAjaxToken();
         // Initialize blocks handler
         $block_handler = $xoops->getHandlerBlock();
         if (isset($_POST['blk'])) {
diff --git a/htdocs/modules/system/admin/extensions/main.php b/htdocs/modules/system/admin/extensions/main.php
index 85a2ea36c..2fb81cda8 100644
--- a/htdocs/modules/system/admin/extensions/main.php
+++ b/htdocs/modules/system/admin/extensions/main.php
@@ -58,6 +58,7 @@
         $xoops->theme()->addScript('media/jquery/plugins/jquery.jeditable.js');
         $xoops->theme()->addScript('modules/system/js/admin.js');
         $xoops->theme()->addScript('modules/system/js/module.js');
+        system_addAjaxToken();
         // Define Breadcrumb and tips
         $admin_page = new \Xoops\Module\Admin();
         $admin_page->addBreadcrumbLink(SystemLocale::CONTROL_PANEL, \XoopsBaseConfig::get('url') . '/admin.php', true);
diff --git a/htdocs/modules/system/admin/modulesadmin/main.php b/htdocs/modules/system/admin/modulesadmin/main.php
index 36e12ed85..b8272cf67 100644
--- a/htdocs/modules/system/admin/modulesadmin/main.php
+++ b/htdocs/modules/system/admin/modulesadmin/main.php
@@ -58,6 +58,7 @@
         $xoops->theme()->addScript('media/jquery/plugins/jquery.jeditable.js');
         $xoops->theme()->addScript('modules/system/js/admin.js');
         $xoops->theme()->addScript('modules/system/js/module.js');
+        system_addAjaxToken();
         // Define Breadcrumb and tips
         $admin_page = new \Xoops\Module\Admin();
         $admin_page->addBreadcrumbLink(SystemLocale::CONTROL_PANEL, \XoopsBaseConfig::get('url') . '/admin.php', true);
@@ -92,22 +93,28 @@
 
     case 'rename':
         $xoops->logger()->quiet();
-        //$xoops->disableErrorReporting();
+        $xoops->security()->requireAjaxToken();
 
         $mid = Request::getInt('id', 0, 'post');
         $value = Request::getString('value', '', 'post');
-        if ($mid != 0) {
-            $module_handler = $xoops->getHandlerModule();
-            $module = $module_handler->getById($mid);
-            $module->setVar('name', $value);
-            if ($module_handler->insertModule($module)) {
-                echo $value;
-
-            }
+        $module_handler = $xoops->getHandlerModule();
+        $module = $mid > 0 ? $module_handler->getById($mid) : null;
+        if (!is_object($module)) {
+            http_response_code(404);
+            break;
+        }
+        $module->setVar('name', $value);
+        if (!$module_handler->insertModule($module)) {
+            // an error status makes jEditable restore the old name
+            http_response_code(500);
+            break;
         }
+        // jEditable inserts the response as HTML
+        echo htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
         break;
 
     case 'order':
+        $xoops->security()->requireAjaxToken();
         // Get Module Handler
         $module_handler = $xoops->getHandlerModule();
         if (isset($_POST['mod'])) {
@@ -131,6 +138,7 @@
 
     case 'active':
         $xoops->logger()->quiet();
+        $xoops->security()->requireAjaxToken();
         //$xoops->disableErrorReporting();
         // Get module handler
         $module_handler = $xoops->getHandlerModule();
@@ -159,6 +167,7 @@
 
     case 'display_in_menu':
         $xoops->logger()->quiet();
+        $xoops->security()->requireAjaxToken();
         //$xoops->disableErrorReporting();
         // Get module handler
         $module_handler = $xoops->getHandlerModule();
diff --git a/htdocs/modules/system/blocks/main.php b/htdocs/modules/system/blocks/main.php
index 1a1ce1ae5..9ef275fb5 100644
--- a/htdocs/modules/system/blocks/main.php
+++ b/htdocs/modules/system/blocks/main.php
@@ -80,6 +80,7 @@ function b_system_main_edit($options)
     // Define scripts
     $xoops->theme()->addScript('media/jquery/plugins/jquery.jeditable.js');
     $xoops->theme()->addScript('modules/system/js/module.js');
+    system_addAjaxToken();
 
     $admin_page->addTips(SystemLocale::MENU_TIPS);
     $admin_page->renderTips();
diff --git a/htdocs/modules/system/include/functions.php b/htdocs/modules/system/include/functions.php
index 92afb5690..a463d340a 100644
--- a/htdocs/modules/system/include/functions.php
+++ b/htdocs/modules/system/include/functions.php
@@ -123,6 +123,25 @@ function system_AdminIcons($img)
     return $url;
 }
 
+/**
+ * Give the page's AJAX scripts (admin.js, blocks.js, module.js) the token
+ * their state changes send, as the JS global XOOPS_TOKEN
+ *
+ * @return void
+ */
+function system_addAjaxToken(): void
+{
+    static $added = false;
+    if (!$added) {
+        $xoops = Xoops::getInstance();
+        $token = json_encode($xoops->security()->createToken(3600));
+        $xoops->theme()->addScript('', array('type' => 'text/javascript'), 'var XOOPS_TOKEN = ' . $token . ';');
+        // reloads the page when the token has expired (HTTP 403)
+        $xoops->theme()->addScript('media/xoops/xoops.js');
+        $added = true;
+    }
+}
+
 /**
  * @param string $name
  * @return void
diff --git a/htdocs/modules/system/js/blocks.js b/htdocs/modules/system/js/blocks.js
index 8e88c5a3a..c4400698e 100644
--- a/htdocs/modules/system/js/blocks.js
+++ b/htdocs/modules/system/js/blocks.js
@@ -8,16 +8,16 @@ $(document).ready(
 				connectWith: '.xo-blocksection',
 				update: function(event, ui) {
                     var list = $(this).sortable( 'serialize');
-                    $.post( 'admin.php?fct=blocksadmin&op=order', list );
+                    $.post( 'admin.php?fct=blocksadmin&op=order', list + '&XOOPS_TOKEN_REQUEST=' + XOOPS_TOKEN );
                 },
 				receive: function(event, ui) {
                     var side = $(this).attr('side');
                     var bid = $(ui.item).attr('bid');
                     var list = $(this).sortable( 'serialize');
                     
-                    $.post( 'admin.php', { fct: 'blocksadmin', op: 'drag', bid: bid, side: side } );
+                    $.post( 'admin.php', { fct: 'blocksadmin', op: 'drag', bid: bid, side: side, XOOPS_TOKEN_REQUEST: XOOPS_TOKEN } );
                     
-                    $.post( 'admin.php?fct=blocksadmin&op=order', list );
+                    $.post( 'admin.php?fct=blocksadmin&op=order', list + '&XOOPS_TOKEN_REQUEST=' + XOOPS_TOKEN );
                       
                 }
 			}
@@ -31,16 +31,16 @@ $(document).ready(
 				connectWith: '.xo-blocksection'/*,
 				update: function(event, ui) {
                     var list = $(this).sortable( 'serialize');
-                    $.post( 'admin.php?fct=blocksadmin&op=order', list );
+                    $.post( 'admin.php?fct=blocksadmin&op=order', list + '&XOOPS_TOKEN_REQUEST=' + XOOPS_TOKEN );
                 },
 				receive: function(event, ui) {
                     var side = $(this).attr('side');
                     var bid = $(ui.item).attr('bid');
                     var list = $(this).sortable( 'serialize');
                     
-                    $.post( 'admin.php', { fct: 'blocksadmin', op: 'drag', bid: bid, side: side } );
+                    $.post( 'admin.php', { fct: 'blocksadmin', op: 'drag', bid: bid, side: side, XOOPS_TOKEN_REQUEST: XOOPS_TOKEN } );
                     
-                    $.post( 'admin.php?fct=blocksadmin&op=order', list );
+                    $.post( 'admin.php?fct=blocksadmin&op=order', list + '&XOOPS_TOKEN_REQUEST=' + XOOPS_TOKEN );
                       
                 }*/
 			}
diff --git a/htdocs/modules/system/js/module.js b/htdocs/modules/system/js/module.js
index cceb2da6e..a120f47e4 100644
--- a/htdocs/modules/system/js/module.js
+++ b/htdocs/modules/system/js/module.js
@@ -47,7 +47,8 @@ $(function() {
 
     $(".rename").editable("admin.php?fct=modulesadmin&op=rename", {
         indicator : "<img src='../../media/xoops/images/spinner.gif'>",
-        cssclass : 'span2'
+        cssclass : 'span2',
+        submitdata : function() { return { XOOPS_TOKEN_REQUEST: XOOPS_TOKEN }; }
     });
 
     $(".modal-backdrop").click(function(){
@@ -64,7 +65,7 @@ $(function() {
         placeholder: 'ui-state-highlight',
         update: function(event, ui) {
             var list = $(this).sortable( 'serialize');
-            $.post( 'admin.php?fct=modulesadmin&op=order', list );
+            $.post( 'admin.php?fct=modulesadmin&op=order', list + '&XOOPS_TOKEN_REQUEST=' + XOOPS_TOKEN );
         }}
     );
     $( "#sortable" ).disableSelection();
@@ -94,7 +95,7 @@ function module_Detail(id){
 }
 
 function module_Disable(id, enable, disable){
-    $.post( 'admin.php', { fct: 'modulesadmin', op: 'active', mid: id } ,
+    $.post( 'admin.php', { fct: 'modulesadmin', op: 'active', mid: id, XOOPS_TOKEN_REQUEST: XOOPS_TOKEN } ,
     function(reponse, textStatus) {
         if (textStatus=='success') {
             if(reponse){
@@ -110,7 +111,7 @@ function module_Disable(id, enable, disable){
 }
 
 function module_Hide(id){
-    $.post( 'admin.php', { fct: 'modulesadmin', op: 'display_in_menu', mid: id } ,
+    $.post( 'admin.php', { fct: 'modulesadmin', op: 'display_in_menu', mid: id, XOOPS_TOKEN_REQUEST: XOOPS_TOKEN } ,
     function(reponse, textStatus) {
         if (textStatus=='success') {
             if(reponse != 0){
diff --git a/htdocs/modules/system/templates/admin/system_blocks_item.tpl b/htdocs/modules/system/templates/admin/system_blocks_item.tpl
index 2bc0c2d0f..02ecb78d6 100644
--- a/htdocs/modules/system/templates/admin/system_blocks_item.tpl
+++ b/htdocs/modules/system/templates/admin/system_blocks_item.tpl
@@ -9,7 +9,7 @@
     </div>
     <div class="xo-blockaction xo-actions">
         <img id="loading_img<{$item.bid}>" src="./images/mimetypes/spinner.gif" style="display:none;" title="<{translate key='LOADING'}>" alt="<{translate key='LOADING'}>" />
-        <img class="xo-tooltip" id="img<{$item.bid}>" onclick="system_setStatus( { fct: 'blocksadmin', op: 'display', bid: <{$item.bid}>, visible: <{if $item.visible}>0<{else}>1<{/if}> }, 'img<{$item.bid}>', 'admin.php' )"
+        <img class="xo-tooltip" id="img<{$item.bid}>" onclick="system_setStatus( { fct: 'blocksadmin', op: 'display', bid: <{$item.bid}>, visible: <{if $item.visible}>0<{else}>1<{/if}>, XOOPS_TOKEN_REQUEST: XOOPS_TOKEN }, 'img<{$item.bid}>', 'admin.php' )"
              src="<{if $item.visible}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{if $item.visible}><{translate key='HIDE_BLOCK' dirname='system'}><{else}><{translate key='DISPLAY_BLOCK' dirname='system'}><{/if}>&nbsp;<{$item.name}>" title="<{if $item.visible}><{translate key='HIDE_BLOCK' dirname='system'}><{else}><{translate key='DISPLAY_BLOCK' dirname='system'}><{/if}>&nbsp;<{$item.name}>" />
         <a class="xo-tooltip" href="admin.php?fct=blocksadmin&amp;op=edit&amp;bid=<{$item.bid}>" title="<{translate key='A_EDIT'}>">
             <img src="<{xoAdminIcons 'edit.png'}>" alt="<{translate key='A_EDIT'}>" />
diff --git a/htdocs/modules/system/templates/admin/system_index.tpl b/htdocs/modules/system/templates/admin/system_index.tpl
index 6b322d991..24574668f 100644
--- a/htdocs/modules/system/templates/admin/system_index.tpl
+++ b/htdocs/modules/system/templates/admin/system_index.tpl
@@ -29,7 +29,7 @@
         <td class="xo-actions width2">
             <{if $menuitem.used}>
                 <img id="loading_<{$menuitem.file}>" src="images/spinner.gif" style="display:none;" alt="<{translate key='LOADING'}>" />
-                <img class="xo-tooltip" id="<{$menuitem.file}>" onclick="system_setStatus( { op: 'system_activate', type: '<{$menuitem.file}>' }, '<{$menuitem.file}>', 'admin.php' )" src="<{if $menuitem.status}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{translate key='CHANGE_STATUS'}>" title="<{translate key='CHANGE_STATUS'}>" />
+                <img class="xo-tooltip" id="<{$menuitem.file}>" onclick="system_setStatus( { op: 'system_activate', type: '<{$menuitem.file}>', XOOPS_TOKEN_REQUEST: XOOPS_TOKEN }, '<{$menuitem.file}>', 'admin.php' )" src="<{if $menuitem.status}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{translate key='CHANGE_STATUS'}>" title="<{translate key='CHANGE_STATUS'}>" />
             <{/if}>
         </td>
     </tr>
diff --git a/htdocs/modules/userrank/admin/userrank.php b/htdocs/modules/userrank/admin/userrank.php
index 5f709b518..f8183ed68 100644
--- a/htdocs/modules/userrank/admin/userrank.php
+++ b/htdocs/modules/userrank/admin/userrank.php
@@ -43,6 +43,7 @@
 
     case 'list':
     default:
+        $xoops->tpl()->assign('token', $xoops->security()->createToken(3600));
         // Add Scripts
         $xoops->theme()->addScript('media/xoops/xoops.js');
 
@@ -178,6 +179,7 @@
 
     // Update userrank status
     case 'userrank_update_special':
+        $xoops->security()->requireAjaxToken();
         // Get rank id
         $rank_id = Request::getInt('rank_id', 0);
         if ($rank_id > 0) {
diff --git a/htdocs/modules/userrank/templates/admin/userrank.tpl b/htdocs/modules/userrank/templates/admin/userrank.tpl
index 5a5f70bae..c2ba434b1 100644
--- a/htdocs/modules/userrank/templates/admin/userrank.tpl
+++ b/htdocs/modules/userrank/templates/admin/userrank.tpl
@@ -29,7 +29,7 @@
         <td class="txtcenter"><{$urank.rank_max}></td>
         <td class="xo-actions txtcenter">
             <img id="loading_sml<{$urank.rank_id}>" src="<{xoAppUrl 'media/xoops/images/spinner.gif'}>" style="display:none;" alt="<{translate key='LOADING'}>" />
-            <img class="cursorpointer xo-tooltip" id="sml<{$urank.rank_id}>" onclick="Xoops.changeStatus( 'userrank.php', { op: 'userrank_update_special', rank_id: <{$urank.rank_id}> }, 'sml<{$urank.rank_id}>' )" src="<{if $urank.rank_special}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{if $urank.rank_special}><{$smarty.const._AM_USERRANK_OFF}><{else}><{$smarty.const._AM_USERRANK_ON}><{/if}>" title="<{if $urank.rank_special}><{$smarty.const._AM_USERRANK_OFF}><{else}><{$smarty.const._AM_USERRANK_ON}><{/if}>" />
+            <img class="cursorpointer xo-tooltip" id="sml<{$urank.rank_id}>" onclick="Xoops.changeStatus( 'userrank.php', { op: 'userrank_update_special', rank_id: <{$urank.rank_id}>, XOOPS_TOKEN_REQUEST: '<{$token}>' }, 'sml<{$urank.rank_id}>' )" src="<{if $urank.rank_special}><{xoAdminIcons 'success.png'}><{else}><{xoAdminIcons 'cancel.png'}><{/if}>" alt="<{if $urank.rank_special}><{$smarty.const._AM_USERRANK_OFF}><{else}><{$smarty.const._AM_USERRANK_ON}><{/if}>" title="<{if $urank.rank_special}><{$smarty.const._AM_USERRANK_OFF}><{else}><{$smarty.const._AM_USERRANK_ON}><{/if}>" />
         </td>
         <td class="xo-actions txtcenter">
             <a class="xo-tooltip" href="./userrank.php?op=userrank_edit&amp;rank_id=<{$urank.rank_id}>" title="<{$smarty.const._AM_USERRANK_EDIT}>">
diff --git a/htdocs/user.php b/htdocs/user.php
index 456b7cd91..a2f678e84 100644
--- a/htdocs/user.php
+++ b/htdocs/user.php
@@ -121,6 +121,9 @@
             );
             $xoops->footer();
         } else {
+            if (!$xoops->security()->check()) {
+                $xoops->redirect('user.php', 3, implode('<br />', $xoops->security()->getErrors()));
+            }
             $del_uid = $xoops->user->getVar("uid");
             $member_handler = $xoops->getHandlerMember();
             if (false != $member_handler->deleteUser($xoops->user)) {
diff --git a/tests/unit/xoopsLib/Xoops/Core/SecurityTest.php b/tests/unit/xoopsLib/Xoops/Core/SecurityTest.php
index 49930fd0f..a8c97dc31 100644
--- a/tests/unit/xoopsLib/Xoops/Core/SecurityTest.php
+++ b/tests/unit/xoopsLib/Xoops/Core/SecurityTest.php
@@ -10,9 +10,10 @@ class SecurityTest extends \PHPUnit\Framework\TestCase
      */
     protected $object;
 
-    protected $SERVER_save;
-    protected $SESSION_save;
-    protected $moduleConfig_save;
+    protected $savedServer;
+    protected $savedSession;
+    protected $savedPost;
+    protected $savedModuleConfig;
 
     /**
      * Sets up the fixture, for example, opens a network connection.
@@ -21,9 +22,10 @@ class SecurityTest extends \PHPUnit\Framework\TestCase
     protected function setUp(): void
     {
         $this->object = new Security();
-        $this->SERVER_save = $_SERVER;
-        $this->SESSION_save = $_SESSION;
-        $this->moduleConfig_save = \Xoops::getInstance()->moduleConfig;
+        $this->savedServer = $_SERVER;
+        $this->savedSession = $_SESSION;
+        $this->savedPost = $_POST;
+        $this->savedModuleConfig = \Xoops::getInstance()->moduleConfig;
     }
 
     /**
@@ -32,9 +34,10 @@ protected function setUp(): void
      */
     protected function tearDown(): void
     {
-        $_SERVER = $this->SERVER_save;
-        $_SESSION = $this->SESSION_save;
-        \Xoops::getInstance()->moduleConfig = $this->moduleConfig_save;
+        $_SERVER = $this->savedServer;
+        $_SESSION = $this->savedSession;
+        $_POST = $this->savedPost;
+        \Xoops::getInstance()->moduleConfig = $this->savedModuleConfig;
     }
 
     public function test___construct()
@@ -76,6 +79,69 @@ public function test_check()
         $this->assertTrue(empty($_SESSION['XOOPS_TOKEN_SESSION']));
     }
 
+    // a wrongful exit() here would end the whole runner with status 0
+    #[\PHPUnit\Framework\Attributes\RunInSeparateProcess]
+    public function test_requireAjaxToken_keepsTokenForNextToggle()
+    {
+        unset($_SESSION['XOOPS_TOKEN_SESSION']);
+        $token = $this->object->createToken(3600);
+        $_SERVER['REQUEST_METHOD'] = 'POST';
+        $_POST['XOOPS_TOKEN_REQUEST'] = $token;
+
+        // returns (does not exit) for a valid POST, twice with one token
+        $this->object->requireAjaxToken();
+        $this->object->requireAjaxToken();
+        $this->assertSame($token, $_SESSION['XOOPS_TOKEN_SESSION'][0]['id']);
+    }
+
+    public static function rejectedAjaxRequests(): array
+    {
+        return [
+            'GET with body token' => ['GET', 'valid', false],
+            'POST without token'  => ['POST', null, false],
+            'POST invalid token'  => ['POST', 'nope', false],
+            'POST expired token'  => ['POST', 'valid', true],
+            'POST token in query' => ['POST', 'query', false],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('rejectedAjaxRequests')]
+    public function test_checkAjaxToken_rejects(string $method, ?string $token, bool $expired)
+    {
+        unset($_SESSION['XOOPS_TOKEN_SESSION']);
+        $valid = $this->object->createToken(3600);
+        if ($expired) {
+            $_SESSION['XOOPS_TOKEN_SESSION'][0]['expire'] = time() - 1;
+        }
+        $_SERVER['REQUEST_METHOD'] = $method;
+        $savedGet = $_GET;
+        $savedPost = $_POST;
+        $savedRequest = $_REQUEST;
+        unset($_POST['XOOPS_TOKEN_REQUEST'], $_REQUEST['XOOPS_TOKEN_REQUEST']);
+        if ('query' === $token) {
+            $_GET['XOOPS_TOKEN_REQUEST'] = $valid;
+            $_REQUEST['XOOPS_TOKEN_REQUEST'] = $valid;
+        } elseif (null !== $token) {
+            $_POST['XOOPS_TOKEN_REQUEST'] = 'valid' === $token ? $valid : $token;
+        }
+
+        try {
+            $this->assertFalse($this->object->checkAjaxToken());
+        } finally {
+            $_GET = $savedGet;
+            $_POST = $savedPost;
+            $_REQUEST = $savedRequest;
+        }
+    }
+
+    public function test_checkAjaxToken_acceptsValidPost()
+    {
+        unset($_SESSION['XOOPS_TOKEN_SESSION']);
+        $_SERVER['REQUEST_METHOD'] = 'POST';
+        $_POST['XOOPS_TOKEN_REQUEST'] = $this->object->createToken(3600);
+        $this->assertTrue($this->object->checkAjaxToken());
+    }
+
     public function test_createToken()
     {
         $instance = $this->object;
diff --git a/xoops_lib/Xoops/Core/Security.php b/xoops_lib/Xoops/Core/Security.php
index 245e353e1..e15370a6f 100644
--- a/xoops_lib/Xoops/Core/Security.php
+++ b/xoops_lib/Xoops/Core/Security.php
@@ -46,6 +46,42 @@ public function check($clearIfValid = true, $token = false, $name = 'XOOPS_TOKEN
         return $this->validateToken($token, $clearIfValid, $name);
     }
 
+    /**
+     * Stop an AJAX state change unless it is a POST carrying a valid token.
+     *
+     * The token is kept, so every toggle on a page can reuse the one token
+     * the page minted (use createToken() with a long timeout for it). A
+     * rejected request ends with HTTP 403, which keeps Xoops.changeStatus()
+     * from flipping its icon.
+     *
+     * @param string $name name of session variable
+     *
+     * @return void
+     */
+    public function requireAjaxToken($name = 'XOOPS_TOKEN'): void
+    {
+        if (!$this->checkAjaxToken($name)) {
+            http_response_code(403);
+            // media/xoops/xoops.js reloads the page on this marker to get a fresh token
+            header('X-Xoops-Token: rejected');
+            exit();
+        }
+    }
+
+    /**
+     * Is this a POST carrying a valid token in its body? The token is kept.
+     *
+     * @param string $name name of session variable
+     *
+     * @return bool
+     */
+    public function checkAjaxToken($name = 'XOOPS_TOKEN'): bool
+    {
+        // the token must come in the body, a query string leaks through logs and referers
+        $token = Request::getString($name . '_REQUEST', '', 'POST');
+        return 'POST' === Request::getMethod() && '' !== $token && $this->check(false, $token, $name);
+    }
+
     /**
      * Create a token in the user's session
      *