diff --git a/src/assets/js/backend/create-form.js b/src/assets/js/backend/create-form.js
index b7f1bd8d..21c83771 100644
--- a/src/assets/js/backend/create-form.js
+++ b/src/assets/js/backend/create-form.js
@@ -1503,7 +1503,7 @@
                     var xhttp = new XMLHttpRequest();
                     xhttp.onreadystatechange = function () {
                         if (this.readyState == 4) {
-                            if (this.status == 200) {
+                            if (!SUPER.builder_request_rejected(this)) {
                                 // Success:
                                 var $elements = $(this.responseText).appendTo($target);
                                 SUPER.init_resize_element_labels();
@@ -1524,6 +1524,7 @@
                     xhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded; charset=UTF-8");
                     var params = {
                         action: 'super_get_element_builder_html',
+                        nonce: super_create_form_i18n.admin_nonce,
                         tag: obj.$el.data('shortcode'),
                         group: obj.$el.data('group'),
                         predefined: $predefined,
@@ -1567,6 +1568,14 @@
             }
         }
     };
+    // WordPress and security plugins can reject a request with an HTTP error, -1 or 0.
+    SUPER.builder_request_rejected = function (xhr) {
+        var body = (typeof xhr.responseText === 'string' ? xhr.responseText.trim() : '');
+        if (xhr.status == 200 && body !== '-1' && body !== '0') return false;
+        alert(super_create_form_i18n.request_rejected.replace('%s', xhr.status));
+        return true;
+    };
+
     SUPER.save_form = function ($this, $method, $button, $initial_i18n, callback, updatingRawFormCode) {
         var i,ii,
             form = document.querySelector('.super-preview-elements'),
@@ -1618,6 +1627,14 @@
         var xhttp = new XMLHttpRequest();
         xhttp.onreadystatechange = function () {
             if (this.readyState == 4) {
+                if (SUPER.builder_request_rejected(this)) {
+                    $('.super-create-form .super-actions .super-save').html('<i class="fas fa-save"></i>Save');
+                    if ($method == 1) $('.super-create-form .super-actions .super-preview:eq(3)').html('Preview').removeClass('super-active');
+                    if ($method == 3) $('.super-preview-elements, .super-form-settings').removeClass('super-loading');
+                    // Do not preview or switch language after an unsuccessful save.
+                    if ($method != 1 && $method != 3 && typeof callback === "function") callback();
+                    return false;
+                }
                 // Success:
                 if (this.status == 200) {
                     SUPER.alertWhenSaving = false;
@@ -1731,6 +1748,12 @@
             var xhttp = new XMLHttpRequest();
             xhttp.onreadystatechange = function () {
                 if (this.readyState == 4) {
+                    if (SUPER.builder_request_rejected(this)) {
+                        $('.super-live-preview').removeClass('super-loading').css('display', 'none');
+                        $('.super-tabs-content').css('display', '');
+                        $this.html('Preview').removeClass('super-active');
+                        return false;
+                    }
                     // Success:
                     if (this.status == 200) {
                         $('.super-live-preview').removeClass('super-loading');
@@ -1756,6 +1779,7 @@
             xhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded; charset=UTF-8");
             var params = {
                 action: 'super_load_preview',
+                nonce: super_create_form_i18n.admin_nonce,
                 form_id: formId
             };
             params = $.param(params);
@@ -2479,20 +2503,23 @@
                         url: ajaxurl,
                         data: {
                             action: 'super_switch_language',
+                            nonce: super_create_form_i18n.admin_nonce,
                             form_id: $('.super-create-form input[name="form_id"]').val(),
                             i18n: $i18n
                         },
-                        success: function (data) {
+                        success: function (data, status, xhr) {
+                            if (SUPER.builder_request_rejected(xhr)) return;
                             data = JSON.parse(data);
                             $('.super-preview-elements').html(data.elements);
                             SUPER.regenerate_element_inner();
                             $('.super-form-settings .super-elements-container').html(data.settings);
                             $('.super-preview-elements, .super-form-settings').removeClass('super-loading');
                         },
-                        error: function () {
-                            alert(super_create_form_i18n.export_form_error);
+                        error: function (xhr) {
+                            SUPER.builder_request_rejected(xhr);
                         },
                         complete: function () {
+                            $('.super-preview-elements, .super-form-settings').removeClass('super-loading');
                             SUPER.init_slider_field();
                             SUPER.init_tooltips();
                             SUPER.init_docs();
@@ -2706,13 +2733,18 @@
                     url: ajaxurl,
                     data: {
                         action: 'super_undo_redo',
+                        nonce: super_create_form_i18n.admin_nonce,
                         form_id: $('.super-create-form input[name="form_id"]').val(),
                         elements: JSON.stringify($history[$index])
                     },
-                    success: function (result) {
+                    success: function (result, status, xhr) {
+                        if (SUPER.builder_request_rejected(xhr)) return;
                         $('.super-preview .super-preview-elements').html(result);
                         SUPER.init_resize_element_labels();
                     },
+                    error: function (xhr) {
+                        SUPER.builder_request_rejected(xhr);
+                    },
                     complete: function () {
                         $this.removeClass('super-loading');
                     }
@@ -3221,6 +3253,10 @@
             var xhttp = new XMLHttpRequest();
             xhttp.onreadystatechange = function () {
                 if (this.readyState == 4) {
+                    if (SUPER.builder_request_rejected(this)) {
+                        $button.removeClass('super-loading');
+                        return false;
+                    }
                     // Success:
                     if (this.status == 200) {
                         var response = this.responseText;
@@ -3327,6 +3363,7 @@
             }
             var params = {
                 action: 'super_get_element_builder_html',
+                nonce: super_create_form_i18n.admin_nonce,
                 tag: $tag,
                 group: $group,
                 builder: ($tag == 'tabs' ? $builder : 0),
@@ -3482,6 +3519,10 @@
             var xhttp = new XMLHttpRequest();
             xhttp.onreadystatechange = function () {
                 if (this.readyState == 4) {
+                    if (SUPER.builder_request_rejected(this)) {
+                        $target.removeClass('super-loading');
+                        return false;
+                    }
                     // Success:
                     if (this.status == 200) {
                         $target.html(this.responseText);
@@ -3521,6 +3562,7 @@
             }
             var params = {
                 action: 'super_load_element_settings',
+                nonce: super_create_form_i18n.admin_nonce,
                 form_id: $('.super-create-form input[name="form_id"]').val(),
                 tag: $tag,
                 group: $group,
diff --git a/src/assets/js/common.js b/src/assets/js/common.js
index 8462cce9..37fdc18a 100644
--- a/src/assets/js/common.js
+++ b/src/assets/js/common.js
@@ -798,33 +798,37 @@ function SUPERreCaptcha(){
             }
         }
         if(args.generatePdf){
-            SUPER.pdf_generator_init(args, function(args){
-                // When debugging is enabled download file instantly without submitting the form
-                if(args.pdfSettings.debug!=="true"){
-                    SUPER.save_data(args); 
-                    return true;
-                }
-                var innerText = args.loadingOverlay.querySelector('.super-inner-text');
-                // Direct download of PDF
-                args._pdf.save(args.pdfSettings.filename, {returnPromise: true}).then(function() {
-                    // Close loading overlay
-                    if(args.progressBar) args.progressBar.style.width = (100)+"%";  
-                    if(innerText) innerText.innerHTML = '<span>'+super_common_i18n.loadingOverlay.completed+'</span>';
-                    args.loadingOverlay.classList.add('super-success');
-                    if(args.pdfSettings.downloadBtn==='true'){
-                        args.loadingOverlay.classList.add('super-success');
-                        SUPER.show_pdf_download_btn(args);
-                    }
-                    // Close Popup (if any)
-                    if(typeof SUPER.init_popups === 'function' && typeof SUPER.init_popups.close === 'function' ){
-                        SUPER.init_popups.close(true);
+            try {
+                SUPER.pdf_generator_init(args, function(args){
+                    // When debugging is enabled download file instantly without submitting the form
+                    if(args.pdfSettings.debug!=="true"){
+                        SUPER.save_data(args);
+                        return true;
                     }
-                }, function() {
-                    // Show error message
-                    if(innerText) innerText.innerHTML = '<span>Something went wrong while downloading the PDF</span>';
-                    args.loadingOverlay.classList.add('super-error');
+                    var innerText = args.loadingOverlay.querySelector('.super-inner-text');
+                    // Direct download of PDF
+                    args._pdf.save(args.pdfSettings.filename, {returnPromise: true}).then(function() {
+                        // Close loading overlay
+                        if(args.progressBar) args.progressBar.style.width = (100)+"%";
+                        if(innerText) innerText.innerHTML = '<span>'+super_common_i18n.loadingOverlay.completed+'</span>';
+                        args.loadingOverlay.classList.add('super-success');
+                        if(args.pdfSettings.downloadBtn==='true'){
+                            args.loadingOverlay.classList.add('super-success');
+                            SUPER.show_pdf_download_btn(args);
+                        }
+                        // Close Popup (if any)
+                        if(typeof SUPER.init_popups === 'function' && typeof SUPER.init_popups.close === 'function' ){
+                            SUPER.init_popups.close(true);
+                        }
+                    }, function() {
+                        // Show error message
+                        if(innerText) innerText.innerHTML = '<span>Something went wrong while downloading the PDF</span>';
+                        args.loadingOverlay.classList.add('super-error');
+                    });
                 });
-            });
+            } catch(error) {
+                SUPER.pdf_generator_abort(args, error);
+            }
         }else{
             SUPER.save_data(args);
         }
@@ -8815,6 +8819,8 @@ function SUPERreCaptcha(){
     SUPER.pdf_generator_init = function(args, callback){
         
         args._save_data_callback = callback;
+        args._pdfAborted = false;
+        args._pdfDone = false;
 
         // Page margins and print area
         // Media                Page size           Print area              Margins
@@ -8942,7 +8948,11 @@ function SUPERreCaptcha(){
         if(super_common_i18n.fonts && super_common_i18n.fonts.link){
             // Replace 'your_url_here' with the actual URL to the JSON file.
             const fontURL = super_common_i18n.fonts.link+'.json';
-            SUPER.pdf_get_font_data_from_url(fontURL).then((fontData) => {
+            const loadFontData = () => Promise.resolve().then(() => SUPER.pdf_get_font_data_from_url(fontURL)).catch(() => null);
+            loadFontData().then((fontData) => {
+                return fontData ? fontData : loadFontData();
+            }).then((fontData) => {
+                if(args._pdfAborted) return false;
                 if(fontData){
                     args._pdf.addFileToVFS('NotoSans-Regular-normal.ttf', fontData.regular);
                     args._pdf.addFont('NotoSans-Regular-normal.ttf', 'NotoSans-Regular', 'normal');
@@ -8952,20 +8962,12 @@ function SUPERreCaptcha(){
                         args._pdf.addFileToVFS('NotoSans-Bold-bold.ttf',fontData.bold);
                     }
                     args._pdf.addFont('NotoSans-Bold-bold.ttf', 'NotoSans-Bold', 'bold');
-
-                    SUPER.pdf_generator_prepare(args, function(args){
-                        // First add pdf-text 
-                        SUPER.pdfWrapTextNodes(args.pdfPageContainer);
-                        SUPER.pdfWrapTextNodesRender(args.pdfPageContainer);
-                        // First scroll over all pages, and determine total pages we have
-                        SUPER.pdf_determine_pages(args, function(args){
-                            // Start generating pages (starting at page 1)
-                            args.currentPage = 1;
-                            SUPER.pdf_generator_generate_page(args);
-                        });
-                    });
-
+                }else{
+                    console.warn('Super Forms: the PDF font file could not be loaded, the default PDF font is used instead.');
                 }
+                SUPER.pdf_generator_start(args);
+            }).catch((error) => {
+                SUPER.pdf_generator_abort(args, error);
             });
             return false;
         }
@@ -8976,20 +8978,32 @@ function SUPERreCaptcha(){
         //
         // Add a timeout (just to be sure)
         setTimeout(function(){
-            SUPER.pdf_generator_prepare(args, function(args){
-                // First add pdf-text 
-                SUPER.pdfWrapTextNodes(args.pdfPageContainer);
-                SUPER.pdfWrapTextNodesRender(args.pdfPageContainer);
-                // First scroll over all pages, and determine total pages we have
-                SUPER.pdf_determine_pages(args, function(args){
-                    // Start generating pages (starting at page 1)
-                    args.currentPage = 1;
-                    SUPER.pdf_generator_generate_page(args);
-                });
-            });
+            SUPER.pdf_generator_start(args);
         }, 5000);
         return false;
     };
+    // Prepare the form, determine page boundaries, then generate the first page.
+    SUPER.pdf_generator_start = function(args){
+        if(args._pdfAborted) return false;
+        try {
+            SUPER.pdf_generator_prepare(args, function(args){
+                if(args._pdfAborted) return false;
+                try {
+                    SUPER.pdfWrapTextNodes(args.pdfPageContainer);
+                    SUPER.pdfWrapTextNodesRender(args.pdfPageContainer);
+                    SUPER.pdf_determine_pages(args, function(args){
+                        if(args._pdfAborted) return false;
+                        args.currentPage = 1;
+                        SUPER.pdf_generator_generate_page(args);
+                    });
+                } catch(error) {
+                    SUPER.pdf_generator_abort(args, error);
+                }
+            });
+        } catch(error) {
+            SUPER.pdf_generator_abort(args, error);
+        }
+    };
     SUPER.pdf_determine_pages = function(args, callback){
         args.pageOrientationChanges = {};
         var result = {
@@ -9570,6 +9584,8 @@ function SUPERreCaptcha(){
     }
 
     SUPER._pdf_generator_done_callback = function(args){
+        // Ignore aborted or duplicate completion callbacks.
+        if(args._pdfAborted || args._pdfDone) return false;
         // Reset everything to how it was
         SUPER.pdf_generator_reset(args.form0);
         // Attach as file to form data
@@ -9603,10 +9619,13 @@ function SUPERreCaptcha(){
             exclude: exclude
         };
         // We PDF has been generated, continue with form submission
+        // Errors after this point belong to submission, not PDF generation.
+        args._pdfDone = true;
         args._save_data_callback(args);
     };
 
     SUPER.recheckCanvasImages = function(args, callback){
+        if(args._pdfAborted) return false;
         var node = args.pdfPageContainer.querySelector('.super-int-phone_selected-flag .super-int-phone_flag:not(.super-canvas-initialized)');
         if(!node || node.closest('[data-pdfoption="exclude"]') || node.closest('[data-html2cvanas-ignore="true"]')){
             callback();
@@ -9620,9 +9639,12 @@ function SUPERreCaptcha(){
                 allowTaint: false,
                 backgroundColor: '#ffffff'
             }).then(function(canvas) {
+                if(args._pdfAborted) return false;
                 var imgData = canvas.toDataURL("image/jpeg", 1.0);
                 node.dataset.imgData = imgData;
                 SUPER.recheckCanvasImages(args, callback);
+            }).catch(function(error) {
+                SUPER.pdf_generator_abort(args, error);
             });
         }
     }
@@ -10058,7 +10080,8 @@ function SUPERreCaptcha(){
             }
         }
         SUPER.recheckCanvasImages(args, function(){
-            SUPER.init_super_responsive_form_fields({form: form, callback: function(formId){
+            var prepareFields = function(formId){
+                if(args._pdfAborted || !form.classList.contains('super-generating-pdf')) return false;
                 // First disable the UI on the map for nicer print of the map
                 // And make map fullwidth and directions fullwidth
                 for(i=0; i < SUPER.google_maps_api.allMaps[formId].length; i++){
@@ -10115,6 +10138,13 @@ function SUPERreCaptcha(){
                 // tmp args.totalPercentagePerPage = (100/args.totalPages) / 3;
                 // tmp args.pdfPercentageCompleted = 0;
                 callback(args);
+            };
+            SUPER.init_super_responsive_form_fields({form: form, callback: function(formId){
+                try {
+                    prepareFields(formId);
+                } catch(error) {
+                    SUPER.pdf_generator_abort(args, error);
+                }
             }});
         });
 
@@ -10137,8 +10167,8 @@ function SUPERreCaptcha(){
         setTimeout(function(){
             // Now allow printing
             try {
-                // Only if not already canceled/reset
-                if(form && !form.classList.contains('super-generating-pdf')){
+                // Only if not already canceled/reset or aborted
+                if(args._pdfAborted || (form && !form.classList.contains('super-generating-pdf'))){
                     return false;
                 }
                 // Re-wrap text nodes because of possible updated HTML content such as pagination {tags}
@@ -10318,12 +10348,11 @@ function SUPERreCaptcha(){
                     }
                 }
                 if(args.pdfSettings.native==='true'){
-                    // Experimental
-                    document.querySelector('.super-pdf-page-container').classList.remove('super-pdf-toggle-ignore-items');
-                    // Only if not already canceled/reset
-                    if(form && !form.classList.contains('super-generating-pdf')){
+                    // Only if not already canceled/reset or aborted
+                    if(args._pdfAborted || (form && !form.classList.contains('super-generating-pdf'))){
                         return false;
                     }
+                    document.querySelector('.super-pdf-page-container').classList.remove('super-pdf-toggle-ignore-items');
                     args.pdfPercentageCompleted += args.totalPercentagePerPage;
                     if(args.pdfPercentageCompleted > 99){
                         args.pdfPercentageCompleted = 100;
@@ -10360,11 +10389,11 @@ function SUPERreCaptcha(){
                         allowTaint: false,
                         backgroundColor: '#ffffff'
                     }).then(function(canvas) {
-                        document.querySelector('.super-pdf-page-container').classList.remove('super-pdf-toggle-ignore-items');
-                        // Only if not already canceled/reset
-                        if(form && !form.classList.contains('super-generating-pdf')){
+                        // Check before touching DOM that cancellation may have removed.
+                        if(args._pdfAborted || (form && !form.classList.contains('super-generating-pdf'))){
                             return false;
                         }
+                        document.querySelector('.super-pdf-page-container').classList.remove('super-pdf-toggle-ignore-items');
                         args.pdfPercentageCompleted += args.totalPercentagePerPage;
                         if(args.pdfPercentageCompleted > 99){
                             args.pdfPercentageCompleted = 100;
@@ -10411,11 +10440,13 @@ function SUPERreCaptcha(){
                             // No more pages to generate (submit form / send email)
                             SUPER._pdf_generator_done_callback(args);
                         }
+                    }).catch(function(error) {
+                        SUPER.pdf_generator_abort(args, error);
                     });
                 }
             }
             catch(error) {
-                console.log("Error: ", error);
+                SUPER.pdf_generator_abort(args, error);
             }
         }, timeout );
     }
@@ -11717,6 +11748,35 @@ function SUPERreCaptcha(){
         }
         SUPER.init_super_responsive_form_fields({form: form});
     };
+    // Restore the form after a PDF failure without submitting it.
+    SUPER.pdf_generator_abort = function(args, error){
+        if(args._pdfAborted) return false;
+        if(args._pdfDone){
+            console.error(error);
+            return false;
+        }
+        args._pdfAborted = true;
+        console.error('Super Forms: the PDF file could not be generated.', error);
+        var restored = false;
+        try {
+            restored = (SUPER.pdf_generator_reset(args.form0)!==false);
+        } catch(resetError) {
+            console.error(resetError);
+        }
+        if(!restored){
+            try {
+                SUPER.reset_submit_button_loading_state(args.form0);
+            } catch(buttonError) {
+                console.error(buttonError);
+            }
+        }
+        if(args.loadingOverlay){
+            var innerText = args.loadingOverlay.querySelector('.super-inner-text');
+            if(innerText) innerText.innerHTML = '<span>'+super_common_i18n.loadingOverlay.pdf_generation_error+'</span>';
+            args.loadingOverlay.classList.add('super-error');
+        }
+        return false;
+    };
     SUPER.save_data = function(args){
         if(args.progressBar) args.progressBar.style.width = 0+'%';
         args.loadingOverlay.querySelector('.super-inner-text').innerHTML = '<span>'+super_common_i18n.loadingOverlay.processing+'</span>';
diff --git a/src/assets/js/frontend/elements.js b/src/assets/js/frontend/elements.js
index c1b60db8..58d018bd 100644
--- a/src/assets/js/frontend/elements.js
+++ b/src/assets/js/frontend/elements.js
@@ -1475,6 +1475,13 @@
             SUPER.init_super_form_frontend();
         });
 
+        // Clear the last Tab key before pointer focus moves into the form.
+        var resetLastTabKey = function(){
+            SUPER.lastTabKey = undefined;
+        };
+        document.addEventListener('mousedown', resetLastTabKey, true);
+        document.addEventListener('touchstart', resetLastTabKey, {capture: true, passive: true});
+
         $doc.on('focusin', function(e){
             var i, nodes;
             if(!e.target.tagName || typeof e.target.closest !== 'function') return true;
@@ -1642,7 +1649,29 @@
                         return false;
                     }
                     if(!form.querySelector('.super-form-button.super-loading')){
-                        submitButton = form.querySelector('.super-form-button .super-button-wrap .super-button-name[data-action="submit"]');
+                        // On a nonfinal step Enter follows Next, including normal step validation.
+                        var multiparts = form.querySelectorAll('.super-multipart'),
+                            activeMultipart = form.querySelector('.super-multipart.super-active');
+                        if(activeMultipart && activeMultipart!==multiparts[multiparts.length-1]){
+                            nodes = activeMultipart.querySelectorAll('.super-next-multipart');
+                            for(i=0; i<nodes.length; i++){
+                                if(!SUPER.has_hidden_parent(nodes[i], false, false) && !nodes[i].closest('.super-readonly')){
+                                    nodes[i].click();
+                                    break;
+                                }
+                            }
+                            e.preventDefault();
+                            return false;
+                        }
+                        // Only submit through a visible button that is not read-only.
+                        submitButton = null;
+                        nodes = form.querySelectorAll('.super-form-button .super-button-wrap .super-button-name[data-action="submit"]');
+                        for(i=0; i<nodes.length; i++){
+                            if(!SUPER.has_hidden_parent(nodes[i], false, false) && !nodes[i].closest('.super-readonly')){
+                                submitButton = nodes[i];
+                                break;
+                            }
+                        }
                         if(submitButton) {
                             var args = {
                                 el: undefined,
diff --git a/src/docs/changelog.md b/src/docs/changelog.md
index 273ac2b9..33bb015b 100644
--- a/src/docs/changelog.md
+++ b/src/docs/changelog.md
@@ -9,6 +9,19 @@
 
 - [PDF Generator Add-on](https://renstillmann.github.io/super-forms/#/pdf-generator-add-on)
 
+## 2026-10-21 - Version 6.4.010-beta
+
+- **Fix:** Clicking the submit button after tabbing out of the form submits normally instead of jumping to the first field and losing the click. Keyboard Tab and Shift+Tab navigation is unchanged.
+- **Fix:** Pressing Enter uses the first submit button that is not hidden by conditional logic and is not read-only. If none is available, Enter does not submit.
+- **Fix:** On a non-final step of a multi-part form, Enter uses an eligible visible, non-read-only Next button with the usual validation instead of submitting the whole form. On the last step it uses an eligible submit button.
+- **Fix:** Required or validated fields inside an invisible column no longer block a legitimate submission. Their values are still submitted, and the server no longer requires them.
+- **Security fix:** Builder preview, language switching, undo/redo, element settings and element HTML requests require an administrator and a valid admin security token. Other logged-in users can no longer load form markup or settings through those requests.
+- **Fix:** Rejected builder save and preview requests restore their buttons and display a reload message instead of remaining stuck. A rejected save does not continue into preview or language switching.
+- **Fix:** PDF font configuration is attached after the Super Forms common script so script optimizers keep the localized font data in the correct order. Pages with repeated font languages preserve the final configured font.
+- **Fix:** PDF generation failures restore the form and display an error with a Close button. Nothing is submitted, and the visitor can retry. A missing PDF font falls back to the default font.
+- **Fix:** Avoided a premature translation-loading notice when registering the recurring schedule.
+- **Improved:** Compatibility with WordPress 7.1.3.
+
 ## 2026-10-09 - Version 6.4.009-beta
 
 - **Fix:** Date submissions use the default `dd-mm-yy` pattern when the saved format, or selected custom format, is missing or empty, while preserving explicit formats and strict date validation.
diff --git a/src/includes/class-ajax.php b/src/includes/class-ajax.php
index 6ec8e56e..a19a5ffe 100644
--- a/src/includes/class-ajax.php
+++ b/src/includes/class-ajax.php
@@ -6186,7 +6186,9 @@ public static function language_switcher() {
      *  @since      4.7.0
     */
     public static function switch_language() {
+        self::authorize_admin_ajax_request();
         $form_id = absint($_POST['form_id']);
+        self::require_admin_form( $form_id );
         // Retrieve all settings with the correct default values
         $settings = SUPER_Common::get_form_settings($form_id);
 
@@ -6415,6 +6417,7 @@ public static function print_custom_html() {
      *  @since      3.8.0
     */
     public static function undo_redo() {
+        self::authorize_admin_ajax_request();
         $form_id = absint($_POST['form_id']);
         $elements = $_POST['elements'];
         $elements = wp_unslash($elements);
@@ -7967,7 +7970,9 @@ public static function import_global_settings() {
      *  @since      1.0.0
     */
     public static function load_preview() {
-        $form_id = absint( $_POST['form_id'] );
+        self::authorize_admin_ajax_request();
+        $form_id = isset( $_POST['form_id'] ) ? absint( $_POST['form_id'] ) : 0;
+        self::require_admin_form( $form_id );
         echo SUPER_Shortcodes::super_form_func( array( 'id'=>$form_id ) );
         die();
     }
@@ -8331,6 +8336,10 @@ public static function loop_over_element_setting_fields($fields, $data, $shortco
      *  @since      1.0.0
     */
     public static function load_element_settings( $tag=null, $group=null, $data=null ) {
+        // Internal PHP calls supply their own arguments and do not need an AJAX nonce.
+        if( doing_action( 'wp_ajax_super_load_element_settings' ) ) {
+            self::authorize_admin_ajax_request();
+        }
         if($tag==null) $tag = $_POST['tag'];
         if($group==null) $group = $_POST['group'];
         if($data==null) $data = $_POST['data'];
@@ -8483,6 +8492,10 @@ public static function load_element_settings( $tag=null, $group=null, $data=null
      *  @since      1.0.0
     */
     public static function get_element_builder_html( $tag=null, $group=null, $inner=null, $data=null, $method=1 ) {
+        // Internal PHP calls supply their own arguments and do not need an AJAX nonce.
+        if( doing_action( 'wp_ajax_super_get_element_builder_html' ) ) {
+            self::authorize_admin_ajax_request();
+        }
         $i18n = (isset($_POST['i18n']) ? $_POST['i18n'] : '');
         $form_id = 0;
         if( isset( $_POST['form_id'] ) ) {
@@ -8677,6 +8690,8 @@ private static function collect_required_fields( $elements, $ctx = null ) {
         foreach( $elements as $element ) {
             $edata = ( isset( $element['data'] ) && is_array( $element['data'] ) ) ? $element['data'] : array();
             $tag = isset( $element['tag'] ) ? $element['tag'] : '';
+            // Invisible columns retain submitted values but are never validated in the browser.
+            if( $tag === 'column' && isset( $edata['invisible'] ) && $edata['invisible'] === 'true' ) continue;
             // An element (or ancestor) that can hide/repeat its subtree "locks" the fields below
             // it: the front-end may legitimately omit them, so they can never be presence-enforced.
             // Conditional logic is not evaluable server-side; repeaters/multipart vary per
diff --git a/src/includes/class-shortcodes.php b/src/includes/class-shortcodes.php
index e5677eaf..b210cdfd 100644
--- a/src/includes/class-shortcodes.php
+++ b/src/includes/class-shortcodes.php
@@ -6886,13 +6886,19 @@ public static function super_form_func( $atts, $elements_only=false ) {
                             file_put_contents($font_file, $font_data);
                         }
                         // ponytail: without the fonts the browser falls back to the default PDF font path.
-                        if( $fonts_ready ) add_action('wp_footer', function($arguments) use ($language) {
+                        if( $fonts_ready ) {
+                            static $last_font_link = null;
                             $link = SUPER_PLUGIN_FILE . 'includes/extensions/pdf-generator/fonts/'.$language;
+                            if( $last_font_link!==$link ) {
+                                $last_font_link = $link;
+                                add_action('wp_footer', function() use ($link) {
 ?><style>.super-form:after {font-family: 'SF-Unicode'!important; content:'.'!important; visibility:hidden!important; position:absolute!important; bottom:0px!important; left:0px!important; z-index:-999999!important;}
-@font-face {font-family:'SF-Unicode';src:url('<?php echo $link; ?>.woff') format('woff');}
-@font-face {font-family:'SF-Unicode';src:url('<?php echo $link; ?>.woff2') format('woff2');}</style>
-<script>super_common_i18n.fonts = {link: '<?php echo $link; ?>'};</script><?php
-                        }, 100, 1);
+@font-face {font-family:'SF-Unicode';src:url('<?php echo esc_url($link); ?>.woff') format('woff');}
+@font-face {font-family:'SF-Unicode';src:url('<?php echo esc_url($link); ?>.woff2') format('woff2');}</style><?php
+                                }, 100);
+                                self::add_pdf_font_script('super_common_i18n.fonts = ' . wp_json_encode(array('link'=>$link)) . ';');
+                            }
+                        }
                     }
                 }
             }
@@ -6901,6 +6907,19 @@ public static function super_form_func( $atts, $elements_only=false ) {
         return do_shortcode( $result );
     }
 
+    /**
+     * Run font setup after super-common and its localization, including when it was printed in the head.
+     */
+    private static function add_pdf_font_script( $js ) {
+        if( !wp_script_is('super-common', 'done') ) {
+            wp_add_inline_script('super-common', $js, 'after');
+            return;
+        }
+        add_action('wp_footer', function() use ($js) {
+            echo '<script>' . $js . '</script>';
+        }, 100);
+    }
+
 }
 
 endif;
diff --git a/src/super-forms.php b/src/super-forms.php
index 29743304..b3f50156 100644
--- a/src/super-forms.php
+++ b/src/super-forms.php
@@ -11,7 +11,7 @@
  * @wordpress-plugin
  * Plugin Name:       Super Forms - Drag & Drop Form Builder
  * Description:       The most advanced, flexible and easy to use form builder for WordPress!
- * Version:           6.4.009
+ * Version:           6.4.010
  * Plugin URI:        https://super-forms.com
  * Author URI:        https://github.com/RensTillmann
  * Author:            Rens Tillmann
@@ -20,7 +20,7 @@
  * License:           GPL v2 or later
  * License URI:       http://www.gnu.org/licenses/gpl-2.0.txt
  * Requires at least: 4.9
- * Tested up to:      7.0.1
+ * Tested up to:      7.1.3
  * Requires PHP:      7.4
  */
 
@@ -1047,7 +1047,7 @@ private static function legacy_entry_custom_file_allowed_root( $file, $form_id,
          *
          *  @since      1.0.0
         */
-        public $version = '6.4.009';
+        public $version = '6.4.010';
         public $slug = 'super-forms';
         public $apiUrl = 'https://api.super-forms.com/';
         public $apiVersion = 'v1';
@@ -1488,7 +1488,8 @@ public static function inject_entry_data($js, $x){
         public static function minute_schedule( $schedules ) {
             $schedules['every_minute'] = array(
                 'interval' => 60,
-                'display' => esc_html__( 'Every minute', 'super-forms' )
+                // Cron can request schedules before it is safe to load translations.
+                'display' => did_action( 'after_setup_theme' ) ? esc_html__( 'Every minute', 'super-forms' ) : 'Every minute'
             );
             return $schedules;
         }
@@ -3018,6 +3019,7 @@ public function init() {
                         'processing' => esc_html__( 'Processing form data...', 'super-forms' ),
                         'uploading_files' => esc_html__( 'Uploading files...', 'super-forms' ),
                         'generating_pdf' => esc_html__( 'Generating PDF file...', 'super-forms' ),
+                        'pdf_generation_error' => esc_html__( 'We couldn\'t create the PDF, so your form has not been sent yet. Please try again.', 'super-forms' ),
                         'completed' => esc_html__( 'Completed!', 'super-forms' ),
                         'close' => esc_html__( 'Close', 'super-forms' ),
                         'redirecting' => esc_html__( 'Redirecting...', 'super-forms' ),
@@ -3728,6 +3730,8 @@ public static function get_scripts() {
                             
                             'save_form_nonce' => wp_create_nonce( 'super_save_form' ),
                             'admin_nonce' => wp_create_nonce( 'super_admin_ajax' ),
+                            /* translators: %s: HTTP status code of the rejected request */
+                            'request_rejected' => esc_html__( 'The request was rejected (HTTP %s). Your session may have expired or a security plugin blocked it. Please reload the page and try again.', 'super-forms' ),
                             'home_url' => get_home_url(),
                             'not_editing_an_element' => sprintf( esc_html__( 'You are currently not editing an element.%sEdit any alement by clicking the %s icon.', 'super-forms' ), '<br />', '<i class="fa fa-pencil"></i>' ),
                             'no_backups_found' => esc_html__( 'No backups found...', 'super-forms' ),