diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index 8b570151..2115bdfc 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -881,7 +881,10 @@ class HttpCli(object):
                     return self.tx_404(True)
             else:
                 if self.vpath:
-                    self.log(t.format(self.uname, self.vpath))
+                    ptn = self.args.nonsus_urls
+                    if not ptn or not ptn.search(self.vpath):
+                        self.log(t.format(self.uname, self.vpath))
+
                     return self.tx_404(True)
 
                 self.uparam["h"] = ""
@@ -3822,7 +3825,9 @@ class HttpCli(object):
             pass
 
         # show dotfiles if permitted and requested
-        if not self.args.ed or "dots" not in self.uparam:
+        if not self.args.ed or (
+            "dots" not in self.uparam and (is_ls or "dots" not in self.cookies)
+        ):
             ls_names = exclude_dotfiles(ls_names)
 
         add_fk = vn.flags.get("fk")
diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index 7b2ef62e..26778b9e 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -5273,6 +5273,9 @@ var treectl = (function () {
 	bcfg_bind(r, 'csel', 'csel', false);
 	bcfg_bind(r, 'dots', 'dotfiles', false, function (v) {
 		r.goto(get_evpath());
+		var xhr = new XHR();
+		xhr.open('GET', SR + '/?setck=dots=' + (v ? 'y' : ''), true);
+		xhr.send();
 	});
 	bcfg_bind(r, 'dir1st', 'dir1st', true, function (v) {
 		treectl.gentab(get_evpath(), treectl.lsc);