diff --git a/db_queries.php b/db_queries.php
index e8962604..b248968a 100644
--- a/db_queries.php
+++ b/db_queries.php
@@ -45,11 +45,12 @@
         <div class="col-md-3">
             <div><input type="checkbox" id="type_forwarded" checked><label for="type_forwarded">Permitted: forwarded</label><br></div>
             <div><input type="checkbox" id="type_cached" checked><label for="type_cached">Permitted: cached</label></div>
-            <div><input type="checkbox" id="type_retried" checked><label for="type_retried">Permitted: Retried</label></div>
+            <div><input type="checkbox" id="type_retried" checked><label for="type_retried">Permitted: retried</label></div>
         </div>
         <div class="col-md-3">
             <div><input type="checkbox" id="type_gravity" checked><label for="type_gravity">Blocked: gravity</label><br></div>
             <div><input type="checkbox" id="type_external" checked><label for="type_external">Blocked: external</label></div>
+            <div><input type="checkbox" id="type_dbbusy" checked><label for="type_dbbusy">Blocked: database busy</label></div>
         </div>
         <div class="col-md-3">
             <div><input type="checkbox" id="type_blacklist" checked><label for="type_blacklist">Blocked: exact blacklist</label><br></div>
diff --git a/dns_records.php b/dns_records.php
index e20c2058..36311ef2 100644
--- a/dns_records.php
+++ b/dns_records.php
@@ -39,6 +39,15 @@
                 </div>
             </div>
             <div class="box-footer clearfix">
+              <strong>Note:</strong>
+              <p>The order of locally defined DNS records is: </p>
+              <ol>
+                  <li>The device's host name and <code>pi.hole</code></li>
+                  <li>Configured in a config file in <code>/etc/dnsmasq.d/</code></li>
+                  <li>Read from <code>/etc/hosts</code></li>
+                  <li>Read from the "Local (custom) DNS" list (stored in <code>/etc/pihole/custom.list</code>)</li>
+              </ol>
+              <p>Only the first record will trigger an address-to-name association.</p>
                 <button type="button" id="btnAdd" class="btn btn-primary pull-right">Add</button>
             </div>
         </div>
diff --git a/scripts/pi-hole/js/db_queries.js b/scripts/pi-hole/js/db_queries.js
index 6cc2de32..3e20638c 100644
--- a/scripts/pi-hole/js/db_queries.js
+++ b/scripts/pi-hole/js/db_queries.js
@@ -137,6 +137,12 @@ function getQueryTypes() {
     queryType.push([12, 13]);
   }
 
+  // 14 is defined above
+
+  if ($("#type_dbbusy").prop("checked")) {
+    queryType.push(15);
+  }
+
   return queryType.join(",");
 }
 
@@ -172,7 +178,7 @@ function refreshTableData() {
   var APIstring = "api_db.php?getAllQueries&from=" + from + "&until=" + until;
   // Check if query type filtering is enabled
   var queryType = getQueryTypes();
-  if (queryType !== "1,2,3,4,5,6") {
+  if (queryType !== "1,2,3,4,5,6,7,8,9,10,11,12,13,14,15") {
     APIstring += "&types=" + queryType;
   }
 
@@ -194,7 +200,9 @@ $(function () {
 
   tableApi = $("#all-queries").DataTable({
     rowCallback: function (row, data) {
-      var fieldtext, buttontext, color;
+      var fieldtext,
+        buttontext = "",
+        color;
       switch (data[4]) {
         case 1:
           color = "red";
@@ -232,17 +240,14 @@ $(function () {
         case 6:
           color = "red";
           fieldtext = "Blocked <br class='hidden-lg'>(external, IP)";
-          buttontext = "";
           break;
         case 7:
           color = "red";
           fieldtext = "Blocked <br class='hidden-lg'>(external, NULL)";
-          buttontext = "";
           break;
         case 8:
           color = "red";
           fieldtext = "Blocked <br class='hidden-lg'>(external, NXRA)";
-          buttontext = "";
           break;
         case 9:
           color = "red";
@@ -265,7 +270,6 @@ $(function () {
         case 12:
           color = "green";
           fieldtext = "Retried";
-          buttontext = "";
           break;
         case 13:
           color = "green";
@@ -278,10 +282,13 @@ $(function () {
           buttontext =
             '<button type="button" class="btn btn-default btn-sm text-red"><i class="fa fa-ban"></i> Blacklist</button>';
           break;
+        case 15:
+          color = "text-orange";
+          fieldtext = "Blocked <br class='hidden-lg'>(database is busy)";
+          break;
         default:
           color = "black";
           fieldtext = "Unknown";
-          buttontext = "";
       }
 
       $(row).css("color", color);
diff --git a/scripts/pi-hole/js/messages.js b/scripts/pi-hole/js/messages.js
index e9728508..2f1aca3d 100644
--- a/scripts/pi-hole/js/messages.js
+++ b/scripts/pi-hole/js/messages.js
@@ -77,6 +77,17 @@ function renderMessage(data, type, row) {
     case "DNSMASQ_CONFIG":
       return "FTL failed to start due to " + row.message;
 
+    case "RATE_LIMIT":
+      return (
+        "Client " +
+        row.message +
+        " has been rate-limited (current config allows up to " +
+        parseInt(row.blob1, 10) +
+        " queries in " +
+        parseInt(row.blob2, 10) +
+        " seconds)"
+      );
+
     default:
       return "Unknown message type<pre>" + JSON.stringify(row) + "</pre>";
   }
diff --git a/scripts/pi-hole/js/queries.js b/scripts/pi-hole/js/queries.js
index 565cffd8..d52f95b1 100644
--- a/scripts/pi-hole/js/queries.js
+++ b/scripts/pi-hole/js/queries.js
@@ -23,6 +23,8 @@ var replyTypes = [
   "NOTIMP",
   "upstream error",
   "DNSSEC",
+  "NONE",
+  "BLOB",
 ];
 var colTypes = ["time", "query type", "domain", "client", "status", "reply type"];
 
@@ -108,21 +110,21 @@ $(function () {
 
       // Query status
       var fieldtext,
-        buttontext,
-        colorClass = false,
+        buttontext = "",
         isCNAME = false,
         regexLink = false;
 
       switch (data[4]) {
         case "1":
-          colorClass = "text-red";
-          fieldtext = "Blocked (gravity)";
+          fieldtext = "<span class='text-red'>Blocked (gravity)</span>";
           buttontext =
             '<button type="button" class="btn btn-default btn-sm text-green"><i class="fas fa-check"></i> Whitelist</button>';
           break;
         case "2":
-          colorClass = "text-green";
-          fieldtext = replyid === 0 ? "OK, sent to " : "OK, answered by ";
+          fieldtext =
+            replyid === 0
+              ? "<span class='text-green'>OK</span>, sent to "
+              : "<span class='text-green'>OK</span>, answered by ";
           fieldtext +=
             "<br class='hidden-lg'>" +
             (data.length > 10 && data[10] !== "N/A" ? data[10] : "") +
@@ -131,14 +133,13 @@ $(function () {
             '<button type="button" class="btn btn-default btn-sm text-red"><i class="fa fa-ban"></i> Blacklist</button>';
           break;
         case "3":
-          colorClass = "text-green";
-          fieldtext = "OK <br class='hidden-lg'>(cached)" + dnssecStatus;
+          fieldtext =
+            "<span class='text-green'>OK</span> <br class='hidden-lg'>(cache)" + dnssecStatus;
           buttontext =
             '<button type="button" class="btn btn-default btn-sm text-red"><i class="fa fa-ban"></i> Blacklist</button>';
           break;
         case "4":
-          colorClass = "text-red";
-          fieldtext = "Blocked <br class='hidden-lg'>(regex blacklist)";
+          fieldtext = "<span class='text-red'>Blocked <br class='hidden-lg'>(regex blacklist)";
 
           if (data.length > 9 && data[9] > 0) {
             regexLink = true;
@@ -148,36 +149,33 @@ $(function () {
             '<button type="button" class="btn btn-default btn-sm text-green"><i class="fas fa-check"></i> Whitelist</button>';
           break;
         case "5":
-          colorClass = "text-red";
-          fieldtext = "Blocked <br class='hidden-lg'>(exact blacklist)";
+          fieldtext = "<span class='text-red'>Blocked <br class='hidden-lg'>(exact blacklist)";
           buttontext =
             '<button type="button" class="btn btn-default btn-sm text-green"><i class="fas fa-check"></i> Whitelist</button>';
           break;
         case "6":
-          colorClass = "text-red";
-          fieldtext = "Blocked <br class='hidden-lg'>(external, IP)";
+          fieldtext = "<span class='text-red'>Blocked <br class='hidden-lg'>(external, IP)";
           buttontext = "";
           break;
         case "7":
-          colorClass = "text-red";
-          fieldtext = "Blocked <br class='hidden-lg'>(external, NULL)";
+          fieldtext =
+            "<span class='text-red'>Blocked <br class='hidden-lg'>(external, NULL)</span>";
           buttontext = "";
           break;
         case "8":
-          colorClass = "text-red";
-          fieldtext = "Blocked <br class='hidden-lg'>(external, NXRA)";
+          fieldtext =
+            "<span class='text-red'>Blocked <br class='hidden-lg'>(external, NXRA)</span>";
           buttontext = "";
           break;
         case "9":
-          colorClass = "text-red";
-          fieldtext = "Blocked (gravity, CNAME)";
+          fieldtext = "<span class='text-red'>Blocked (gravity, CNAME)</span>";
           buttontext =
             '<button type="button" class="btn btn-default btn-sm text-green"><i class="fas fa-check"></i> Whitelist</button>';
           isCNAME = true;
           break;
         case "10":
-          colorClass = "text-red";
-          fieldtext = "Blocked <br class='hidden-lg'>(regex blacklist, CNAME)";
+          fieldtext =
+            "<span class='text-red'>Blocked <br class='hidden-lg'>(regex blacklist, CNAME)</span>";
 
           if (data.length > 9 && data[9] > 0) {
             regexLink = true;
@@ -188,32 +186,31 @@ $(function () {
           isCNAME = true;
           break;
         case "11":
-          colorClass = "text-red";
-          fieldtext = "Blocked <br class='hidden-lg'>(exact blacklist, CNAME)";
+          fieldtext =
+            "<span class='text-red'>Blocked <br class='hidden-lg'>(exact blacklist, CNAME)</span>";
           buttontext =
             '<button type="button" class="btn btn-default btn-sm text-green"><i class="fas fa-check"></i> Whitelist</button>';
           isCNAME = true;
           break;
         case "12":
-          colorClass = "text-green";
-          fieldtext = "Retried";
-          buttontext = "";
+          fieldtext = "<span class='text-green'>Retried</span>";
           break;
         case "13":
-          colorClass = "text-green";
-          fieldtext = "Retried <br class='hidden-lg'>(ignored)";
-          buttontext = "";
+          fieldtext = "<span class='text-green'>Retried</span> <br class='hidden-lg'>(ignored)";
           break;
         case "14":
-          colorClass = "text-green";
-          fieldtext = "OK <br class='hidden-lg'>(already forwarded)" + dnssecStatus;
+          fieldtext =
+            "<span class='text-green'>OK</span> <br class='hidden-lg'>(already forwarded)" +
+            dnssecStatus;
           buttontext =
             '<button type="button" class="btn btn-default btn-sm text-red"><i class="fa fa-ban"></i> Blacklist</button>';
           break;
+        case "15":
+          fieldtext =
+            "<span class='text-red'>Blocked <br class='hidden-lg'>(database is busy)</span>";
+          break;
         default:
-          colorClass = false;
           fieldtext = "Unknown (" + parseInt(data[4], 10) + ")";
-          buttontext = "";
       }
 
       // Add EDE here if available and not included in dnssecStatus
@@ -224,10 +221,6 @@ $(function () {
 
       fieldtext += '<input type="hidden" name="id" value="' + parseInt(data[4], 10) + '">';
 
-      if (colorClass !== false) {
-        $(row).addClass(colorClass);
-      }
-
       $("td:eq(4)", row).html(fieldtext);
       $("td:eq(6)", row).html(buttontext);
 
@@ -273,7 +266,8 @@ $(function () {
 
       $("td:eq(5)", row).html(replytext);
 
-      if (data.length > 7) {
+      // Show response time only when reply is not N/A
+      if (data.length > 7 && replyid !== 0) {
         var content = $("td:eq(5)", row).html();
         $("td:eq(5)", row).html(content + " (" + (0.1 * data[7]).toFixed(1) + "ms)");
       }
diff --git a/scripts/pi-hole/php/func.php b/scripts/pi-hole/php/func.php
index 12e41061..4d79872b 100644
--- a/scripts/pi-hole/php/func.php
+++ b/scripts/pi-hole/php/func.php
@@ -472,6 +472,7 @@ function returnSuccess($message = "", $json = true)
 
 function returnError($message = "", $json = true)
 {
+    $message = htmlentities($message) ;
     if ($json) {
         return [ "success" => false, "message" => $message ];
     } else {
diff --git a/scripts/pi-hole/php/password.php b/scripts/pi-hole/php/password.php
index 01e7efd6..91888a0b 100644
--- a/scripts/pi-hole/php/password.php
+++ b/scripts/pi-hole/php/password.php
@@ -50,7 +50,8 @@
             {
                 $auth = true;
                 // Refresh cookie with new expiry
-                setcookie('persistentlogin', $pwhash, time()+60*60*24*7);
+                // setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly )
+                setcookie('persistentlogin', $pwhash, time()+60*60*24*7, null, null, null, true );
             }
             else
             {
@@ -79,7 +80,8 @@
                     // Set persistent cookie if selected
                     if (isset($_POST['persistentlogin']))
                     {
-                        setcookie('persistentlogin', $pwhash, time()+60*60*24*7);
+                        // setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly )
+                        setcookie('persistentlogin', $pwhash, time()+60*60*24*7, null, null, null, true );
                     }
                     header('Location: index.php');
                     exit();
diff --git a/settings.php b/settings.php
index eace1c24..cc8f9c4f 100644
--- a/settings.php
+++ b/settings.php
@@ -41,7 +41,7 @@ if (isset($_POST["submit"])) {
         <button type="button" class="close" data-hide="alert" aria-label="Close"><span aria-hidden="true">&times;</span>
         </button>
         <h4><i class="icon fa fa-exclamation-triangle"></i> Debug</h4>
-        <pre><?php print_r($_POST); ?></pre>
+        <pre><?php print_r(htmlentities($_POST)); ?></pre>
     </div>
 <?php } ?>
 
@@ -886,7 +886,9 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array("sysadmin", "dns", "piho
                                                     <p>When there is a Pi-hole domain set and this box is
                                                     ticked, this asks FTL that this domain is purely
                                                     local and FTL may answer queries from <code>/etc/hosts</code> or DHCP leases
-                                                    but should never forward queries on that domain to any upstream servers.</p>
+                                                    but should never forward queries on that domain to any upstream servers.
+                                                    If Conditional Fowarding is enabled, unticking this box may cause a partial
+                                                    DNS loop under certain circumstances (e.g. if a client would send TLD DNSSEC queries).</p>
                                                 </div>
                                                 <div>
                                                     <input type="checkbox" name="DNSbogusPriv" id="DNSbogusPriv" title="bogus-priv" <?php if ($DNSbogusPriv){ ?>checked<?php } ?>>
@@ -935,6 +937,8 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array("sysadmin", "dns", "piho
                                                    devices ending in your local domain name will not leave your network, however, this is optional.
                                                    The local domain name must match the domain name specified
                                                    in your DHCP server for this to work. You can likely find it within the DHCP settings.</p>
+                                                <p>Enabling Conditional Fowarding will also forward all hostnames (i.e., non-FQDNs) to the router
+                                                   when "Never forward non-FQDNs" is <em>not</em> enabled.</p>
                                                 <div class="form-group">
                                                     <div>
                                                         <input type="checkbox" name="rev_server" id="rev_server" value="rev_server" <?php if(isset($rev_server) && ($rev_server == true)){ ?>checked<?php } ?>>