@@ -110,6 +110,8 @@ neon logo that doubles as the SVG favicon ([`7be5254`](../../commit/7be5254)):
 | **Password protection**: single password (no username), 90-day session cookie, brute-force lockout, logout entry; off in hotspot mode. Scripts/API clients authenticate with the password as an **API key** (`X-API-Key` header / `apikey` query param) | [`e74e712`](../../commit/e74e712) |
 | **One shared device password (Security tab)**: the password fields were pulled out of the WiFi/FTP/WebDAV tabs into a single **Security** sub-tab — one password now protects the web interface, FTP *and* WebDAV (set once, applies everywhere; applied live without a reboot). An **empty password is accepted** and disables protection for all three. The **hostname** moved to the top of the **General** tab (saved on its own; `/wificonfig` now does partial updates) and the navbar brand reads just **Leo Industries** | [`c6dfc67`](../../commit/c6dfc67) |
 | **FTP/WebDAV accept any username**: with one shared password the username is pointless, so both servers now authenticate by **password only — any username is accepted** (wrong password still rejected; empty device password = open). The username fields are gone from both tabs. FTP uses a **vendored, patched copy** of ESP-FTP-Server-Lib in [`lib/`](lib/ESP-FTP-Server-Lib) (password-only auth); WebDAV's self-contained server decodes the HTTP-Basic header and compares only the password | [`be96850`](../../commit/be96850) |
+| **FTP auto-start on boot**: a toggle in the FTP tab starts the FTP server automatically once WiFi is up after boot (same one-shot pattern as WebDAV), so it no longer has to be enabled by hand each time | [`PENDINGHASH4`](../../commit/PENDINGHASH4) |
+| **Configurable session-cookie lifetime**: the Security tab lets you set how long the web-interface login is remembered (in days) or choose **unlimited** (≈10 years; browsers cap cookies at ~400 days). Replaces the hard-coded 90-day cookie | [`PENDINGHASH4`](../../commit/PENDINGHASH4) |
 | **One-click OTA + version badge**: a Tools-tab button (also bindable command **186** / MQTT `firmware_update`) pulls the rolling `latest` GitHub release and flashes it over OTA; a navbar badge shows the running build and turns amber when an update is available (passive `/version` check) — click it to install | [`8527f5e`](../../commit/8527f5e) · [`b736abc`](../../commit/b736abc) |
 | **HTTP file sync**: pull audio files from a web server onto the SD card from a JSON manifest — additive, streamed in chunks straight to SD, background task with live progress + stop, abort-on-button, stall watchdog, auto-pauses playback and keeps the device awake mid-transfer. The manifest is streamed into the parser to halve peak RAM | [`ac24bbc`](../../commit/ac24bbc) · [`42d2c46`](../../commit/42d2c46) |
 | **WebDAV server**: mount the SD card as a network drive (`http://<ip>:81/`) to copy audio on/off it straight from Finder/Explorer — no FTP client needed. Self-contained server (OPTIONS/PROPFIND/GET/HEAD+ranges/PUT/DELETE/MKCOL/MOVE/COPY/LOCK) running in its own task pinned to core 0 so transfers never disturb the audio pipeline; optional HTTP-Basic credentials. Configure + auto-start on boot in its own **WebDAV** settings sub-tab; start/stop live from the Control tab, command **188** or MQTT `webdav` (Home Assistant switch included). With auto-start on, the share is announced over **Bonjour/mDNS** (`_webdav._tcp`, `path=/`) so it pops up by itself in the Finder/Explorer network sidebar — no manual "Connect to Server" needed (currently disabled — see `WEBDAV_ENABLE`) | [`9b2bee0`](../../commit/9b2bee0) |
 
@@ -745,24 +745,29 @@ paths:
   /security:
     get:
       tags: [Fork]
-      summary: Is web-interface password protection enabled?
+      summary: Password-protection status and session-cookie lifetime.
       responses:
         "200":
-          description: Whether a web password is set.
+          description: Whether a web password is set, plus the cookie lifetime in days (0 = unlimited).
           content:
             application/json:
               schema:
                 type: object
                 properties:
                   enabled:
                     type: boolean
+                  cookieDays:
+                    type: integer
+                    description: Session-cookie lifetime in days; 0 means unlimited.
     post:
       tags: [Fork]
-      summary: Set or clear the shared device password (web interface, FTP and WebDAV).
+      summary: Set the shared device password and/or the session-cookie lifetime.
       description: >
         Sets one shared password that protects the web interface, FTP and WebDAV at once
         (applied live, no reboot). An empty password is accepted and disables protection
-        for all three.
+        for all three. Both fields are optional: send only "cookieDays" to change the
+        session-cookie lifetime without touching the password. If "password" is omitted the
+        password is left unchanged.
       requestBody:
         required: true
         content:
@@ -772,9 +777,12 @@ paths:
               properties:
                 password:
                   type: string
+                cookieDays:
+                  type: integer
+                  description: Session-cookie lifetime in days; 0 means unlimited.
       responses:
         "200":
-          description: Password updated.
+          description: Settings updated.
   /login:
     post:
       tags: [Fork]
 
@@ -138,6 +138,12 @@
 			"title": "Passwort",
 			"placeholder": "Leer lassen, um den Schutz zu deaktivieren",
 			"desc": "Ein gemeinsames Passwort für alles: Webinterface, FTP und WebDAV. Bei FTP und WebDAV ist der Benutzername egal – jeder Benutzername funktioniert, es zählt nur dieses Passwort. Nach dem Anmelden im Webinterface bleibt man 90 Tage eingeloggt; im Hotspot-Modus ist der Schutz inaktiv. Leer lassen, um den Schutz überall (Webinterface, FTP, WebDAV) zu deaktivieren."
+		},
+		"cookie": {
+			"title": "Anmeldung merken",
+			"unlimited": "Unbegrenzt eingeloggt bleiben",
+			"days": "Eingeloggt bleiben für (Tage)",
+			"desc": "Wie lange du nach dem Anmelden im Webinterface eingeloggt bleibst. Browser begrenzen Cookies meist auf max. ~400 Tage."
 		}
 	},
 	"wifi": {
@@ -444,6 +450,7 @@
 	"ftp": {
 		"title": "FTP-Einstellungen",
 		"authHint": "FTP akzeptiert jeden Benutzernamen – nur das Passwort zählt. Das Passwort ist das gemeinsame Geräte-Passwort (Tab \"Sicherheit\"). Leeres Passwort = Zugriff ohne Anmeldung.",
+		"enable": "FTP beim Start automatisch aktivieren",
 		"user": {
 			"title": "FTP-Benutzername",
 			"placeholder": "Benutzername"
 
@@ -138,6 +138,12 @@
 			"title": "Password",
 			"placeholder": "Leave empty to disable protection",
 			"desc": "One shared password for everything: web interface, FTP and WebDAV. For FTP and WebDAV the username does not matter - any username works, only this password is checked. Once logged in to the web interface you stay logged in for 90 days; protection is inactive in hotspot mode. Leave empty to disable protection everywhere (web interface, FTP, WebDAV)."
+		},
+		"cookie": {
+			"title": "Stay logged in",
+			"unlimited": "Stay logged in indefinitely",
+			"days": "Stay logged in for (days)",
+			"desc": "How long you stay logged in to the web interface after signing in. Browsers usually cap cookies at ~400 days."
 		}
 	},
 	"wifi": {
@@ -444,6 +450,7 @@
 	"ftp": {
 		"title": "FTP-settings",
 		"authHint": "FTP accepts any username - only the password matters. The password is the shared device password (\"Security\" tab). An empty password means access without a login.",
+		"enable": "Start FTP automatically on boot",
 		"user": {
 			"title": "FTP-Username",
 			"placeholder": "username"
 
@@ -131,6 +131,12 @@
 			"title": "Mot de passe",
 			"placeholder": "Laisser vide pour désactiver la protection",
 			"desc": "Un seul mot de passe partagé pour tout : interface web, FTP et WebDAV. Pour le FTP et le WebDAV, le nom d'utilisateur n'a pas d'importance - n'importe quel nom fonctionne, seul ce mot de passe est vérifié. Une fois connecté à l'interface web, vous restez connecté pendant 90 jours ; la protection est inactive en mode hotspot. Laisser vide pour désactiver la protection partout (interface web, FTP, WebDAV)."
+		},
+		"cookie": {
+			"title": "Rester connecté",
+			"unlimited": "Rester connecté indéfiniment",
+			"days": "Rester connecté pendant (jours)",
+			"desc": "Durée pendant laquelle vous restez connecté à l'interface web après la connexion. Les navigateurs limitent généralement les cookies à ~400 jours."
 		}
 	},
 	"wifi": {
@@ -437,6 +443,7 @@
 	"ftp": {
 		"title": "Paramètres FTP",
 		"authHint": "Le FTP accepte n'importe quel nom d'utilisateur - seul le mot de passe compte. C'est le mot de passe partagé de l'appareil (onglet « Sécurité »). Un mot de passe vide permet l'accès sans connexion.",
+		"enable": "Démarrer le FTP automatiquement au démarrage",
 		"user": {
 			"title": "Nom d'utilisateur FTP",
 			"placeholder": "nom d'utilisateur"
 
@@ -3136,6 +3136,26 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 						</fieldset>
 					</div>
 				</form>
+				<hr>
+				<form action="#securityConfig" method="POST" onsubmit="saveCookieTimeout(); return false">
+					<div class="col-md-12 mb-4">
+						<fieldset>
+							<legend class="w-auto" data-i18n="security.cookie.title"></legend>
+							<div class="form-check form-switch mb-2">
+								<input class="form-check-input" type="checkbox" id="cookieUnlimited" name="cookieUnlimited">
+								<label class="form-check-label" for="cookieUnlimited" data-i18n="security.cookie.unlimited"></label>
+							</div>
+							<div class="mb-2">
+								<label for="cookieDays" data-i18n="[prepend]security.cookie.days">:</label>
+								<input type="number" class="form-control" id="cookieDays" name="cookieDays" min="1" max="3650" value="90">
+							</div>
+							<small class="form-text" data-i18n="security.cookie.desc"></small>
+							<div class="text-center mt-2">
+								<button type="submit" class="btn btn-primary" data-i18n="submit"></button>
+							</div>
+						</fieldset>
+					</div>
+				</form>
 			</div>
 		</div>
 		<div class="tab-pane fade" id="nav-wifi" role="tabpanel" aria-labelledby="nav-wifi-tab">
@@ -3239,10 +3259,20 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 		</div>
 		<div class="tab-pane fade" id="nav-ftp" role="tabpanel" aria-labelledby="nav-ftp-tab">
 			<div class="container" id="ftpConfig">
-				<div class="mb-3 col-md-12">
-					<legend data-i18n="ftp.title"></legend>
-					<div class="mb-2"><small class="text-muted" data-i18n="ftp.authHint"></small></div>
-				</div>
+				<form action="#ftpConfig" method="POST" onsubmit="ftpSettings('ftpConfig'); return false">
+					<div class="mb-3 col-md-12">
+						<legend data-i18n="ftp.title"></legend>
+						<div class="mb-2"><small class="text-muted" data-i18n="ftp.authHint"></small></div>
+						<div class="form-check form-switch mb-3">
+							<input class="form-check-input" type="checkbox" id="ftpEnable" name="ftpEnable">
+							<label class="form-check-label" for="ftpEnable" data-i18n="ftp.enable"></label>
+						</div>
+					</div>
+					<div class="text-center">
+						<button type="reset" class="btn btn-warning" data-i18n="reset"></button>&nbsp;<button
+							type="submit" class="btn btn-primary" data-i18n="submit"></button>
+					</div>
+				</form>
 				<hr>
 			</div>
 			<div class="container" id="ftpStart">
@@ -5346,6 +5376,7 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			let ftpSettings = settings.ftp;
 			if (ftpSettings) {
 				document.getElementById('nav-ftp-tab').setAttribute('data-visible', true);
+				document.getElementById("ftpEnable").checked = !!ftpSettings.enable;
 			}
 			// webdav (the sub-tab stays hidden unless the firmware reports WebDAV support)
 			let webdavSettingsData = settings.webdav;
@@ -5957,6 +5988,22 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			toaster.info(i18next.t("toast.saved"));
 		}
 
+		/* save the FTP auto-start-on-boot flag (no credentials: any username, password via Security tab) */
+		async function ftpSettings(clickedId) {
+			lastIdclicked = clickedId;
+			var myObj = {
+				"ftp": {
+					enable: document.getElementById('ftpEnable').checked
+				}
+			};
+			await fetch("http://" + host + "/settings", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify(myObj)
+			});
+			toaster.info(i18next.t("toast.saved"));
+		}
+
 		function ftpSetStatus(start) {
 			var myObj = {
 				"ftpStatus": {
@@ -7037,11 +7084,40 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			try {
 				const status = await (await fetch("http://" + host + "/security")).json();
 				document.getElementById('menuLogout').setAttribute('data-visible', status.enabled === true);
+				if (status.cookieDays !== undefined) {
+					const unlimited = (status.cookieDays === 0);
+					document.getElementById('cookieUnlimited').checked = unlimited;
+					if (!unlimited) document.getElementById('cookieDays').value = status.cookieDays;
+					applyCookieUnlimitedState();
+				}
 			} catch (e) {
 				console.log("failed to fetch security status", e);
 			}
 		}
 
+		// the "unlimited" switch disables the day input (a blank/ignored value while unlimited)
+		function applyCookieUnlimitedState() {
+			document.getElementById('cookieDays').disabled = document.getElementById('cookieUnlimited').checked;
+		}
+		document.getElementById('cookieUnlimited').addEventListener('change', applyCookieUnlimitedState);
+
+		// save just the cookie lifetime (0 = unlimited); never touches the password
+		async function saveCookieTimeout() {
+			const unlimited = document.getElementById('cookieUnlimited').checked;
+			const days = unlimited ? 0 : parseInt(document.getElementById('cookieDays').value, 10) || 90;
+			const response = await fetch("http://" + host + "/security", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ cookieDays: days })
+			});
+			if (response.ok) {
+				flashActionOk();
+				refreshSecurityStatus();
+			} else {
+				toaster.error(response.statusText);
+			}
+		}
+
 		async function securityConfig() {
 			const response = await fetch("http://" + host + "/security", {
 				method: "POST",
 
@@ -24,6 +24,7 @@ String Ftp_Password = "esp32"; // FTP-password (default; can be changed later vi
 FTPServer *ftpSrv; // Heap-alloction takes place later (when needed)
 bool ftpEnableLastStatus = false;
 bool ftpEnableCurrentStatus = false;
+static bool ftpAutostart = false; // start automatically on boot (persisted setting "ftpEnable")
 #endif
 
 void ftpManager(void);
@@ -49,6 +50,10 @@ void Ftp_Init(void) {
 		Ftp_Password = nvsFtpPassword;
 		Log_Printf(LOGLEVEL_INFO, restoredFtpPwdFromNvs, nvsFtpPassword.c_str());
 	}
+
+#ifdef FTP_ENABLE
+	ftpAutostart = gPrefsSettings.getBool("ftpEnable", false);
+#endif
 }
 
 // Re-reads the FTP credentials from NVS into the in-memory globals the running
@@ -83,6 +88,14 @@ void Ftp_Exit(void) {
 
 void Ftp_Cyclic(void) {
 #ifdef FTP_ENABLE
+	// One-shot auto-start: when the persisted setting asks for it, fire the server up the first time
+	// WiFi is available after boot, then never touch it again (so a manual stop isn't overridden).
+	static bool autostartHandled = false;
+	if (ftpAutostart && !autostartHandled && Wlan_IsConnected()) {
+		autostartHandled = true;
+		Ftp_EnableServer();
+	}
+
 	ftpManager();
 
 	if (WL_CONNECTED == WiFi.status()) {