diff --git a/public_html/admin/index.php b/public_html/admin/index.php
index bd538d3..1c77120 100644
--- a/public_html/admin/index.php
+++ b/public_html/admin/index.php
@@ -943,7 +943,7 @@ select.filter-sel:focus{border-color:var(--cyan)}
 
 <div id="toast"></div>
 
-<script>
+<script data-cfasync="false">
 // ── UTILS ─────────────────────────────────────────────────────────────────────
 let _alertFilter = 'active';
 let _modalCb = null;
@@ -993,15 +993,22 @@ function statusBadge(s) {
 
 // ── AUTH ──────────────────────────────────────────────────────────────────────
 async function doLogin() {
+  const btn=document.querySelector('#loginBox .btn');
+  const err=document.getElementById('loginErr');
   const u=document.getElementById('lu').value.trim(), p=document.getElementById('lp').value;
-  const fd=new FormData(); fd.append('action','login'); fd.append('username',u); fd.append('password',p);
-  const r = await fetch(location.href,{method:'POST',body:fd});
-  const d = await r.json();
-  if (d.error) { document.getElementById('loginErr').textContent=d.error; return; }
-  document.getElementById('loginWrap').style.display='none';
-  document.getElementById('app').style.display='flex';
-  document.getElementById('adminUser').textContent = (d.name||u).toUpperCase();
-  initApp();
+  if (!u||!p){err.textContent='Enter username and password';return;}
+  btn.disabled=true; btn.textContent='AUTHENTICATING...'; err.textContent='';
+  try {
+    const fd=new FormData(); fd.append('action','login'); fd.append('username',u); fd.append('password',p);
+    const r = await fetch(location.href,{method:'POST',body:fd});
+    const d = await r.json();
+    if (d.error) { err.textContent=d.error; return; }
+    document.getElementById('loginWrap').style.display='none';
+    document.getElementById('app').style.display='flex';
+    document.getElementById('adminUser').textContent = (d.name||u).toUpperCase();
+    initApp();
+  } catch(e) { err.textContent='Connection error — try again'; }
+  finally { btn.disabled=false; btn.textContent='AUTHENTICATE'; }
 }
 
 async function doLogout() {