diff --git a/assets/apps/components/src/Common/SingleSizingInput.js b/assets/apps/components/src/Common/SingleSizingInput.js
index f119fa1e64..2da051f193 100755
--- a/assets/apps/components/src/Common/SingleSizingInput.js
+++ b/assets/apps/components/src/Common/SingleSizingInput.js
@@ -1,4 +1,5 @@
 import PropTypes from 'prop-types';
+import { useState } from '@wordpress/element';
 
 const SingleSizingInput = ({
 	type,
@@ -10,6 +11,9 @@ const SingleSizingInput = ({
 	label,
 	disabled,
 }) => {
+	// Partial input like "-" reads as empty; rendering 0 would erase it.
+	const [isEmptyInput, setIsEmptyInput] = useState(false);
+
 	return (
 		<div className="nv-sizing-item">
 			<input
@@ -17,13 +21,15 @@ const SingleSizingInput = ({
 				disabled={disabled}
 				type="number"
 				className={type ? type + '-input' : ''}
-				value={value}
+				value={isEmptyInput ? '' : value}
 				min={min}
 				max={max}
 				step={step}
-				onChange={(e) =>
-					onChange(type, e.target.value === '' ? 0 : e.target.value)
-				}
+				onChange={(e) => {
+					setIsEmptyInput(e.target.value === '');
+					onChange(type, e.target.value === '' ? 0 : e.target.value);
+				}}
+				onBlur={() => setIsEmptyInput(false)}
 			/>
 			{label && (
 				<label className="label" htmlFor={type + '-input'}>
diff --git a/assets/apps/components/src/Controls/Sizing.js b/assets/apps/components/src/Controls/Sizing.js
index d4f93546af..9315af2ba3 100755
--- a/assets/apps/components/src/Controls/Sizing.js
+++ b/assets/apps/components/src/Controls/Sizing.js
@@ -6,6 +6,13 @@ import { __ } from '@wordpress/i18n';
 import { mapValues } from 'lodash';
 import { Button, Tooltip } from '@wordpress/components';
 
+/**
+ * @param {string|number|null|undefined} value Control value or default.
+ * @return {boolean} Whether the value is unset.
+ */
+const isEmptyValue = (value) =>
+	value === '' || value === null || value === undefined;
+
 const SizingControl = ({
 	noLinking,
 	options,
@@ -61,8 +68,11 @@ const SizingControl = ({
 
 	const hasSetValues = () => {
 		if (typeof defaults !== 'object') {
-			// eslint-disable-next-line eqeqeq
-			return parseFloat(defaults) != parseFloat(options[0].value);
+			const current = options[0].value;
+			if (isEmptyValue(defaults) || isEmptyValue(current)) {
+				return isEmptyValue(defaults) !== isEmptyValue(current);
+			}
+			return parseFloat(defaults) !== parseFloat(current);
 		}
 		return (
 			options.filter(
diff --git a/assets/apps/customizer-controls/src/builder/scss/_customizer-adjustments.scss b/assets/apps/customizer-controls/src/builder/scss/_customizer-adjustments.scss
index 6e2d3268c4..6fa834e7e5 100644
--- a/assets/apps/customizer-controls/src/builder/scss/_customizer-adjustments.scss
+++ b/assets/apps/customizer-controls/src/builder/scss/_customizer-adjustments.scss
@@ -12,7 +12,14 @@ ul[id^="sub-accordion-panel-hfg_"] {
   }
 
   #accordion-section-neve_header_presets,
-  #accordion-section-neve_footer_copyright_section {
+  #accordion-section-neve_footer_copyright_section,
+  #accordion-section-neve_global_footer_settings {
 	  margin-top: 20px;
   }
+
+  // Only some sites get the copyright section; when it is there, the two form one group.
+  #accordion-section-neve_footer_copyright_section
+  + #accordion-section-neve_global_footer_settings {
+	  margin-top: 0;
+  }
 }
diff --git a/assets/apps/customizer-controls/src/controls.js b/assets/apps/customizer-controls/src/controls.js
index 2bb9ee80d6..7f7126c54a 100644
--- a/assets/apps/customizer-controls/src/controls.js
+++ b/assets/apps/customizer-controls/src/controls.js
@@ -316,9 +316,8 @@ const bindDataAttrQuickLinks = () => {
 };
 const checkHasElementorTemplates = () => {
 	if (NeveReactCustomize.elementor.hasElementorShopTemplate) {
-		window.wp.customize
-			.section('woocommerce_product_catalog')
-			.notifications.add(
+		window.wp.customize.section('woocommerce_product_catalog', (section) =>
+			section.notifications.add(
 				new window.wp.customize.Notification(
 					'neve-custom-elementor-shop-template',
 					{
@@ -329,13 +328,13 @@ const checkHasElementorTemplates = () => {
 						),
 					}
 				)
-			);
+			)
+		);
 	}
 
 	if (NeveReactCustomize.elementor.hasElementorProductTemplate) {
-		window.wp.customize
-			.section('neve_single_product_layout')
-			.notifications.add(
+		window.wp.customize.section('neve_single_product_layout', (section) =>
+			section.notifications.add(
 				new window.wp.customize.Notification(
 					'neve-custom-elementor-product-template',
 					{
@@ -346,7 +345,8 @@ const checkHasElementorTemplates = () => {
 						),
 					}
 				)
-			);
+			)
+		);
 	}
 };
 
diff --git a/assets/apps/customizer-controls/src/scss/_general.scss b/assets/apps/customizer-controls/src/scss/_general.scss
index 8140f9f19a..73f3935611 100644
--- a/assets/apps/customizer-controls/src/scss/_general.scss
+++ b/assets/apps/customizer-controls/src/scss/_general.scss
@@ -75,7 +75,8 @@
 
 
 #sub-accordion-panel-hfg_header #accordion-section-neve_header_presets,
-#sub-accordion-panel-hfg_footer #accordion-section-neve_footer_copyright_section {
+#sub-accordion-panel-hfg_footer #accordion-section-neve_footer_copyright_section,
+#sub-accordion-panel-hfg_footer #accordion-section-neve_global_footer_settings {
   display: list-item !important;
 }
 
diff --git a/assets/apps/customizer-controls/src/typeface/Typeface.js b/assets/apps/customizer-controls/src/typeface/Typeface.js
index 11c35af3b2..450e7ad3a6 100644
--- a/assets/apps/customizer-controls/src/typeface/Typeface.js
+++ b/assets/apps/customizer-controls/src/typeface/Typeface.js
@@ -260,11 +260,7 @@ const Typeface = (props) => {
 				label={__('Letter Spacing', 'neve')}
 				step={0.1}
 				default={defaultLS[currentDevice]}
-				value={
-					letterSpacing && letterSpacing[currentDevice]
-						? letterSpacing[currentDevice]
-						: ''
-				}
+				value={letterSpacing[currentDevice] ?? ''}
 				max={20}
 				min={-5}
 				units={['px']}
diff --git a/assets/apps/dashboard/src/utils/common.js b/assets/apps/dashboard/src/utils/common.js
index 0ebe8f1f6a..4b8238933b 100644
--- a/assets/apps/dashboard/src/utils/common.js
+++ b/assets/apps/dashboard/src/utils/common.js
@@ -83,7 +83,8 @@ const getTabHash = () => {
 
 	hash = hash.substring(1);
 
-	if (!tabs[hash]?.render && !tabs[hash]?.url) {
+	// Tabs with only a `url` are links (e.g. Starter Sites once the plugin is active), not content.
+	if (!tabs[hash]?.render) {
 		return null;
 	}
 
diff --git a/assets/scss/components/compat/woocommerce/_cart.scss b/assets/scss/components/compat/woocommerce/_cart.scss
index 2e1fc5ecad..37f729e4cb 100644
--- a/assets/scss/components/compat/woocommerce/_cart.scss
+++ b/assets/scss/components/compat/woocommerce/_cart.scss
@@ -31,6 +31,7 @@
 
 .woocommerce-cart table.cart td.actions .coupon {
 	display: flex;
+	flex-wrap: wrap;
 }
 
 //</editor-fold>
diff --git a/assets/scss/components/editor/_typography.scss b/assets/scss/components/editor/_typography.scss
index 01e6900070..5f54aa8245 100644
--- a/assets/scss/components/editor/_typography.scss
+++ b/assets/scss/components/editor/_typography.scss
@@ -1,8 +1,10 @@
 @import "../main/global-colors";
 @import "../main/variables";
 
+// In the iframed editor the wrapper is the body itself.
 main,
 body &,
+&:is(body),
 body & p {
 	color: var(--nv-text-color);
 	font-size: var(--bodyfontsize);
@@ -52,21 +54,30 @@ h5,
 h6 {
 	margin-bottom: $spacing-lg;
 	margin-top: 0;
-
-	&.wp-block,
-	& {
-		font-family: var(--headingsfontfamily, var(--bodyfontfamily));
-		color: var(--headingcolor, inherit);
-	}
 }
 
 $headings: [h1,h2,h3,h4,h5,h6];
 
-@each $heading in $headings {
-	#{$heading} {
+// One class still outranks these; the html prefix ties core's editor reset.
+// WP 5.5-5.8 core heading styles are (0,1,1); those body classes outrank them.
+@at-root html :where(.editor-styles-wrapper),
+.branch-5-5 .editor-styles-wrapper,
+.branch-5-6 .editor-styles-wrapper,
+.branch-5-7 .editor-styles-wrapper,
+.branch-5-8 .editor-styles-wrapper {
+
+	h1,
+	h2,
+	h3,
+	h4,
+	h5,
+	h6 {
+		font-family: var(--headingsfontfamily, var(--bodyfontfamily));
+		color: var(--headingcolor, inherit);
+	}
 
-		&.wp-block,
-		& {
+	@each $heading in $headings {
+		#{$heading} {
 			font-size: var(--#{$heading}fontsize);
 			font-weight: var(--#{$heading}fontweight);
 			line-height: var(--#{$heading}lineheight);
@@ -209,9 +220,15 @@ pre:not(.CodeMirror-line) {
 
 
 // === Links === //
-a:not(.wp-block-button__link) {
+@at-root html :where(.editor-styles-wrapper) a:where(:not(.wp-block-button__link)) {
 	color: var(--nv-primary-accent);
 
+	// wp-admin's common.css loads in the editor and colours these at (0,1,1).
+	&:focus,
+	&:active {
+		color: var(--nv-primary-accent);
+	}
+
 	&:hover {
 		color: var(--nv-secondary-accent);
 		text-decoration: none;
diff --git a/composer.lock b/composer.lock
index b6f6754f86..b0cb92d373 100644
--- a/composer.lock
+++ b/composer.lock
@@ -8,16 +8,16 @@
     "packages": [
         {
             "name": "codeinwp/themeisle-sdk",
-            "version": "3.3.65",
+            "version": "3.3.67",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Codeinwp/themeisle-sdk.git",
-                "reference": "f650fe856d52ce4e5754557d89ba2f3127ad54d8"
+                "reference": "e1dda44811660a65c3da6994349c054a46686d69"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Codeinwp/themeisle-sdk/zipball/f650fe856d52ce4e5754557d89ba2f3127ad54d8",
-                "reference": "f650fe856d52ce4e5754557d89ba2f3127ad54d8",
+                "url": "https://api.github.com/repos/Codeinwp/themeisle-sdk/zipball/e1dda44811660a65c3da6994349c054a46686d69",
+                "reference": "e1dda44811660a65c3da6994349c054a46686d69",
                 "shasum": ""
             },
             "require-dev": {
@@ -43,9 +43,9 @@
             ],
             "support": {
                 "issues": "https://github.com/Codeinwp/themeisle-sdk/issues",
-                "source": "https://github.com/Codeinwp/themeisle-sdk/tree/v3.3.65"
+                "source": "https://github.com/Codeinwp/themeisle-sdk/tree/v3.3.67"
             },
-            "time": "2026-09-29T09:35:47+00:00"
+            "time": "2026-10-13T12:16:34+00:00"
         },
         {
             "name": "wptt/webfont-loader",
diff --git a/e2e-tests/fixtures/customizer/typography/letter-spacing-reset.json b/e2e-tests/fixtures/customizer/typography/letter-spacing-reset.json
new file mode 100644
index 0000000000..d3a894d983
--- /dev/null
+++ b/e2e-tests/fixtures/customizer/typography/letter-spacing-reset.json
@@ -0,0 +1,26 @@
+{
+	"neve_typeface_general": {
+		"fontSize": {
+			"suffix": {
+				"mobile": "px",
+				"tablet": "px",
+				"desktop": "px"
+			},
+			"mobile": 15,
+			"tablet": 16,
+			"desktop": 16
+		},
+		"lineHeight": {
+			"mobile": 1.6,
+			"tablet": 1.6,
+			"desktop": 1.7
+		},
+		"letterSpacing": {
+			"mobile": 0,
+			"tablet": "0",
+			"desktop": 0
+		},
+		"fontWeight": "400",
+		"textTransform": "none"
+	}
+}
diff --git a/e2e-tests/specs/admin/dashboard-tab-hash.spec.ts b/e2e-tests/specs/admin/dashboard-tab-hash.spec.ts
new file mode 100644
index 0000000000..9ea204b0f8
--- /dev/null
+++ b/e2e-tests/specs/admin/dashboard-tab-hash.spec.ts
@@ -0,0 +1,19 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('Dashboard tab from the URL hash', () => {
+	test('a hash naming a link-only tab opens the Welcome tab', async ({
+		page,
+	}) => {
+		const errors: string[] = [];
+		page.on('pageerror', (error) => errors.push(error.message));
+
+		// "Get Neve Pro" is a link, not a tab with content. "Starter Sites" is
+		// the same once the Starter Sites plugin is active.
+		await page.goto('wp-admin/admin.php?page=neve-welcome#get-neve-pro');
+
+		await expect(
+			page.getByRole('link', { name: 'Go to Customizer' })
+		).toBeVisible();
+		expect(errors).toEqual([]);
+	});
+});
diff --git a/e2e-tests/specs/customizer/general/elementor-template-notices.spec.ts b/e2e-tests/specs/customizer/general/elementor-template-notices.spec.ts
new file mode 100644
index 0000000000..cf1573526e
--- /dev/null
+++ b/e2e-tests/specs/customizer/general/elementor-template-notices.spec.ts
@@ -0,0 +1,143 @@
+import { test, expect, Page } from '@playwright/test';
+
+type ElementorFlags = {
+	hasElementorShopTemplate: boolean;
+	hasElementorProductTemplate: boolean;
+};
+
+type CustomizeSection = {
+	notifications: { has: (code: string) => boolean };
+};
+
+type CustomizeWindow = Window & {
+	NeveReactCustomize: { elementor: ElementorFlags };
+	wp: {
+		customize: {
+			section: {
+				(id: string): CustomizeSection | undefined;
+				has: (id: string) => boolean;
+				add: (section: CustomizeSection) => CustomizeSection;
+			};
+			Section: new (
+				id: string,
+				options: { params: { title: string } }
+			) => CustomizeSection;
+		};
+	};
+};
+
+const PRODUCT_SECTION = 'neve_single_product_layout';
+const SHOP_SECTION = 'woocommerce_product_catalog';
+
+/**
+ * Report both Elementor WooCommerce templates as present, as a site with
+ * leftover Elementor Pro templates would.
+ *
+ * @param {Page} page Playwright page.
+ */
+const forceElementorTemplates = async (page: Page): Promise<void> => {
+	await page.addInitScript(() => {
+		let localized: Record<string, unknown> | undefined;
+		Object.defineProperty(window, 'NeveReactCustomize', {
+			configurable: true,
+			get: () => localized,
+			set: (value: Record<string, unknown>) => {
+				localized = {
+					...value,
+					elementor: {
+						hasElementorShopTemplate: true,
+						hasElementorProductTemplate: true,
+					},
+				};
+			},
+		});
+	});
+};
+
+const openCustomizer = async (page: Page): Promise<void> => {
+	await page.goto('/wp-admin/customize.php');
+	await page.waitForSelector('.wp-full-overlay-sidebar', {
+		state: 'visible',
+	});
+};
+
+test.describe('Elementor WooCommerce template notices', () => {
+	test.beforeEach(async ({ page }) => {
+		await forceElementorTemplates(page);
+	});
+
+	test('customizer finishes loading when the WooCommerce sections are missing', async ({
+		page,
+	}) => {
+		const notificationErrors: string[] = [];
+		page.on('pageerror', (error) => {
+			if (error.message.includes('notifications')) {
+				notificationErrors.push(error.message);
+			}
+		});
+
+		await openCustomizer(page);
+
+		// Registered after the Elementor check, so it only appears if init got past it.
+		await expect(page.locator('#neve-style-book')).toBeVisible({
+			timeout: 60_000,
+		});
+
+		const state = await page.evaluate(
+			([shop, product]) => {
+				const { wp, NeveReactCustomize } =
+					window as unknown as CustomizeWindow;
+				return {
+					flags: NeveReactCustomize.elementor,
+					hasShopSection: wp.customize.section.has(shop),
+					hasProductSection: wp.customize.section.has(product),
+				};
+			},
+			[SHOP_SECTION, PRODUCT_SECTION]
+		);
+
+		expect(state.flags).toEqual({
+			hasElementorShopTemplate: true,
+			hasElementorProductTemplate: true,
+		});
+		expect(state.hasShopSection).toBe(false);
+		expect(state.hasProductSection).toBe(false);
+		expect(notificationErrors).toEqual([]);
+	});
+
+	const warnings = [
+		[SHOP_SECTION, 'neve-custom-elementor-shop-template'],
+		[PRODUCT_SECTION, 'neve-custom-elementor-product-template'],
+	] as const;
+
+	for (const [sectionId, code] of warnings) {
+		test(`shows the ${code} warning once ${sectionId} is registered`, async ({
+			page,
+		}) => {
+			await openCustomizer(page);
+			await expect(page.locator('#neve-style-book')).toBeVisible({
+				timeout: 60_000,
+			});
+
+			await page.evaluate((id) => {
+				const { wp } = window as unknown as CustomizeWindow;
+				wp.customize.section.add(
+					new wp.customize.Section(id, { params: { title: id } })
+				);
+			}, sectionId);
+
+			// The section callback resolves through a jQuery Deferred, which is async.
+			await expect
+				.poll(() =>
+					page.evaluate(
+						([id, notification]) =>
+							(window as unknown as CustomizeWindow).wp.customize
+								.section(id)
+								?.notifications.has(notification) ?? false,
+						[sectionId, code] as const
+					)
+				)
+				.toBe(true);
+		});
+	}
+});
diff --git a/e2e-tests/specs/customizer/header-footer-visibility/header-footer-visibility.spec.ts b/e2e-tests/specs/customizer/header-footer-visibility/header-footer-visibility.spec.ts
new file mode 100644
index 0000000000..d5ecabe8f3
--- /dev/null
+++ b/e2e-tests/specs/customizer/header-footer-visibility/header-footer-visibility.spec.ts
@@ -0,0 +1,115 @@
+import { test, expect } from '@playwright/test';
+import { setCustomizeSettings } from '../../../utils';
+
+const HEADER_WRAPPER = 'header.header';
+const FOOTER_WRAPPER = '#site-footer';
+const SKIP_LINK = 'a.neve-skip-link';
+
+test.describe( 'Global header and footer visibility', function () {
+	test( 'Shows both toggles in the builder panels', async function ( { page } ) {
+		// The builder panels hide every section they do not know, so a registered
+		// control can still be invisible. Only the browser catches that.
+		await page.goto( '/wp-admin/customize.php' );
+		await page.waitForSelector( '#customize-theme-controls' );
+
+		const panels = {
+			hfg_header: {
+				section: 'neve_pro_global_header_settings',
+				control: 'neve_disable_header',
+			},
+			hfg_footer: {
+				section: 'neve_global_footer_settings',
+				control: 'neve_disable_footer',
+			},
+		};
+
+		for ( const [ panel, item ] of Object.entries( panels ) ) {
+			await page.click( `#accordion-panel-${ panel } h3` );
+
+			const section = page.locator( `#accordion-section-${ item.section }` );
+			await expect( section ).toBeVisible();
+
+			await section.locator( 'h3' ).click();
+			const control = page.locator( `#customize-control-${ item.control }` );
+			await expect( control ).toBeVisible();
+
+			// Assert on the structure. The label text is translated.
+			await expect(
+				control.locator( 'input[type="checkbox"]' )
+			).toHaveCount( 1 );
+
+			await page.goto( '/wp-admin/customize.php' );
+			await page.waitForSelector( '#customize-theme-controls' );
+		}
+	} );
+
+	test( 'Renders both parts when nothing is turned off', async function ( {
+		page,
+		request,
+		baseURL,
+	} ) {
+		await setCustomizeSettings(
+			'hf-visible',
+			{ neve_disable_header: false, neve_disable_footer: false },
+			{ request, baseURL }
+		);
+		await page.goto( '/hello-world/?test_name=hf-visible' );
+
+		await expect( page.locator( HEADER_WRAPPER )).toHaveCount( 1 );
+		await expect( page.locator( FOOTER_WRAPPER )).toHaveCount( 1 );
+	} );
+
+	test( 'Drops the header wrapper and keeps the skip link', async function ( {
+		page,
+		request,
+		baseURL,
+	} ) {
+		await setCustomizeSettings(
+			'hf-no-header',
+			{ neve_disable_header: true },
+			{ request, baseURL }
+		);
+		await page.goto( '/hello-world/?test_name=hf-no-header' );
+
+		// The wrapper used to stay behind, empty, holding only the skip link.
+		await expect( page.locator( HEADER_WRAPPER )).toHaveCount( 0 );
+		await expect( page.locator( SKIP_LINK )).toHaveCount( 1 );
+
+		// The rest of the page is untouched.
+		await expect( page.locator( 'main#content' )).toHaveCount( 1 );
+		await expect( page.locator( FOOTER_WRAPPER )).toHaveCount( 1 );
+	} );
+
+	test( 'Drops the footer and leaves the header alone', async function ( {
+		page,
+		request,
+		baseURL,
+	} ) {
+		await setCustomizeSettings(
+			'hf-no-footer',
+			{ neve_disable_footer: true },
+			{ request, baseURL }
+		);
+		await page.goto( '/hello-world/?test_name=hf-no-footer' );
+
+		await expect( page.locator( FOOTER_WRAPPER )).toHaveCount( 0 );
+		await expect( page.locator( HEADER_WRAPPER )).toHaveCount( 1 );
+	} );
+
+	test( 'Reaches an archive, where the page metabox never did', async function ( {
+		page,
+		request,
+		baseURL,
+	} ) {
+		await setCustomizeSettings(
+			'hf-archive',
+			{ neve_disable_header: true, neve_disable_footer: true },
+			{ request, baseURL }
+		);
+		await page.goto( '/?s=hello&test_name=hf-archive' );
+
+		await expect( page.locator( 'body.search' )).toHaveCount( 1 );
+		await expect( page.locator( HEADER_WRAPPER )).toHaveCount( 0 );
+		await expect( page.locator( FOOTER_WRAPPER )).toHaveCount( 0 );
+	} );
+} );
diff --git a/e2e-tests/specs/customizer/typography/letter-spacing-reset.spec.ts b/e2e-tests/specs/customizer/typography/letter-spacing-reset.spec.ts
new file mode 100644
index 0000000000..24abf90224
--- /dev/null
+++ b/e2e-tests/specs/customizer/typography/letter-spacing-reset.spec.ts
@@ -0,0 +1,151 @@
+import { test, expect, Locator, Page } from '@playwright/test';
+import { setCustomizeSettings } from '../../../utils';
+import data from '../../../fixtures/customizer/typography/letter-spacing-reset.json';
+
+type Device = 'desktop' | 'tablet' | 'mobile';
+
+type CustomizeWindow = Window & {
+	wp: {
+		customize: {
+			(id: string): {
+				get: () => { letterSpacing: Record<Device, string | number> };
+			};
+			previewedDevice: (device: Device) => void;
+		};
+	};
+};
+
+/**
+ * Open the Customizer on a section and wait for a control to render.
+ *
+ * @param {Page}   page    Playwright page.
+ * @param {string} section Section id to autofocus.
+ * @param {string} control Control id to wait for.
+ */
+const openControl = async (
+	page: Page,
+	section: string,
+	control: string
+): Promise<Locator> => {
+	await page.goto(
+		`/wp-admin/customize.php?test_name=letterSpacingReset&autofocus[section]=${section}`
+	);
+	const wrap = page.locator(`#customize-control-${control}`);
+	await expect(wrap.locator('.letter-spacing input')).toBeVisible();
+
+	return wrap;
+};
+
+/**
+ * Switch the Customizer preview device.
+ *
+ * @param {Page}   page   Playwright page.
+ * @param {Device} device Device to preview.
+ */
+const previewDevice = (page: Page, device: Device): Promise<void> =>
+	page.evaluate((d) => {
+		(window as unknown as CustomizeWindow).wp.customize.previewedDevice(d);
+	}, device);
+
+/**
+ * Read the body typeface desktop letter spacing from the Customizer setting.
+ *
+ * @param {Page} page Playwright page.
+ */
+const storedDesktopLetterSpacing = (page: Page): Promise<string | number> =>
+	page.evaluate(
+		() =>
+			(window as unknown as CustomizeWindow).wp
+				.customize('neve_typeface_general')
+				.get().letterSpacing.desktop
+	);
+
+test.describe('Typeface number controls reset state', function () {
+	test.beforeAll(async ({ request, baseURL }) => {
+		await setCustomizeSettings('letterSpacingReset', data, {
+			request,
+			baseURL,
+		});
+	});
+
+	test('Zero letter spacing shows as default', async ({ page }) => {
+		const control = await openControl(
+			page,
+			'neve_typography_general',
+			'neve_typeface_general'
+		);
+		const input = control.locator('.letter-spacing input');
+		const reset = control.locator('.letter-spacing .reset');
+
+		await expect(input).toHaveValue('0');
+		await expect(reset).toHaveCount(0);
+
+		// Stored as a string, as typed values are.
+		await previewDevice(page, 'tablet');
+		await expect(input).toHaveValue('0');
+		await expect(reset).toHaveCount(0);
+
+		await previewDevice(page, 'desktop');
+		await input.fill('1');
+		await expect(reset).toHaveCount(1);
+
+		await reset.click();
+		await expect(input).toHaveValue('0');
+		await expect(reset).toHaveCount(0);
+	});
+
+	test('Negative letter spacing can be typed from zero', async ({ page }) => {
+		const control = await openControl(
+			page,
+			'neve_typography_general',
+			'neve_typeface_general'
+		);
+		const input = control.locator('.letter-spacing input');
+
+		await expect(input).toHaveValue('0');
+		await input.selectText();
+		await page.keyboard.type('-1');
+
+		await expect(input).toHaveValue('-1');
+		expect(await storedDesktopLetterSpacing(page)).toBe('-1');
+	});
+
+	test('Cleared letter spacing saves 0 and shows it on blur', async ({
+		page,
+	}) => {
+		const control = await openControl(
+			page,
+			'neve_typography_general',
+			'neve_typeface_general'
+		);
+		const input = control.locator('.letter-spacing input');
+
+		await input.fill('1');
+		await input.selectText();
+		await page.keyboard.press('Backspace');
+
+		await expect(input).toHaveValue('');
+		expect(await storedDesktopLetterSpacing(page)).toBe(0);
+
+		await input.blur();
+		await expect(input).toHaveValue('0');
+	});
+
+	test('Untouched empty defaults have no reset', async ({ page }) => {
+		const control = await openControl(
+			page,
+			'neve_buttons_section',
+			'neve_button_typeface'
+		);
+
+		for (const field of ['font-size', 'line-height', 'letter-spacing']) {
+			await expect(control.locator(`.${field} input`)).toHaveValue('');
+			await expect(control.locator(`.${field} .reset`)).toHaveCount(0);
+		}
+
+		const input = control.locator('.letter-spacing input');
+		await input.fill('0');
+		await expect(input).toHaveValue('0');
+		await expect(control.locator('.letter-spacing .reset')).toHaveCount(1);
+	});
+});
diff --git a/e2e-tests/specs/editor/block-style-overrides.spec.ts b/e2e-tests/specs/editor/block-style-overrides.spec.ts
new file mode 100644
index 0000000000..2660d7c660
--- /dev/null
+++ b/e2e-tests/specs/editor/block-style-overrides.spec.ts
@@ -0,0 +1,161 @@
+import { test, expect, Frame, Page } from '@playwright/test';
+import { clearWelcome, setCustomizeSettings } from '../../utils';
+
+const STYLE_CLASS = 'is-style-nv';
+const STYLE_COLOR = 'rgb(1, 2, 3)';
+const STYLE_FONT_SIZE = '37px';
+const TEST_NAME = 'block-style-overrides';
+const BODY_FONT_SIZE = { mobile: '19', tablet: '19', desktop: '19' };
+
+const openEditorCanvas = async (page: Page): Promise<Frame> => {
+	await page.goto(`wp-admin/post-new.php?test_name=${TEST_NAME}`);
+	await clearWelcome(page);
+	await page.waitForFunction(() =>
+		window.wp?.data?.select('core/block-editor')
+	);
+	await page
+		.frameLocator('iframe[name="editor-canvas"]')
+		.locator('.is-root-container')
+		.waitFor();
+
+	const canvas = page.frame({ name: 'editor-canvas' });
+	if (!canvas) {
+		throw new Error('Editor canvas iframe not found.');
+	}
+	return canvas;
+};
+
+const insertFixtureBlocks = async (page: Page): Promise<void> => {
+	await page.evaluate((styleClass: string) => {
+		const { createBlock } = window.wp.blocks;
+		window.wp.data.dispatch('core/block-editor').insertBlocks([
+			createBlock('core/heading', {
+				level: 2,
+				className: styleClass,
+				content: 'Styled heading',
+			}),
+			createBlock('core/heading', { level: 2, content: 'Plain heading' }),
+			createBlock('core/paragraph', {
+				className: styleClass,
+				content: 'Styled paragraph <a href="#styled">styled link</a>',
+			}),
+			createBlock('core/paragraph', {
+				content: 'Plain paragraph <a href="#plain">plain link</a>',
+			}),
+		]);
+	}, STYLE_CLASS);
+};
+
+// Loaded before the theme, so only specificity can make it win.
+const prependBlockStyle = async (canvas: Frame): Promise<void> => {
+	await canvas.evaluate(
+		({
+			styleClass,
+			color,
+			fontSize,
+		}: {
+			styleClass: string;
+			color: string;
+			fontSize: string;
+		}) => {
+			const style = document.createElement('style');
+			style.textContent = `.${styleClass} { color: ${color}; font-size: ${fontSize}; } .${styleClass} a { color: ${color}; }`;
+			document.head.prepend(style);
+		},
+		{
+			styleClass: STYLE_CLASS,
+			color: STYLE_COLOR,
+			fontSize: STYLE_FONT_SIZE,
+		}
+	);
+};
+
+type ProbeProperty = 'color' | 'fontSize';
+
+// Resolved beside the element so em values compare as px.
+const resolveVariable = (
+	canvas: Frame,
+	selector: string,
+	property: ProbeProperty,
+	variable: string
+): Promise<string> =>
+	canvas.evaluate(
+		(args: {
+			selector: string;
+			property: ProbeProperty;
+			variable: string;
+		}) => {
+			const element = document.querySelector(args.selector);
+			if (!element?.parentElement) {
+				throw new Error(`Missing ${args.selector}`);
+			}
+			const probe = document.createElement('span');
+			probe.style[args.property] = `var(${args.variable})`;
+			element.parentElement.appendChild(probe);
+			const value = getComputedStyle(probe)[args.property];
+			probe.remove();
+			return value;
+		},
+		{ selector, property, variable }
+	);
+
+test.describe('Editor block style overrides', () => {
+	test('Single-class block styles override theme heading, paragraph and link defaults', async ({
+		page,
+		request,
+		baseURL,
+	}) => {
+		await setCustomizeSettings(
+			TEST_NAME,
+			{ neve_typeface_general: { fontSize: BODY_FONT_SIZE } },
+			{ request, baseURL }
+		);
+		const canvas = await openEditorCanvas(page);
+		await insertFixtureBlocks(page);
+		await prependBlockStyle(canvas);
+
+		const editor = page.frameLocator('iframe[name="editor-canvas"]');
+
+		const styledHeading = editor.locator(`h2.${STYLE_CLASS}`);
+		const styledParagraph = editor.locator(`p.${STYLE_CLASS}`);
+
+		await expect(styledHeading).toHaveCSS('color', STYLE_COLOR);
+		await expect(styledHeading).toHaveCSS('font-size', STYLE_FONT_SIZE);
+		await expect(styledParagraph).toHaveCSS('color', STYLE_COLOR);
+		await expect(styledParagraph).toHaveCSS('font-size', STYLE_FONT_SIZE);
+		await expect(styledParagraph.locator('a')).toHaveCSS(
+			'color',
+			STYLE_COLOR
+		);
+
+		const plainHeading = `h2.wp-block:not(.${STYLE_CLASS})`;
+		const plainParagraph = `p.wp-block:not(.${STYLE_CLASS})`;
+		await expect(editor.locator(plainHeading)).toHaveCSS(
+			'font-size',
+			await resolveVariable(
+				canvas,
+				plainHeading,
+				'fontSize',
+				'--h2fontsize'
+			)
+		);
+		await expect(editor.locator(plainParagraph)).toHaveCSS(
+			'font-size',
+			await resolveVariable(
+				canvas,
+				plainParagraph,
+				'fontSize',
+				'--bodyfontsize'
+			)
+		);
+		await expect(editor.locator(`${plainParagraph} a`)).toHaveCSS(
+			'color',
+			await resolveVariable(
+				canvas,
+				`${plainParagraph} a`,
+				'color',
+				'--nv-primary-accent'
+			)
+		);
+	});
+});
diff --git a/e2e-tests/specs/woocommerce/cart-coupon-notice.spec.ts b/e2e-tests/specs/woocommerce/cart-coupon-notice.spec.ts
new file mode 100644
index 0000000000..2914b4b50f
--- /dev/null
+++ b/e2e-tests/specs/woocommerce/cart-coupon-notice.spec.ts
@@ -0,0 +1,92 @@
+import { test, expect } from '@playwright/test';
+
+type Box = { top: number; bottom: number; width: number };
+type CouponBoxes = { coupon: Box; input: Box; button: Box; notice: Box };
+
+// Guest session, so the cart does not persist into other specs.
+test.use({ storageState: { cookies: [], origins: [] } });
+
+test.describe('Classic cart coupon error notice', function () {
+	let productId: number;
+	let pageId: number;
+	let cartPath: string;
+
+	test.beforeAll(async ({ request }) => {
+		const product = await request.post('/wp-json/wc/v3/products', {
+			data: {
+				name: 'Coupon notice product',
+				regular_price: '10',
+				status: 'publish',
+			},
+		});
+		expect(product.ok()).toBe(true);
+		productId = (await product.json()).id;
+
+		const page = await request.post('/wp-json/wp/v2/pages', {
+			data: {
+				title: 'Classic cart',
+				content: '[woocommerce_cart]',
+				status: 'publish',
+			},
+		});
+		expect(page.ok()).toBe(true);
+		const pageData: { id: number; link: string } = await page.json();
+		pageId = pageData.id;
+		cartPath = new URL(pageData.link).pathname;
+	});
+
+	test.afterAll(async ({ request }) => {
+		await request.delete(`/wp-json/wc/v3/products/${productId}?force=true`);
+		await request.delete(`/wp-json/wp/v2/pages/${pageId}?force=true`);
+	});
+
+	test('Invalid coupon notice gets its own full-width row', async ({
+		page,
+	}) => {
+		await page.goto(`/?add-to-cart=${productId}`);
+		await page.goto(cartPath);
+
+		const coupon = page.locator('table.cart td.actions .coupon');
+
+		await coupon.locator('#coupon_code').fill('neve-not-a-coupon');
+		await coupon.locator('button[name="apply_coupon"]').click();
+		// The alert role is only set once the cart form has been re-rendered.
+		await expect(
+			coupon.locator('.coupon-error-notice[role="alert"]')
+		).toBeVisible();
+
+		for (const width of [1280, 375]) {
+			await page.setViewportSize({ width, height: 900 });
+
+			// One pass: WooCommerce scrolls to the notice between reads.
+			const boxes: CouponBoxes = await coupon.evaluate((el) => {
+				const measure = (selector: string | null): Box => {
+					const node = selector ? el.querySelector(selector) : el;
+					if (!node) {
+						throw new Error(`Missing ${selector} in .coupon`);
+					}
+					const rect = node.getBoundingClientRect();
+					return {
+						top: rect.top,
+						bottom: rect.bottom,
+						width: rect.width,
+					};
+				};
+				return {
+					coupon: measure(null),
+					input: measure('#coupon_code'),
+					button: measure('button[name="apply_coupon"]'),
+					notice: measure('.coupon-error-notice'),
+				};
+			});
+
+			expect(boxes.notice.top).toBeGreaterThanOrEqual(
+				boxes.button.bottom
+			);
+			expect(
+				Math.abs(boxes.notice.width - boxes.coupon.width)
+			).toBeLessThan(2);
+			expect(boxes.button.top).toBeLessThan(boxes.input.bottom);
+		}
+	});
+});
diff --git a/globals/sanitize-functions.php b/globals/sanitize-functions.php
index c2143336b0..5d2e81002a 100644
--- a/globals/sanitize-functions.php
+++ b/globals/sanitize-functions.php
@@ -36,6 +36,18 @@ function neve_is_css_var( $value ) {
 	return (bool) preg_match( $pattern, $value );
 }
 
+/**
+ * Check whether a value is a single CSS gradient function.
+ *
+ * @param string $value Value to check.
+ *
+ * @return bool
+ */
+function neve_is_css_gradient( string $value ): bool {
+	// Recursion keeps parentheses balanced, so nothing can follow the closing one.
+	return (bool) preg_match( '/^(?:repeating-)?(?:linear|radial|conic)-gradient(\((?:[a-z0-9#%.,\s\/_-]|(?1))*\))$/i', trim( $value ) );
+}
+
 /**
  * Sanitize a color control value.
  *
@@ -54,8 +66,8 @@ function neve_sanitize_colors( $value ) {
 		return trim( $value );
 	}
 
-	if ( false !== strpos( $value, 'gradient' ) ) {
-		return $value;
+	if ( neve_is_css_gradient( $value ) ) {
+		return trim( $value );
 	}
 
 	// Is this an rgba color or a hex?
diff --git a/header-footer-grid/Core/Builder/Abstract_Builder.php b/header-footer-grid/Core/Builder/Abstract_Builder.php
index 90b0a4c8b2..24173fec99 100644
--- a/header-footer-grid/Core/Builder/Abstract_Builder.php
+++ b/header-footer-grid/Core/Builder/Abstract_Builder.php
@@ -830,7 +830,7 @@ public function render() {
 			$style     = $this->add_style( [] );
 			$generator = new Css_Generator();
 			$generator->set( $style );
-			$style = $generator->generate();
+			$style = wp_strip_all_tags( $generator->generate() );
 			echo '<style type="text/css" id="' . esc_attr( $this->get_id() ) . '-style">' . $style . '</style>';// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 		}
 		foreach ( $layout as $device_name => $device ) {
diff --git a/header-footer-grid/Core/Builder/Footer.php b/header-footer-grid/Core/Builder/Footer.php
index d36c6e8522..482e05ca67 100644
--- a/header-footer-grid/Core/Builder/Footer.php
+++ b/header-footer-grid/Core/Builder/Footer.php
@@ -162,6 +162,8 @@ function ( $value ) {
 	 * @access  public
 	 */
 	public function customize_register( WP_Customize_Manager $wp_customize ) {
+		$this->customize_global_footer( $wp_customize );
+
 		if ( $this->has_valid_addons() || ! Migration_Flags::is_new_user_after_v41() ) {
 			return parent::customize_register( $wp_customize );
 		}
@@ -192,10 +194,47 @@ public function customize_register( WP_Customize_Manager $wp_customize ) {
 				'setting' => 'footer_copyright_content',
 			]
 		);
-		
+
 		return parent::customize_register( $wp_customize );
 	}
 
+	/**
+	 * Registers the footer options section, the counterpart of the global header settings.
+	 *
+	 * @param WP_Customize_Manager $wp_customize The Customize Manager.
+	 *
+	 * @return void
+	 */
+	private function customize_global_footer( WP_Customize_Manager $wp_customize ) {
+		$wp_customize->add_section(
+			'neve_global_footer_settings',
+			[
+				'title'    => __( 'Footer Options', 'neve' ),
+				'priority' => 201,
+				'panel'    => 'hfg_footer',
+			]
+		);
+
+		$wp_customize->add_setting(
+			'neve_disable_footer',
+			[
+				'default'           => false,
+				'transport'         => 'refresh',
+				'sanitize_callback' => 'neve_sanitize_checkbox',
+			]
+		);
+
+		$wp_customize->add_control(
+			'neve_disable_footer',
+			[
+				'label'    => esc_html__( 'Disable Footer', 'neve' ),
+				'section'  => 'neve_global_footer_settings',
+				'type'     => 'neve_toggle_control',
+				'priority' => 5,
+			]
+		);
+	}
+
 	/**
 	 * Add footer component.
 	 *
diff --git a/header-footer-grid/Core/Builder/Header.php b/header-footer-grid/Core/Builder/Header.php
index 975c271ffe..50e165f8a3 100644
--- a/header-footer-grid/Core/Builder/Header.php
+++ b/header-footer-grid/Core/Builder/Header.php
@@ -39,6 +39,7 @@ class Header extends Abstract_Builder {
 	const BACKGROUND_HEADING = 'background_heading';
 	const ADVANCED_STYLE     = 'advanced_style';
 	const BACKGROUND_SETTING = 'background';
+	const DISABLE_HEADER     = 'neve_disable_header';
 
 	/**
 	 * Default color for global header background
@@ -111,6 +112,8 @@ public function init() {
 	 */
 	public function customize_register( WP_Customize_Manager $wp_customize ) {
 		if ( ! neve_is_new_builder() ) {
+			$this->customize_legacy_global_header( $wp_customize );
+
 			return parent::customize_register( $wp_customize );
 		}
 
@@ -206,12 +209,89 @@ private function move_pro_controls( WP_Customize_Manager $wp_customize, WP_Custo
 		ksort( $global_settings_tabs->tabs );
 	}
 
+	/**
+	 * Arguments of the setting behind the toggle that hides the header on every page.
+	 *
+	 * @return array{default: false, transport: string, sanitize_callback: string}
+	 */
+	private function get_disable_header_setting_args(): array {
+		return [
+			'default'           => false,
+			'transport'         => 'refresh',
+			'sanitize_callback' => 'neve_sanitize_checkbox',
+		];
+	}
+
+	/**
+	 * Arguments of the toggle that hides the header on every page.
+	 *
+	 * @return array{label: string, section: string, type: string, priority: int}
+	 */
+	private function get_disable_header_control_args(): array {
+		return [
+			'label'    => esc_html__( 'Disable Header', 'neve' ),
+			'section'  => 'neve_pro_global_header_settings',
+			'type'     => 'neve_toggle_control',
+			'priority' => 5,
+		];
+	}
+
+	/**
+	 * Registers the header toggle for the legacy builder.
+	 *
+	 * The legacy builder has no global header settings tabs, so the toggle is a plain control
+	 * and any Neve Pro controls in the section keep showing as before.
+	 *
+	 * @param WP_Customize_Manager $wp_customize The Customize Manager.
+	 *
+	 * @return void
+	 */
+	private function customize_legacy_global_header( WP_Customize_Manager $wp_customize ) {
+		if ( $wp_customize->get_section( 'neve_pro_global_header_settings' ) === null ) {
+			$wp_customize->add_section(
+				'neve_pro_global_header_settings',
+				[
+					'title'    => __( 'Global Header Settings', 'neve' ),
+					'priority' => 200,
+					'panel'    => 'hfg_header',
+				]
+			);
+		}
+
+		$setting_args = $this->get_disable_header_setting_args();
+
+		// Theme Check reads the sanitize_callback key from the add_setting() call itself.
+		$wp_customize->add_setting(
+			self::DISABLE_HEADER,
+			[
+				'default'           => $setting_args['default'],
+				'transport'         => $setting_args['transport'],
+				'sanitize_callback' => $setting_args['sanitize_callback'],
+			]
+		);
+		$wp_customize->add_control( self::DISABLE_HEADER, $this->get_disable_header_control_args() );
+	}
+
 	/**
 	 * Registers controls for global header background
 	 */
 	private function customize_global_header() {
 		$section_id = 'neve_pro_global_header_settings';
 
+		// Not a conditional header setting: it hides every header layout at once.
+		SettingsManager::get_instance()->add(
+			array_merge(
+				$this->get_disable_header_setting_args(),
+				$this->get_disable_header_control_args(),
+				[
+					'id'       => self::DISABLE_HEADER,
+					'noformat' => true,
+					'group'    => $section_id,
+					'tab'      => 'general',
+				]
+			)
+		);
+
 		SettingsManager::get_instance()->add(
 			[
 				'id'        => self::BACKGROUND_HEADING,
diff --git a/header-footer-grid/Core/Components/Abstract_Component.php b/header-footer-grid/Core/Components/Abstract_Component.php
index 3e88c8d310..7777a28f13 100644
--- a/header-footer-grid/Core/Components/Abstract_Component.php
+++ b/header-footer-grid/Core/Components/Abstract_Component.php
@@ -361,7 +361,7 @@ public function render_css() {
 		$css_array = $this->add_style( $css_array );
 		$generator = new Css_Generator();
 		$generator->set( $css_array );
-		$style = $generator->generate();
+		$style = wp_strip_all_tags( $generator->generate() );
 
 		echo '<style type="text/css" id="' . esc_attr( $this->get_id() ) . '-style">' . $style . '</style>';  // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 		self::$should_show_css = false;
diff --git a/header-footer-grid/Traits/Core.php b/header-footer-grid/Traits/Core.php
index f9cd7dffeb..6542892595 100644
--- a/header-footer-grid/Traits/Core.php
+++ b/header-footer-grid/Traits/Core.php
@@ -55,12 +55,16 @@ protected function css_array_to_css( $rules = [], $indent = 0 ) {
 	/**
 	 * Sanitize regular json.
 	 *
-	 * @param string $input Input.
+	 * @param mixed $input JSON string, decoded array, or any other value.
 	 *
 	 * @return string
 	 */
 	public function sanitize_json( $input ) {
-		$inputs = json_decode( $input, true );
+		if ( is_array( $input ) ) {
+			return empty( $input ) ? '' : (string) wp_json_encode( $input );
+		}
+
+		$inputs = is_string( $input ) ? json_decode( $input, true ) : null;
 		if ( is_array( $inputs ) && ! empty( $inputs ) ) {
 			return $input;
 		}
@@ -71,11 +75,12 @@ public function sanitize_json( $input ) {
 	/**
 	 * Sanitize responsive control
 	 *
-	 * @param string $input Input.
+	 * @param mixed $input JSON string, decoded array, or any other value.
 	 * @return string
 	 */
 	public function sanitize_responsive_int_json( $input ) {
-		$inputs   = json_decode( $input, true );
+		// Pro conditional headers return the stored value decoded, so arrays reach the sanitizer.
+		$inputs   = is_array( $input ) ? $input : ( is_string( $input ) ? json_decode( $input, true ) : null );
 		$filtered = array(
 			'mobile'  => 0,
 			'tablet'  => 0,
diff --git a/header.php b/header.php
index 6825cdf20a..8fb79a6ce0 100644
--- a/header.php
+++ b/header.php
@@ -75,31 +75,45 @@
 	do_action( 'neve_before_header_wrapper_hook' );
 	?>
 
-	<header class="<?php echo esc_attr( $header_classes ); ?>" <?php echo ( neve_is_amp() ) ? 'next-page-hide' : ''; ?> >
-		<a class="neve-skip-link show-on-focus" href="#content" >
-			<?php echo __( 'Skip to content', 'neve' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
-		</a>
-		<?php
+	<a class="neve-skip-link show-on-focus" href="#content" <?php echo ( neve_is_amp() ) ? 'next-page-hide' : ''; ?>>
+		<?php echo __( 'Skip to content', 'neve' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
+	</a>
+
+	<?php
+	$neve_has_header = apply_filters( 'neve_filter_toggle_content_parts', true, 'header' ) === true;
+
+	// The hooks around the header run even when it is off, so what they add (such as the
+	// Neve Pro page header) stays. The wrapper is printed only when it has something to wrap.
+	ob_start();
+
+	/**
+	 * Executes actions before the header ( navigation ) area.
+	 *
+	 * @since 1.0.0
+	 */
+	do_action( 'neve_before_header_hook' );
 
-		/**
-		 * Executes actions before the header ( navigation ) area.
-		 *
-		 * @since 1.0.0
-		 */
-		do_action( 'neve_before_header_hook' );
-
-		if ( apply_filters( 'neve_filter_toggle_content_parts', true, 'header' ) === true ) {
-			do_action( 'neve_do_header' );
-		}
-
-		/**
-		 * Executes actions after the header ( navigation ) area.
-		 *
-		 * @since 1.0.0
-		 */
-		do_action( 'neve_after_header_hook' );
+	if ( $neve_has_header ) {
+		do_action( 'neve_do_header' );
+	}
+
+	/**
+	 * Executes actions after the header ( navigation ) area.
+	 *
+	 * @since 1.0.0
+	 */
+	do_action( 'neve_after_header_hook' );
+
+	$neve_header_markup = (string) ob_get_clean();
+
+	if ( $neve_has_header || trim( $neve_header_markup ) !== '' ) {
 		?>
+	<header class="<?php echo esc_attr( $header_classes ); ?>" <?php echo ( neve_is_amp() ) ? 'next-page-hide' : ''; ?> >
+		<?php echo $neve_header_markup; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Printed by the header hooks, which escape their own output. ?>
 	</header>
+		<?php
+	}
+	?>
 
 	<?php
 	/**
diff --git a/inc/admin/metabox/manager.php b/inc/admin/metabox/manager.php
index d44db72ac8..195bef0373 100755
--- a/inc/admin/metabox/manager.php
+++ b/inc/admin/metabox/manager.php
@@ -314,9 +314,11 @@ public function neve_register_meta() {
 			]
 		);
 		foreach ( $meta_sidebar_controls as $control ) {
-			$type = 'string';
+			$type              = 'string';
+			$sanitize_callback = 'sanitize_text_field';
 			if ( $control['type'] === 'range' ) {
-				$type = 'integer';
+				$type              = 'integer';
+				$sanitize_callback = 'absint';
 			}
 
 			$post_type = '';
@@ -328,7 +330,7 @@ public function neve_register_meta() {
 				'show_in_rest'      => true,
 				'type'              => $type,
 				'single'            => true,
-				'sanitize_callback' => 'sanitize_text_field',
+				'sanitize_callback' => $sanitize_callback,
 				'auth_callback'     => function () {
 					return current_user_can( 'edit_posts' );
 				},
diff --git a/inc/compatibility/amp.php b/inc/compatibility/amp.php
index b8cb26eca1..0ecb933232 100644
--- a/inc/compatibility/amp.php
+++ b/inc/compatibility/amp.php
@@ -24,7 +24,7 @@ public function register_hooks() {
 		if ( ! neve_is_amp() ) {
 			return;
 		}
-		add_filter( 'neve_caret_wrap_filter', array( $this, 'amp_dropdowns' ), 10, 2 );
+		add_filter( 'neve_caret_wrap_filter', array( $this, 'amp_dropdowns' ), 10, 3 );
 		add_filter(
 			'neve_woocommerce_sidebar_filter_btn_data_attrs',
 			array(
@@ -44,7 +44,9 @@ public function register_hooks() {
 		add_filter( 'walker_nav_menu_start_el', array( $this, 'wrap_content' ), 10, 4 );
 		add_filter( 'neve_sidebar_data_attrs', array( $this, 'add_woo_sidebar_attrs' ), 10, 2 );
 		add_filter( 'neve_search_menu_item_filter', array( $this, 'add_search_menu_item_attrs' ), 10, 2 );
-		add_action( 'neve_after_header_hook', array( $this, 'render_amp_states' ) );
+		// Printed outside the header, because one of the states drives the shop sidebar,
+		// which is on the page even when the header is turned off.
+		add_action( 'neve_after_header_wrapper_hook', array( $this, 'render_amp_states' ) );
 		add_filter( 'neve_nav_toggle_data_attrs', array( $this, 'add_nav_toggle_attrs' ) );
 		add_action( 'wp_head', array( $this, 'inline_styles' ) );
 
@@ -150,7 +152,7 @@ public function wrap_content( $item_output, $item, $depth, $args ) {
 
 		$item_output = '<div class="has-caret amp">' . $item_output . $caret . '</div>';
 		// Filter that is used for AMP proper event integration.
-		$item_output = apply_filters( 'neve_caret_wrap_filter', $item_output, $item->menu_order );
+		$item_output = apply_filters( 'neve_caret_wrap_filter', $item_output, $item->menu_order, $item );
 
 		return $item_output;
 	}
@@ -251,12 +253,13 @@ public function sidebar_close_button_attrs( $input, $slug ) {
 	/**
 	 * Implement AMP integration on drop-downs.
 	 *
-	 * @param string $output the output.
-	 * @param string $id menu item order.
+	 * @param string        $output the output.
+	 * @param string        $id menu item order.
+	 * @param \WP_Post|null $item menu item that owns the drop-down.
 	 *
 	 * @return mixed
 	 */
-	public function amp_dropdowns( $output, $id ) {
+	public function amp_dropdowns( $output, $id, $item = null ) {
 
 		// Generate a unique id for drop-down items.
 		$state = 'neveMenuItemExpanded' . $id;
@@ -272,6 +275,9 @@ public function amp_dropdowns( $output, $id ) {
 		$amp_caret .= '<div class="caret-wrap amp-caret-wrap"';
 		$amp_caret .= ' on="tap:AMP.setState( { ' . $state . ': ! ' . $state . ' } )"';
 		$amp_caret .= ' role="button" ';
+		if ( $item !== null ) {
+			$amp_caret .= ' aria-label="' . esc_attr( \Neve\Views\Nav_Walker::get_submenu_toggle_label( $item ) ) . '"';
+		}
 		$amp_caret .= ' aria-expanded="false" ';
 		$amp_caret .= ' [aria-expanded]="' . $state . ' ? \'true\' : \'false\'">' . $caret . '</div>';
 
@@ -333,6 +339,12 @@ public function should_display_infinite_scroll() {
 			return false;
 		}
 
+		// The infinite scroll wraps the footer and replaces the pagination, so without
+		// the footer the page keeps its regular pagination.
+		if ( apply_filters( 'neve_filter_toggle_content_parts', true, 'footer' ) !== true ) {
+			return false;
+		}
+
 		$has_pagination = ! empty( get_the_posts_pagination() );
 		if ( ! $has_pagination ) {
 			return false;
diff --git a/inc/compatibility/elementor.php b/inc/compatibility/elementor.php
index 45f0d4b352..f41638a50c 100644
--- a/inc/compatibility/elementor.php
+++ b/inc/compatibility/elementor.php
@@ -127,7 +127,7 @@ public function enqueue() {
 		 * @since 3.1.0
 		 */
 		$css = apply_filters( 'neve_elementor_colors', $css );
-		$css = Dynamic_Css::minify_css( $css );
+		$css = wp_strip_all_tags( Dynamic_Css::minify_css( $css ) );
 		wp_add_inline_style( 'neve-style', $css );
 	}
 
diff --git a/inc/compatibility/fse.php b/inc/compatibility/fse.php
index b046a541d1..df4b045523 100644
--- a/inc/compatibility/fse.php
+++ b/inc/compatibility/fse.php
@@ -186,20 +186,33 @@ public function handle_header() {
 		<div class="wrapper">
 		<?php do_action( 'neve_before_header_wrapper_hook' ); ?>
 
-		<header class="<?php echo esc_attr( $header_classes ); ?>" <?php echo ( neve_is_amp() ) ? 'next-page-hide' : ''; ?> >
-			<a class="neve-skip-link show-on-focus" href="#content">
-				<?php echo __( 'Skip to content', 'neve' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
-			</a>
-			<?php
-			do_action( 'neve_before_header_hook' );
+		<a class="neve-skip-link show-on-focus" href="#content" <?php echo ( neve_is_amp() ) ? 'next-page-hide' : ''; ?>>
+			<?php echo __( 'Skip to content', 'neve' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
+		</a>
 
-			if ( apply_filters( 'neve_filter_toggle_content_parts', true, 'header' ) === true ) {
-				$this->handle_theme_part( 'header', $template );
-			}
+		<?php
+		$has_header = apply_filters( 'neve_filter_toggle_content_parts', true, 'header' ) === true;
+
+		// The hooks around the header run even when it is off, so what they add (such as the
+		// Neve Pro page header) stays. The wrapper is printed only when it has something to wrap.
+		ob_start();
+		do_action( 'neve_before_header_hook' );
+
+		if ( $has_header ) {
+			$this->handle_theme_part( 'header', $template );
+		}
+
+		do_action( 'neve_after_header_hook' );
+		$header_markup = (string) ob_get_clean();
 
-			do_action( 'neve_after_header_hook' );
+		if ( $has_header || trim( $header_markup ) !== '' ) {
 			?>
+		<header class="<?php echo esc_attr( $header_classes ); ?>" <?php echo ( neve_is_amp() ) ? 'next-page-hide' : ''; ?> >
+			<?php echo $header_markup; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Printed by the header hooks and the header template part, which escape their own output. ?>
 		</header>
+			<?php
+		}
+		?>
 
 		<?php
 		do_action( 'neve_after_header_wrapper_hook' );
diff --git a/inc/core/admin.php b/inc/core/admin.php
index d234886dec..da731b6fd4 100644
--- a/inc/core/admin.php
+++ b/inc/core/admin.php
@@ -196,7 +196,7 @@ public function register_react_components() {
 		}
 
 		wp_register_style( 'neve-components', trailingslashit( NEVE_ASSETS_URL ) . 'apps/components/build/style-components.css', [ 'wp-components' ], $deps['version'] );
-		wp_add_inline_style( 'neve-components', Dynamic_Css::get_root_css() );
+		wp_add_inline_style( 'neve-components', wp_strip_all_tags( Dynamic_Css::get_root_css() ) );
 	}
 
 	/**
diff --git a/inc/core/dynamic_css.php b/inc/core/dynamic_css.php
index 53546dbe78..60b186a3b3 100644
--- a/inc/core/dynamic_css.php
+++ b/inc/core/dynamic_css.php
@@ -90,7 +90,7 @@ public function enqueue() {
 
 		$style .= self::get_root_css();
 
-		$style = self::minify_css( $style );
+		$style = wp_strip_all_tags( self::minify_css( $style ) );
 
 		wp_add_inline_style( $is_for_gutenberg ? self::GUTENBERG_HANDLE : self::FRONTEND_HANDLE, $style );
 	}
@@ -115,7 +115,7 @@ public function add_customize_vars_tag() {
 
 		$css = ':root{' . $this->get_css_vars() . '}';
 		$css .= apply_filters( 'neve_after_css_root', $css );
-		wp_add_inline_style( 'nv-css-vars', self::minify_css($css ) );
+		wp_add_inline_style( 'nv-css-vars', wp_strip_all_tags( self::minify_css($css ) ) );
 
 		/**
 		 * Custom colors needs a separate style to prevent overwriting the main color for the pallets.
diff --git a/inc/customizer/loader.php b/inc/customizer/loader.php
index 94bbe8b790..fbaa02eeac 100644
--- a/inc/customizer/loader.php
+++ b/inc/customizer/loader.php
@@ -13,6 +13,7 @@
 use Neve\Core\Factory;
 use Neve\Core\Settings\Config;
 use Neve\Customizer\Options\Colors_Background;
+use Neve\Views\Font_Manager;
 
 /**
  * Main customizer handler.
@@ -196,7 +197,7 @@ public function enqueue_customizer_controls() {
 			}
 		}
 
-		$fonts = neve_get_google_fonts();
+		$fonts = $this->get_remote_preview_fonts();
 
 		if ( empty( $fonts ) ) {
 			return;
@@ -214,6 +215,31 @@ public function enqueue_customizer_controls() {
 		}
 	}
 
+	/**
+	 * Get the Google fonts whose control previews load remotely.
+	 *
+	 * When fonts are hosted locally, the already downloaded faces are inlined instead.
+	 *
+	 * @return string[]
+	 */
+	private function get_remote_preview_fonts(): array {
+		$fonts = neve_get_google_fonts();
+
+		if ( ! Font_Manager::should_load_fonts_locally() ) {
+			return $fonts;
+		}
+
+		$local_faces = Font_Manager::get_downloaded_font_faces();
+
+		if ( empty( $local_faces['variants'] ) ) {
+			return $fonts;
+		}
+
+		wp_add_inline_style( 'react-controls', $local_faces['css'] );
+
+		return array_values( array_diff( $fonts, array_keys( $local_faces['variants'] ) ) );
+	}
+
 	/**
 	 * Enqueue customizer preview script.
 	 */
diff --git a/inc/customizer/options/colors_background.php b/inc/customizer/options/colors_background.php
index 4d5f9f96d4..077966f8b6 100644
--- a/inc/customizer/options/colors_background.php
+++ b/inc/customizer/options/colors_background.php
@@ -150,6 +150,11 @@ public function sanitize_global_colors( $value ) {
 
 		foreach ( $value['palettes'] as $slug => $args ) {
 			foreach ( $args['colors'] as $key => $color_val ) {
+				// Keys become CSS custom property names.
+				if ( sanitize_key( $key ) !== $key ) {
+					unset( $value['palettes'][ $slug ]['colors'][ $key ] );
+					continue;
+				}
 				$value['palettes'][ $slug ]['colors'][ $key ] = neve_sanitize_colors( $color_val );
 			}
 		}
@@ -176,7 +181,7 @@ public function sanitize_global_custom_colors( $value ) {
 		foreach ( $value as $slug => $options ) {
 			$color = neve_sanitize_colors( $options['val'] );
 
-			if ( ! $color ) {
+			if ( ! $color || sanitize_key( $slug ) !== $slug ) {
 				unset( $value[ $slug ] );
 				continue;
 			}
diff --git a/inc/views/font_manager.php b/inc/views/font_manager.php
index 07185db495..5303e8dd1b 100644
--- a/inc/views/font_manager.php
+++ b/inc/views/font_manager.php
@@ -147,11 +147,34 @@ private function get_body_variations() {
 	 * Register the fonts that are selected in customizer.
 	 */
 	public function register_google_fonts() {
+		$local_variants = $this->get_customizer_local_variants();
+
 		foreach ( self::$font_families as $font_family => $font_weights ) {
+			$required = array_merge( $font_weights, array( '400' ) );
+
+			if ( isset( $local_variants[ $font_family ] ) && ! array_diff( $required, $local_variants[ $font_family ] ) ) {
+				continue;
+			}
+
 			$this->enqueue_google_font( $font_family, $font_weights );
 		}
 	}
 
+	/**
+	 * Get the font variants the Customizer controls already load from the local font cache.
+	 *
+	 * Core fires the block editor hooks inside the controls for the widgets editor.
+	 *
+	 * @return array<string, list<string>> Font family => variants such as '700' or '400italic'.
+	 */
+	private function get_customizer_local_variants(): array {
+		if ( ! doing_action( 'customize_controls_enqueue_scripts' ) || ! self::should_load_fonts_locally() ) {
+			return array();
+		}
+
+		return self::get_downloaded_font_faces()['variants'];
+	}
+
 	/**
 	 * Will register fonts for the editor preview (mobile|tablet)
 	 */
@@ -298,28 +321,13 @@ public function add_rel_preload( $html, $handle ) {
 	 * @return void
 	 */
 	public function load_external_fonts_locally() {
-
-		$toggle = get_option( Config::OPTION_LOCAL_GOOGLE_FONTS_HOSTING, false );
-
-		/**
-		 * Filters whether the remote fonts should be hosted locally.
-		 *
-		 * This filter applies for both Google Fonts and Typekit Fonts if the Typekit module is used.
-		 *
-		 * @param bool $should_enqueue_locally Whether the Google Fonts should be hosted locally. Default value is false.
-		 *
-		 * @since 2.11
-		 */
-		$should_enqueue_locally = apply_filters( 'neve_load_remote_fonts_locally', $toggle );
-
-		if ( ! (bool) $should_enqueue_locally ) {
+		if ( ! self::should_load_fonts_locally() ) {
 			return;
 		}
 
 		$is_admin_context = is_admin() || is_customize_preview();
-		$wptt_vendor_file = trailingslashit( get_template_directory() ) . 'vendor/wptt/webfont-loader/wptt-webfont-loader.php';
 
-		if ( $is_admin_context || ! is_readable( $wptt_vendor_file ) ) {
+		if ( $is_admin_context || ! self::require_webfont_loader() ) {
 			return;
 		}
 
@@ -381,16 +389,6 @@ public function load_external_fonts_locally() {
 
 		$external_fonts = array_unique( $external_fonts );
 
-		require_once $wptt_vendor_file;
-
-		/**
-		 * The vendor file was readable at the top of this method, but confirm it
-		 * actually declared the loader before dequeuing anything.
-		 */
-		if ( ! function_exists( 'wptt_get_webfont_styles' ) ) {
-			return;
-		}
-
 		// Dequeue these handles since we are going to load the fonts locally.
 		foreach ( array_unique( $handles ) as $handle ) {
 			wp_dequeue_style( $handle );
@@ -402,4 +400,116 @@ public function load_external_fonts_locally() {
 
 	}
 
+	/**
+	 * Whether remote fonts should be hosted locally.
+	 *
+	 * @return bool
+	 */
+	public static function should_load_fonts_locally(): bool {
+		$toggle = get_option( Config::OPTION_LOCAL_GOOGLE_FONTS_HOSTING, false );
+
+		/**
+		 * Filters whether the remote fonts should be hosted locally.
+		 *
+		 * This filter applies for both Google Fonts and Typekit Fonts if the Typekit module is used.
+		 *
+		 * @param bool $should_enqueue_locally Whether the Google Fonts should be hosted locally. Default value is false.
+		 *
+		 * @since 2.11
+		 */
+		return (bool) apply_filters( 'neve_load_remote_fonts_locally', $toggle );
+	}
+
+	/**
+	 * Get the font faces already downloaded for local hosting.
+	 *
+	 * Only reads the existing cache, so nothing is downloaded outside the frontend.
+	 *
+	 * @return array{css: string, variants: array<string, list<string>>} Variants keyed by font family.
+	 */
+	public static function get_downloaded_font_faces(): array {
+		$faces = array(
+			'css'      => '',
+			'variants' => array(),
+		);
+
+		if ( ! self::require_webfont_loader() ) {
+			return $faces;
+		}
+
+		global $wp_filesystem;
+
+		// The loader uses $wp_filesystem without checking it was set up or connected.
+		if ( ! $wp_filesystem ) {
+			require_once ABSPATH . 'wp-admin/includes/file.php';
+			WP_Filesystem();
+		}
+
+		if ( ! $wp_filesystem instanceof \WP_Filesystem_Base || $wp_filesystem->errors->has_errors() ) {
+			return $faces;
+		}
+
+		$stylesheets = glob( ( new \WPTT_WebFont_Loader() )->get_fonts_folder() . '/*.css' );
+
+		if ( empty( $stylesheets ) ) {
+			return $faces;
+		}
+
+		foreach ( $stylesheets as $stylesheet ) {
+			$css = (string) $wp_filesystem->get_contents( $stylesheet );
+
+			$faces['css']     .= $css;
+			$faces['variants'] = array_merge_recursive( $faces['variants'], self::get_font_face_variants( $css ) );
+		}
+
+		$faces['variants'] = array_map(
+			function ( array $variants ): array {
+				return array_values( array_unique( $variants ) );
+			},
+			$faces['variants']
+		);
+
+		return $faces;
+	}
+
+	/**
+	 * Get the variants each @font-face rule in a stylesheet declares.
+	 *
+	 * @param string $css Stylesheet contents.
+	 *
+	 * @return array<string, list<string>> Font family => variants such as '700' or '400italic'.
+	 */
+	private static function get_font_face_variants( string $css ): array {
+		$variants = array();
+
+		foreach ( explode( '@font-face', $css ) as $face ) {
+			if ( ! preg_match( '/font-family:\s*[\'"]?([^;\'"]+)/', $face, $family ) ) {
+				continue;
+			}
+
+			$weight = preg_match( '/font-weight:\s*(\d+)/', $face, $matches ) ? $matches[1] : '400';
+			$italic = preg_match( '/font-style:\s*italic/', $face ) ? 'italic' : '';
+
+			$variants[ trim( $family[1] ) ][] = $weight . $italic;
+		}
+
+		return $variants;
+	}
+
+	/**
+	 * Load the bundled webfont loader.
+	 *
+	 * @return bool Whether the loader is available.
+	 */
+	private static function require_webfont_loader(): bool {
+		$file = trailingslashit( get_template_directory() ) . 'vendor/wptt/webfont-loader/wptt-webfont-loader.php';
+
+		if ( ! is_readable( $file ) ) {
+			return false;
+		}
+
+		require_once $file;
+
+		return class_exists( '\WPTT_WebFont_Loader' ) && function_exists( 'wptt_get_webfont_styles' );
+	}
 }
diff --git a/inc/views/nav_walker.php b/inc/views/nav_walker.php
index 197c0e3a43..6ce97948c0 100644
--- a/inc/views/nav_walker.php
+++ b/inc/views/nav_walker.php
@@ -120,9 +120,7 @@ public function add_caret( $title, $item, $args, $depth ) {
 			// neighbouring item would overlap (obscure) the touch target.
 			$caret_wrap_css = $caret_settings['side'] === 'right' ? 'margin-left:-3px;' : 'margin-right:-3px;';
 
-			// wp_pre_kses_less_than() first, so strip_tags() does not read a title like "Kids <12" as a tag.
-			/* translators: %s: menu item title */
-			$toggle_aria_label = sprintf( __( '%s submenu', 'neve' ), wp_strip_all_tags( wp_pre_kses_less_than( $item->title ), true ) ); // @phpstan-ignore-line title is defined on WP_Post object that is used as Menu Item.
+			$toggle_aria_label = self::get_submenu_toggle_label( $item );
 
 			$is_sidebar_item = strpos( $args->menu_id, 'sidebar' ) !== false;
 			$is_expanded     = $is_sidebar_item && apply_filters( 'neve_first_level_expanded', false ) && $depth === 0;
@@ -144,6 +142,25 @@ public function add_caret( $title, $item, $args, $depth ) {
 		return $title;
 	}
 
+	/**
+	 * Accessible name of the toggle that opens an item's submenu.
+	 *
+	 * @param \WP_Post $item menu item object.
+	 *
+	 * @return string Plain text; escape for the output context.
+	 */
+	public static function get_submenu_toggle_label( $item ): string {
+		// wp_pre_kses_less_than() first, so strip_tags() does not read a title like "Kids <12" as a tag.
+		$title = wp_strip_all_tags( wp_pre_kses_less_than( $item->title ?? '' ), true ); // @phpstan-ignore-line title is defined on WP_Post object that is used as Menu Item.
+
+		if ( $title === '' ) {
+			return __( 'Submenu', 'neve' );
+		}
+
+		/* translators: %s: menu item title */
+		return sprintf( __( '%s submenu', 'neve' ), $title );
+	}
+
 	/**
 	 * Get submenu icon.
 	 *
diff --git a/inc/views/pluggable/metabox_settings.php b/inc/views/pluggable/metabox_settings.php
index 3f449cebc4..1dbdc7d95a 100644
--- a/inc/views/pluggable/metabox_settings.php
+++ b/inc/views/pluggable/metabox_settings.php
@@ -258,7 +258,7 @@ public function get_title_disabled() {
 	/**
 	 * Get content width, if any.
 	 *
-	 * @return int|bool Content width.
+	 * @return int|false Content width.
 	 */
 	public function get_content_width() {
 		$post_id = $this->get_post_id();
@@ -273,7 +273,7 @@ public function get_content_width() {
 			return false;
 		}
 
-		return get_post_meta( $post_id, self::CONTENT_WIDTH, true );
+		return absint( get_post_meta( $post_id, self::CONTENT_WIDTH, true ) );
 
 	}
 
diff --git a/inc/views/scroll_to_top.php b/inc/views/scroll_to_top.php
index 634cf09a94..758fc1c69e 100644
--- a/inc/views/scroll_to_top.php
+++ b/inc/views/scroll_to_top.php
@@ -22,7 +22,9 @@ class Scroll_To_Top extends Base_View {
 	public function init() {
 		add_action( 'wp_footer', array( $this, 'render_button' ) );
 		add_action( 'wp_enqueue_scripts', array( $this, 'enqueue_scripts' ) );
-		add_action( 'neve_before_header_hook', array( $this, 'scroll_to_top_amp' ) );
+		// Printed outside the header, because the button is hidden until one of these
+		// animations shows it, and the button stays on the page when the header is turned off.
+		add_action( 'neve_before_header_wrapper_hook', array( $this, 'scroll_to_top_amp' ) );
 	}
 
 	/**
@@ -39,7 +41,10 @@ public function scroll_to_top_amp() {
 			return;
 		}
 
-		echo '<amp-position-observer on="enter:hideAnim.start; exit:showAnim.start" layout="nodisplay"></amp-position-observer>';
+		// The observer watches its own parent unless it is given a target. Its parent here is
+		// the page wrapper, which is never out of the viewport, so it watches this anchor instead.
+		echo '<div id="nv-scroll-to-top-anchor"></div>';
+		echo '<amp-position-observer target="nv-scroll-to-top-anchor" on="enter:hideAnim.start; exit:showAnim.start" layout="nodisplay"></amp-position-observer>';
 
 		// We use 2 `amp-animation` elements to trigger the visibility of the button. The first one is for making the button visible
 		echo '
diff --git a/inc/views/tweaks.php b/inc/views/tweaks.php
index 5860508b67..683c89894f 100644
--- a/inc/views/tweaks.php
+++ b/inc/views/tweaks.php
@@ -17,5 +17,29 @@ class Tweaks extends Base_View {
 	public function init() {
 		// Remove gallery default style.
 		add_filter( 'use_default_gallery_style', '__return_false' );
+		add_filter( 'neve_filter_toggle_content_parts', array( $this, 'filter_global_visibility' ), 200, 2 );
+	}
+
+	/**
+	 * Hide the header or the footer when they are turned off for the whole site.
+	 *
+	 * Runs after the post meta filter, because the metabox writes 'off' by default and
+	 * that value cannot tell an untouched post from a deliberate one.
+	 *
+	 * @param bool   $status Whether the part is rendered or not.
+	 * @param string $context The part name.
+	 *
+	 * @return bool
+	 */
+	public function filter_global_visibility( $status, $context ) {
+		if ( $context !== 'header' && $context !== 'footer' ) {
+			return $status;
+		}
+
+		if ( get_theme_mod( 'neve_disable_' . $context, false ) ) {
+			return false;
+		}
+
+		return $status;
 	}
 }
diff --git a/tests/fixtures/trait-submenu-nav-menu.php b/tests/fixtures/trait-submenu-nav-menu.php
new file mode 100644
index 0000000000..bd0f722973
--- /dev/null
+++ b/tests/fixtures/trait-submenu-nav-menu.php
@@ -0,0 +1,61 @@
+<?php
+/**
+ * Menu fixture shared by the submenu toggle tests.
+ *
+ * @package neve
+ */
+
+/**
+ * Trait NeveSubmenuNavMenuFixture
+ */
+trait NeveSubmenuNavMenuFixture {
+
+	/**
+	 * Render a menu through the Neve walker whose only parent item has one child.
+	 *
+	 * @param string $parent_title Title of the parent item.
+	 * @param string $menu_id      `menu_id` passed to wp_nav_menu(); the walker branches on it.
+	 *
+	 * @return array{html: string, parent_id: int}
+	 */
+	private function render_submenu_nav_menu( string $parent_title, string $menu_id ): array {
+		$nav_menu  = wp_create_nav_menu( 'Submenu Fixture ' . wp_generate_password( 6, false ) );
+		$parent_id = wp_update_nav_menu_item(
+			$nav_menu,
+			0,
+			array(
+				'menu-item-title'  => $parent_title,
+				'menu-item-url'    => home_url( '/shop/' ),
+				'menu-item-type'   => 'custom',
+				'menu-item-status' => 'publish',
+			)
+		);
+		wp_update_nav_menu_item(
+			$nav_menu,
+			0,
+			array(
+				'menu-item-title'     => 'Cart',
+				'menu-item-url'       => home_url( '/cart/' ),
+				'menu-item-type'      => 'custom',
+				'menu-item-status'    => 'publish',
+				'menu-item-parent-id' => $parent_id,
+			)
+		);
+
+		$html = wp_nav_menu(
+			array(
+				'menu'        => $nav_menu,
+				'menu_id'     => $menu_id,
+				'container'   => '',
+				'echo'        => false,
+				'fallback_cb' => false,
+				'walker'      => new \Neve\Views\Nav_Walker(),
+			)
+		);
+
+		return array(
+			'html'      => (string) $html,
+			'parent_id' => (int) $parent_id,
+		);
+	}
+}
diff --git a/tests/stubs/amp.php b/tests/stubs/amp.php
new file mode 100644
index 0000000000..3b4516df33
--- /dev/null
+++ b/tests/stubs/amp.php
@@ -0,0 +1,20 @@
+<?php
+/**
+ * Minimal AMP stub, so the theme can be asked to render an AMP request.
+ *
+ * `neve_is_amp()` looks for this function; it reports whatever the test asked for
+ * and stays false for every test that does not care.
+ *
+ * @package neve
+ */
+
+if ( ! function_exists( 'is_amp_endpoint' ) ) {
+	/**
+	 * Whether the current test asked for an AMP request.
+	 *
+	 * @return bool
+	 */
+	function is_amp_endpoint() {
+		return ! empty( $GLOBALS['neve_tests_is_amp'] );
+	}
+}
diff --git a/tests/stubs/woocommerce-cart.php b/tests/stubs/woocommerce-cart.php
index d74b2f1f43..9aa27c6442 100644
--- a/tests/stubs/woocommerce-cart.php
+++ b/tests/stubs/woocommerce-cart.php
@@ -185,3 +185,36 @@ function wc_get_page_id( $page ) {
 		return -1;
 	}
 }
+
+if ( ! function_exists( 'is_woocommerce' ) ) {
+	/**
+	 * Stand-in for the WooCommerce page conditional tag.
+	 *
+	 * @return bool
+	 */
+	function is_woocommerce() {
+		return false;
+	}
+}
+
+if ( ! function_exists( 'is_product' ) ) {
+	/**
+	 * Stand-in for the single product conditional tag.
+	 *
+	 * @return bool
+	 */
+	function is_product() {
+		return false;
+	}
+}
+
+if ( ! function_exists( 'is_account_page' ) ) {
+	/**
+	 * Stand-in for the account page conditional tag.
+	 *
+	 * @return bool
+	 */
+	function is_account_page() {
+		return false;
+	}
+}
diff --git a/tests/test-elementor-compatibility.php b/tests/test-elementor-compatibility.php
index 6dc7d7b69a..2cc4d4cd78 100644
--- a/tests/test-elementor-compatibility.php
+++ b/tests/test-elementor-compatibility.php
@@ -183,4 +183,32 @@ public function test_global_colors_front_end_passes_through_not_found_on_typogra
 
 		$this->assertSame( $error, $elementor->alter_global_colors_front_end( $error, [], $request ) );
 	}
+
+	/**
+	 * A stored custom color with HTML reaches the Elementor palette inline style without tags.
+	 */
+	public function test_enqueue_strips_html_from_palette_style(): void {
+		$previous_styles      = $GLOBALS['wp_styles'] ?? null;
+		$GLOBALS['wp_styles'] = new WP_Styles();
+
+		try {
+			wp_register_style( 'neve-style', false );
+
+			$this->get_elementor_compat(
+				[
+					'custom-1' => [
+						'label' => 'Custom',
+						'val'   => 'linear-gradient(red,blue)</style><script>alert(1)</script>',
+					],
+				]
+			)->enqueue();
+
+			$inline = implode( '', (array) wp_styles()->get_data( 'neve-style', 'after' ) );
+
+			$this->assertStringContainsString( '--e-global-color-custom1:linear-gradient(red,blue)', $inline );
+			$this->assertStringNotContainsString( '<', $inline );
+		} finally {
+			$GLOBALS['wp_styles'] = $previous_styles;
+		}
+	}
 }
diff --git a/tests/test-neve-amp-submenu-aria-label.php b/tests/test-neve-amp-submenu-aria-label.php
new file mode 100644
index 0000000000..d72fefbfff
--- /dev/null
+++ b/tests/test-neve-amp-submenu-aria-label.php
@@ -0,0 +1,70 @@
+<?php
+/**
+ * Tests for the accessible name of the AMP submenu toggle.
+ *
+ * @package neve
+ */
+
+require_once __DIR__ . '/fixtures/trait-submenu-nav-menu.php';
+
+if ( ! function_exists( 'amp_is_request' ) ) {
+	/**
+	 * Stand-in for the AMP plugin, driven by the test flag.
+	 *
+	 * @return bool
+	 */
+	function amp_is_request() {
+		return ! empty( $GLOBALS['neve_test_amp_request'] );
+	}
+}
+
+/**
+ * Class TestNeveAmpSubmenuAriaLabel
+ */
+class TestNeveAmpSubmenuAriaLabel extends WP_UnitTestCase {
+	use NeveSubmenuNavMenuFixture;
+
+	/**
+	 * Serve the request as AMP and register the theme's AMP hooks.
+	 *
+	 * @return void
+	 */
+	public function set_up(): void {
+		parent::set_up();
+		wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
+		$GLOBALS['neve_test_amp_request'] = true;
+		( new \Neve\Compatibility\Amp() )->register_hooks();
+	}
+
+	/**
+	 * The parent test case restores the hooks registered above.
+	 *
+	 * @return void
+	 */
+	public function tear_down(): void {
+		unset( $GLOBALS['neve_test_amp_request'] );
+		parent::tear_down();
+	}
+
+	/**
+	 * The AMP toggle is named after its menu item.
+	 *
+	 * @return void
+	 */
+	public function test_amp_submenu_toggle_is_named_after_its_item(): void {
+		$html = $this->render_submenu_nav_menu( 'Shop <b>Now</b>', 'nv-primary-navigation-1' )['html'];
+
+		$this->assertMatchesRegularExpression( '/<div class="caret-wrap amp-caret-wrap"[^>]* aria-label="Shop Now submenu"/', $html );
+	}
+
+	/**
+	 * An item without a title still gets a non-empty name.
+	 *
+	 * @return void
+	 */
+	public function test_amp_submenu_toggle_has_a_fallback_name_for_an_empty_title(): void {
+		$html = $this->render_submenu_nav_menu( '', 'nv-primary-navigation-1' )['html'];
+
+		$this->assertMatchesRegularExpression( '/<div class="caret-wrap amp-caret-wrap"[^>]* aria-label="Submenu"/', $html );
+	}
+}
diff --git a/tests/test-neve-css-style-tags.php b/tests/test-neve-css-style-tags.php
new file mode 100644
index 0000000000..944e6c6ef4
--- /dev/null
+++ b/tests/test-neve-css-style-tags.php
@@ -0,0 +1,164 @@
+<?php
+/**
+ * Tests that stored color values cannot break out of generated style tags.
+ *
+ * @package neve
+ */
+
+use HFG\Core\Components\Abstract_Component;
+use HFG\Main;
+use Neve\Core\Dynamic_Css;
+use Neve\Core\Settings\Config;
+use Neve\Core\Settings\Mods;
+
+/**
+ * Class TestNeveCssStyleTags
+ */
+class TestNeveCssStyleTags extends WP_UnitTestCase {
+
+	const PAYLOAD = 'linear-gradient(red,blue)</style><script>alert(1)</script>';
+
+	/**
+	 * Previous global Customizer manager.
+	 *
+	 * @var WP_Customize_Manager|null
+	 */
+	private ?WP_Customize_Manager $previous_customize;
+
+	/**
+	 * Previous global styles registry.
+	 *
+	 * @var WP_Styles|null
+	 */
+	private ?WP_Styles $previous_styles;
+
+	/**
+	 * Previous component CSS render flag.
+	 *
+	 * @var bool
+	 */
+	private bool $previous_should_show_css;
+
+	/**
+	 * Store the global state the tests replace.
+	 */
+	public function set_up(): void {
+		parent::set_up();
+
+		$this->previous_customize       = $GLOBALS['wp_customize'] ?? null;
+		$this->previous_styles          = $GLOBALS['wp_styles'] ?? null;
+		$this->previous_should_show_css = Abstract_Component::$should_show_css;
+
+		Mods::$no_cache = true;
+	}
+
+	/**
+	 * Restore the replaced global state.
+	 */
+	public function tear_down(): void {
+		$GLOBALS['wp_customize']               = $this->previous_customize;
+		$GLOBALS['wp_styles']                  = $this->previous_styles;
+		Abstract_Component::$should_show_css   = $this->previous_should_show_css;
+		Mods::$no_cache                        = false;
+
+		remove_theme_mod( 'custom_html_color' );
+		remove_theme_mod( 'hfg_header_layout_main_background' );
+		remove_theme_mod( Config::MODS_GLOBAL_CUSTOM_COLORS );
+		remove_theme_mod( Config::MODS_GLOBAL_COLORS );
+
+		parent::tear_down();
+	}
+
+	/**
+	 * A stored component color with HTML is printed without tags in the Customizer preview.
+	 */
+	public function test_component_css_strips_html_in_customizer_preview(): void {
+		require_once ABSPATH . WPINC . '/class-wp-customize-manager.php';
+
+		$GLOBALS['wp_customize'] = new WP_Customize_Manager();
+		$GLOBALS['wp_customize']->start_previewing_theme();
+
+		set_theme_mod( 'custom_html_color', self::PAYLOAD );
+		Abstract_Component::$should_show_css = true;
+
+		$component = Main::get_instance()->get_builder( 'header' )->get_component( 'custom_html' );
+		$this->assertInstanceOf( Abstract_Component::class, $component );
+
+		ob_start();
+		$component->render_css();
+		$output = (string) ob_get_clean();
+
+		$this->assertStringContainsString( '--color: linear-gradient(red,blue);', $output );
+		$this->assertStringNotContainsString( '<script', $output );
+		$this->assertSame( 1, substr_count( $output, '</style>' ) );
+	}
+
+	/**
+	 * A stored custom color with HTML reaches the frontend inline style without tags.
+	 */
+	public function test_frontend_inline_style_strips_html(): void {
+		$GLOBALS['wp_styles'] = new WP_Styles();
+		wp_register_style( Dynamic_Css::FRONTEND_HANDLE, false );
+
+		set_theme_mod(
+			Config::MODS_GLOBAL_CUSTOM_COLORS,
+			[
+				'custom-1' => [
+					'label' => 'Custom',
+					'val'   => self::PAYLOAD,
+				],
+			]
+		);
+
+		( new Dynamic_Css() )->enqueue();
+
+		$inline = implode( '', (array) wp_styles()->get_data( Dynamic_Css::FRONTEND_HANDLE, 'after' ) );
+
+		$this->assertStringContainsString( '--custom-1:linear-gradient(red,blue)', $inline );
+		$this->assertStringNotContainsString( '<', $inline );
+		$this->assertStringContainsString( '.alignfull > [class*="__inner-container"]', $inline );
+	}
+
+	/**
+	 * A stored palette color with HTML reaches the Customizer CSS vars tag without tags.
+	 */
+	public function test_customizer_css_vars_tag_strips_html(): void {
+		$GLOBALS['wp_styles'] = new WP_Styles();
+
+		$global = neve_get_global_colors_default();
+		$global['palettes'][ $global['activePalette'] ]['colors']['nv-primary-accent'] = self::PAYLOAD;
+		set_theme_mod( Config::MODS_GLOBAL_COLORS, $global );
+
+		( new Dynamic_Css() )->add_customize_vars_tag();
+
+		$inline = implode( '', (array) wp_styles()->get_data( 'nv-css-vars', 'after' ) );
+
+		$this->assertStringContainsString( '--nv-primary-accent:linear-gradient(red,blue)', $inline );
+		$this->assertStringNotContainsString( '<', $inline );
+	}
+
+	/**
+	 * A stored row background with HTML is printed without tags in the Customizer preview.
+	 */
+	public function test_builder_css_strips_html_in_customizer_preview(): void {
+		require_once ABSPATH . WPINC . '/class-wp-customize-manager.php';
+
+		$GLOBALS['wp_customize'] = new WP_Customize_Manager();
+		$GLOBALS['wp_customize']->start_previewing_theme();
+
+		set_theme_mod(
+			'hfg_header_layout_main_background',
+			[
+				'type'       => 'color',
+				'colorValue' => self::PAYLOAD,
+			]
+		);
+
+		ob_start();
+		Main::get_instance()->get_builder( 'header' )->render();
+		$output = (string) ob_get_clean();
+
+		$this->assertStringContainsString( '--bgcolor: linear-gradient(red,blue);', $output );
+		$this->assertStringNotContainsString( '<script', $output );
+	}
+}
diff --git a/tests/test-neve-global-header-footer.php b/tests/test-neve-global-header-footer.php
new file mode 100644
index 0000000000..1732a60021
--- /dev/null
+++ b/tests/test-neve-global-header-footer.php
@@ -0,0 +1,803 @@
+<?php
+/**
+ * Tests for the global header and footer visibility toggles.
+ *
+ * @package neve
+ */
+
+/**
+ * Class TestNeveGlobalHeaderFooter
+ */
+class TestNeveGlobalHeaderFooter extends WP_UnitTestCase {
+
+	/**
+	 * Customizer manager in place before the test replaced it.
+	 *
+	 * @var WP_Customize_Manager|null
+	 */
+	private $previous_customizer;
+
+	/**
+	 * Setup.
+	 */
+	public function setUp(): void {
+		parent::setUp();
+
+		// The test case restores the hooks and rolls back the database, but it leaves
+		// this global alone.
+		$this->previous_customizer = isset( $GLOBALS['wp_customize'] ) ? $GLOBALS['wp_customize'] : null;
+
+		// Another test in the suite declares the WooCommerce class; the theme then
+		// calls the conditional tags that come with it.
+		require_once __DIR__ . '/stubs/woocommerce-cart.php';
+		require_once __DIR__ . '/stubs/amp.php';
+
+		$this->mark_header_and_footer_hooks();
+	}
+
+	/**
+	 * Teardown.
+	 */
+	public function tearDown(): void {
+		if ( $this->previous_customizer === null ) {
+			unset( $GLOBALS['wp_customize'] );
+		} else {
+			$GLOBALS['wp_customize'] = $this->previous_customizer;
+		}
+
+		unset( $GLOBALS['neve_tests_is_amp'] );
+		remove_theme_mod( 'neve_disable_header' );
+		remove_theme_mod( 'neve_disable_footer' );
+		remove_theme_mod( 'neve_migrated_builders' );
+
+		parent::tearDown();
+	}
+
+	/**
+	 * Print a marker on each header and footer hook, so the tests can tell which ones ran.
+	 *
+	 * @return void
+	 */
+	private function mark_header_and_footer_hooks() {
+		$hooks = array(
+			'neve_before_header_wrapper_hook',
+			'neve_before_header_hook',
+			'neve_do_header',
+			'neve_after_header_hook',
+			'neve_after_header_wrapper_hook',
+			'neve_before_footer_hook',
+			'neve_do_footer',
+			'neve_after_footer_hook',
+		);
+
+		foreach ( $hooks as $hook ) {
+			add_action(
+				$hook,
+				function () use ( $hook ) {
+					echo '[' . esc_html( $hook ) . ']';
+				}
+			);
+		}
+	}
+
+	/**
+	 * Render the theme header.
+	 *
+	 * @return string
+	 */
+	private function render_header() {
+		// Keep the markup under test free of whatever plugins print in the head.
+		remove_all_actions( 'wp_head' );
+
+		ob_start();
+		load_template( get_theme_file_path( 'header.php' ), false );
+
+		return (string) ob_get_clean();
+	}
+
+	/**
+	 * Render the theme footer.
+	 *
+	 * @return string
+	 */
+	private function render_footer() {
+		remove_all_actions( 'wp_footer' );
+
+		ob_start();
+		load_template( get_theme_file_path( 'footer.php' ), false );
+
+		return (string) ob_get_clean();
+	}
+
+	/**
+	 * Make a published page that carries meta.
+	 *
+	 * @param array<string, string> $meta Meta keys and values.
+	 *
+	 * @return int
+	 */
+	private function make_page( $meta = array() ) {
+		$page_id = self::factory()->post->create(
+			array(
+				'post_type'   => 'page',
+				'post_status' => 'publish',
+			)
+		);
+
+		foreach ( $meta as $key => $value ) {
+			update_post_meta( $page_id, $key, $value );
+		}
+
+		return $page_id;
+	}
+
+	/**
+	 * Whether the part is rendered.
+	 *
+	 * @param string $context The part name.
+	 *
+	 * @return bool
+	 */
+	private function renders( $context ) {
+		return apply_filters( 'neve_filter_toggle_content_parts', true, $context );
+	}
+
+	/**
+	 * The parts this feature covers.
+	 *
+	 * @return array<string, array{'header'|'footer'}>
+	 */
+	public function header_and_footer() {
+		return array(
+			'header' => array( 'header' ),
+			'footer' => array( 'footer' ),
+		);
+	}
+
+	/*
+	|--------------------------------------------------------------------------
+	| What the toggle decides
+	|--------------------------------------------------------------------------
+	*/
+
+	/**
+	 * The header and the footer are rendered when no global toggle is set.
+	 */
+	public function test_header_and_footer_render_by_default() {
+		$this->assertTrue( $this->renders( 'header' ) );
+		$this->assertTrue( $this->renders( 'footer' ) );
+	}
+
+	/**
+	 * Each toggle hides its own part and leaves the other one alone.
+	 *
+	 * @param string $part The part name.
+	 *
+	 * @dataProvider header_and_footer
+	 */
+	public function test_each_toggle_hides_only_its_own_part( $part ) {
+		$other = $part === 'header' ? 'footer' : 'header';
+		set_theme_mod( 'neve_disable_' . $part, true );
+
+		$this->assertFalse( $this->renders( $part ) );
+		$this->assertTrue( $this->renders( $other ) );
+	}
+
+	/**
+	 * The toggles leave every other content part alone.
+	 */
+	public function test_other_content_parts_are_untouched() {
+		set_theme_mod( 'neve_disable_header', true );
+		set_theme_mod( 'neve_disable_footer', true );
+
+		$this->assertTrue( $this->renders( 'title' ) );
+		$this->assertTrue( $this->renders( 'featured-image' ) );
+		$this->assertFalse( apply_filters( 'neve_filter_toggle_content_parts', false, 'sidebar' ) );
+	}
+
+	/*
+	|--------------------------------------------------------------------------
+	| The toggle against the post meta
+	|--------------------------------------------------------------------------
+	*/
+
+	/**
+	 * The global toggle wins over a page that carries the default meta value.
+	 *
+	 * The metabox stores 'off' both for an untouched page and for one that was turned on
+	 * and off again, so 'off' must not count as a deliberate opt in.
+	 *
+	 * @param string $part The part name.
+	 *
+	 * @dataProvider header_and_footer
+	 */
+	public function test_global_toggle_wins_over_an_off_meta_value( $part ) {
+		set_theme_mod( 'neve_disable_' . $part, true );
+		$this->go_to( get_permalink( $this->make_page( array( 'neve_meta_disable_' . $part => 'off' ) ) ) );
+
+		$this->assertFalse( $this->renders( $part ) );
+	}
+
+	/**
+	 * A single page still turns the parts off on its own.
+	 *
+	 * @param string $part The part name.
+	 *
+	 * @dataProvider header_and_footer
+	 */
+	public function test_post_meta_still_disables_a_part_on_its_own( $part ) {
+		$this->go_to( get_permalink( $this->make_page( array( 'neve_meta_disable_' . $part => 'on' ) ) ) );
+
+		$this->assertFalse( $this->renders( $part ) );
+	}
+
+	/**
+	 * Meta on one page does not leak to another.
+	 */
+	public function test_meta_does_not_leak_between_pages() {
+		$with_meta = $this->make_page( array( 'neve_meta_disable_header' => 'on' ) );
+		$plain     = $this->make_page();
+
+		$this->go_to( get_permalink( $with_meta ) );
+		$this->assertFalse( $this->renders( 'header' ) );
+
+		$this->go_to( get_permalink( $plain ) );
+		$this->assertTrue( $this->renders( 'header' ) );
+	}
+
+	/**
+	 * The global toggle reaches the views that have no metabox.
+	 *
+	 * @param string $context The view to open.
+	 *
+	 * @dataProvider views_without_a_metabox
+	 */
+	public function test_global_toggle_reaches_views_without_a_metabox( $context ) {
+		$post_id = self::factory()->post->create( array( 'post_status' => 'publish' ) );
+
+		if ( $context === 'category' ) {
+			$category_id = self::factory()->category->create();
+			wp_set_post_categories( $post_id, array( $category_id ) );
+			$url = get_category_link( $category_id );
+		} else {
+			$url = home_url( '/?s=neve' );
+		}
+
+		set_theme_mod( 'neve_disable_header', true );
+		$this->go_to( $url );
+
+		// Guard the fixture: the assertion only means something in the right view.
+		$this->assertFalse( is_singular(), 'The metabox covers singular views, this must not be one.' );
+		$this->assertFalse( $this->renders( 'header' ) );
+	}
+
+	/**
+	 * Views the metabox never reached.
+	 *
+	 * @return array<string, array{'category'|'search'}>
+	 */
+	public function views_without_a_metabox() {
+		return array(
+			'category archive' => array( 'category' ),
+			'search results'   => array( 'search' ),
+		);
+	}
+
+	/*
+	|--------------------------------------------------------------------------
+	| The markup
+	|--------------------------------------------------------------------------
+	*/
+
+	/**
+	 * The header wrapper is rendered when the header is on.
+	 */
+	public function test_header_wrapper_is_rendered_when_enabled() {
+		$markup = $this->render_header();
+
+		$this->assertStringContainsString( '<header', $markup );
+		$this->assertStringContainsString( '[neve_do_header]', $markup );
+	}
+
+	/**
+	 * Leave nothing hooked right before and right after the header, the way a site without Neve Pro is.
+	 *
+	 * @return void
+	 */
+	private function unhook_around_the_header() {
+		remove_all_actions( 'neve_before_header_hook' );
+		remove_all_actions( 'neve_after_header_hook' );
+	}
+
+	/**
+	 * Turn the header off globally or for the current page.
+	 *
+	 * @return array<string, array{'global'|'meta'}>
+	 */
+	public function provide_header_switches() {
+		return array(
+			'global toggle' => array( 'global' ),
+			'page meta'     => array( 'meta' ),
+		);
+	}
+
+	/**
+	 * Turn the header off.
+	 *
+	 * @param string $switch Either global or meta.
+	 *
+	 * @return void
+	 */
+	private function disable_header( $switch ) {
+		if ( $switch === 'global' ) {
+			set_theme_mod( 'neve_disable_header', true );
+
+			return;
+		}
+
+		$this->go_to( get_permalink( $this->make_page( array( 'neve_meta_disable_header' => 'on' ) ) ) );
+	}
+
+	/**
+	 * A disabled header with nothing hooked around it leaves no empty wrapper behind.
+	 *
+	 * @dataProvider provide_header_switches
+	 *
+	 * @param string $switch Either global or meta.
+	 */
+	public function test_disabled_header_leaves_no_empty_wrapper_behind( $switch ) {
+		$this->unhook_around_the_header();
+		$this->disable_header( $switch );
+		$markup = $this->render_header();
+
+		$this->assertStringNotContainsString( '<header', $markup );
+		$this->assertStringNotContainsString( '[neve_do_header]', $markup );
+	}
+
+	/**
+	 * A disabled header keeps what other code prints around it, such as the Neve Pro page header.
+	 *
+	 * @dataProvider provide_header_switches
+	 *
+	 * @param string $switch Either global or meta.
+	 */
+	public function test_disabled_header_keeps_content_hooked_around_it( $switch ) {
+		$this->disable_header( $switch );
+		$markup = $this->render_header();
+
+		$this->assertStringContainsString( '<header', $markup );
+		$this->assertStringContainsString( '[neve_before_header_hook]', $markup );
+		$this->assertStringContainsString( '[neve_after_header_hook]', $markup );
+		$this->assertStringNotContainsString( '[neve_do_header]', $markup );
+	}
+
+	/**
+	 * Hooks that print only whitespace do not bring the empty wrapper back.
+	 */
+	public function test_whitespace_around_a_disabled_header_leaves_no_wrapper() {
+		$this->unhook_around_the_header();
+		add_action(
+			'neve_after_header_hook',
+			function () {
+				echo "\n\t  \n";
+			}
+		);
+		set_theme_mod( 'neve_disable_header', true );
+
+		$this->assertStringNotContainsString( '<header', $this->render_header() );
+	}
+
+	/**
+	 * On AMP the skip link hides on the pages that infinite scroll appends, as it did inside the header.
+	 */
+	public function test_the_skip_link_hides_on_appended_amp_pages() {
+		$this->assertDoesNotMatchRegularExpression( '/class="neve-skip-link[^>]*next-page-hide/', $this->render_header() );
+
+		$GLOBALS['neve_tests_is_amp'] = true;
+		set_theme_mod( 'neve_disable_header', true );
+
+		$this->assertMatchesRegularExpression( '/class="neve-skip-link[^>]*next-page-hide/', $this->render_header() );
+	}
+
+	/**
+	 * A disabled header keeps the skip link, the page skeleton and the wrapper hooks.
+	 */
+	public function test_disabled_header_keeps_the_skip_link_and_the_skeleton() {
+		set_theme_mod( 'neve_disable_header', true );
+		$markup = $this->render_header();
+
+		$this->assertStringContainsString( 'neve-skip-link', $markup );
+		$this->assertStringContainsString( '<div class="wrapper">', $markup );
+		$this->assertStringContainsString( '<main id="content"', $markup );
+		$this->assertStringContainsString( '[neve_before_header_wrapper_hook]', $markup );
+		$this->assertStringContainsString( '[neve_after_header_wrapper_hook]', $markup );
+	}
+
+	/**
+	 * The footer is rendered when it is on.
+	 */
+	public function test_footer_is_rendered_when_enabled() {
+		$this->assertStringContainsString( '[neve_do_footer]', $this->render_footer() );
+	}
+
+	/**
+	 * A disabled footer runs no footer hooks and still closes the page.
+	 */
+	public function test_disabled_footer_runs_no_hooks_and_closes_the_page() {
+		set_theme_mod( 'neve_disable_footer', true );
+		$markup = $this->render_footer();
+
+		$this->assertStringNotContainsString( '[neve_do_footer]', $markup );
+		$this->assertStringNotContainsString( '[neve_before_footer_hook]', $markup );
+		$this->assertStringContainsString( '</main>', $markup );
+		$this->assertStringContainsString( '</body>', $markup );
+	}
+
+	/*
+	|--------------------------------------------------------------------------
+	| The block theme template
+	|--------------------------------------------------------------------------
+	*/
+
+	/**
+	 * Render the header of the block theme compatibility layer on a new page.
+	 *
+	 * @param array<string, string> $meta Meta keys and values of the page.
+	 *
+	 * @return string
+	 */
+	private function render_fse_header( $meta = array() ) {
+		$fse = new \Neve\Compatibility\Fse();
+		$this->go_to( get_permalink( $this->make_page( $meta ) ) );
+
+		$template = $fse->get_template_slug();
+		$this->assertSame( 'page', $template, 'Expected the page template.' );
+		set_theme_mod( \Neve\Compatibility\Fse::FSE_ENABLED_SLUG, true );
+		set_theme_mod( 'neve_fse_' . $template, true );
+
+		ob_start();
+		$fse->handle_header();
+
+		return (string) ob_get_clean();
+	}
+
+	/**
+	 * The block theme header wrapper is rendered when the header is on.
+	 */
+	public function test_fse_header_wrapper_is_rendered_when_enabled() {
+		$markup = $this->render_fse_header();
+
+		$this->assertStringContainsString( '<header', $markup );
+		$this->assertStringContainsString( '[neve_do_header]', $markup );
+	}
+
+	/**
+	 * Render the block theme header with the header turned off globally or for the page.
+	 *
+	 * @param string $switch Either global or meta.
+	 *
+	 * @return string
+	 */
+	private function render_disabled_fse_header( $switch ) {
+		if ( $switch === 'global' ) {
+			set_theme_mod( 'neve_disable_header', true );
+
+			return $this->render_fse_header();
+		}
+
+		return $this->render_fse_header( array( 'neve_meta_disable_header' => 'on' ) );
+	}
+
+	/**
+	 * A disabled header leaves no empty wrapper behind in the block theme template either.
+	 *
+	 * @dataProvider provide_header_switches
+	 *
+	 * @param string $switch Either global or meta.
+	 */
+	public function test_fse_disabled_header_leaves_no_wrapper_behind( $switch ) {
+		$this->unhook_around_the_header();
+		$markup = $this->render_disabled_fse_header( $switch );
+
+		$this->assertStringNotContainsString( '<header', $markup );
+		$this->assertStringNotContainsString( '[neve_do_header]', $markup );
+		$this->assertStringContainsString( 'neve-skip-link', $markup );
+		$this->assertStringContainsString( '<main id="content"', $markup );
+	}
+
+	/**
+	 * A disabled header keeps what other code prints around it in the block theme template too.
+	 *
+	 * @dataProvider provide_header_switches
+	 *
+	 * @param string $switch Either global or meta.
+	 */
+	public function test_fse_disabled_header_keeps_content_hooked_around_it( $switch ) {
+		$markup = $this->render_disabled_fse_header( $switch );
+
+		$this->assertStringContainsString( '<header', $markup );
+		$this->assertStringContainsString( '[neve_after_header_hook]', $markup );
+		$this->assertStringNotContainsString( '[neve_do_header]', $markup );
+	}
+
+	/**
+	 * On AMP the block theme skip link hides on the pages that infinite scroll appends, too.
+	 */
+	public function test_the_fse_skip_link_hides_on_appended_amp_pages() {
+		$GLOBALS['neve_tests_is_amp'] = true;
+
+		$this->assertMatchesRegularExpression( '/class="neve-skip-link[^>]*next-page-hide/', $this->render_fse_header() );
+	}
+
+	/*
+	|--------------------------------------------------------------------------
+	| The customizer controls
+	|--------------------------------------------------------------------------
+	*/
+
+	/**
+	 * Run a full customizer cycle, with every other module registering too.
+	 *
+	 * The builders hook into customize_register only in the admin, so they are called directly.
+	 *
+	 * @return WP_Customize_Manager
+	 */
+	private function register_customizer() {
+		require_once ABSPATH . WPINC . '/class-wp-customize-manager.php';
+
+		global $wp_customize;
+		$wp_customize = new WP_Customize_Manager();
+
+		$loader = new \Neve\Customizer\Loader();
+		$loader->init();
+		do_action( 'customize_register', $wp_customize );
+
+		foreach ( array( 'header', 'footer' ) as $builder ) {
+			\HFG\Main::get_instance()->get_builder( $builder )->customize_register( $wp_customize );
+		}
+
+		return $wp_customize;
+	}
+
+	/**
+	 * Assert that a toggle saves a boolean and starts off.
+	 *
+	 * @param WP_Customize_Manager $wp_customize The Customize Manager.
+	 * @param string               $id           The setting id.
+	 *
+	 * @return void
+	 */
+	private function assert_toggle_setting( $wp_customize, $id ) {
+		$control = $wp_customize->get_control( $id );
+		$this->assertNotNull( $control, 'The ' . $id . ' toggle is missing.' );
+		$this->assertSame( 'neve_toggle_control', $control->type );
+
+		$setting = $wp_customize->get_setting( $id );
+		$this->assertFalse( $setting->default );
+		$this->assertSame( 'refresh', $setting->transport );
+		$this->assertTrue( $setting->sanitize( 'on' ) );
+		$this->assertFalse( $setting->sanitize( '' ) );
+	}
+
+	/**
+	 * The header toggle opens the general tab of the global header settings.
+	 */
+	public function test_the_header_toggle_sits_in_the_global_header_settings() {
+		$wp_customize = $this->register_customizer();
+
+		$this->assert_toggle_setting( $wp_customize, 'neve_disable_header' );
+
+		$section = $wp_customize->get_section( 'neve_pro_global_header_settings' );
+		$this->assertNotNull( $section );
+		$this->assertSame( 'hfg_header', $section->panel );
+		$this->assertSame( 'neve_pro_global_header_settings', $wp_customize->get_control( 'neve_disable_header' )->section );
+
+		// The tabs only show the controls they list, and the first tab is the one that opens.
+		$tabs = $wp_customize->get_control( 'neve_pro_global_header_settings_tabs' );
+		$this->assertSame( array( 'general', 'style' ), array_keys( $tabs->tabs ) );
+		$this->assertArrayHasKey( 'neve_disable_header', $tabs->controls['general'] );
+	}
+
+	/**
+	 * Sites still on the legacy builder keep both toggles.
+	 *
+	 * The legacy builder has no global header settings tabs, so the header toggle is a plain control there.
+	 */
+	public function test_the_toggles_stay_on_the_legacy_builder() {
+		set_theme_mod( 'neve_migrated_builders', false );
+
+		$wp_customize = $this->register_customizer();
+
+		$this->assert_toggle_setting( $wp_customize, 'neve_disable_header' );
+		$this->assert_toggle_setting( $wp_customize, 'neve_disable_footer' );
+
+		$section = $wp_customize->get_section( 'neve_pro_global_header_settings' );
+		$this->assertNotNull( $section );
+		$this->assertSame( 'hfg_header', $section->panel );
+		$this->assertSame( 'neve_pro_global_header_settings', $wp_customize->get_control( 'neve_disable_header' )->section );
+		$this->assertNull( $wp_customize->get_control( 'neve_pro_global_header_settings_tabs' ) );
+	}
+
+	/**
+	 * On the legacy builder, a global header settings section that Neve Pro registered first is kept.
+	 */
+	public function test_the_legacy_builder_keeps_an_existing_global_header_section() {
+		require_once ABSPATH . WPINC . '/class-wp-customize-manager.php';
+
+		set_theme_mod( 'neve_migrated_builders', false );
+
+		global $wp_customize;
+		$wp_customize = new WP_Customize_Manager();
+		$wp_customize->add_section(
+			'neve_pro_global_header_settings',
+			array(
+				'title'    => 'Registered first',
+				'priority' => 100,
+				'panel'    => 'hfg_header',
+			)
+		);
+
+		\HFG\Main::get_instance()->get_builder( 'header' )->customize_register( $wp_customize );
+
+		$section = $wp_customize->get_section( 'neve_pro_global_header_settings' );
+		$this->assertSame( 'Registered first', $section->title );
+		$this->assertSame( 100, $section->priority );
+		$this->assertSame( 'neve_pro_global_header_settings', $wp_customize->get_control( 'neve_disable_header' )->section );
+	}
+
+	/**
+	 * Sites that started before 4.0.1 and sites that started after it.
+	 *
+	 * @return array<string, array{string, bool}>
+	 */
+	public function provide_user_since_versions() {
+		return array(
+			'older site, no copyright section' => array( 'unknown', false ),
+			'newer site, copyright section'    => array( '4.2.0', true ),
+		);
+	}
+
+	/**
+	 * The footer toggle gets its own global settings section, with or without the copyright section.
+	 *
+	 * @dataProvider provide_user_since_versions
+	 *
+	 * @param string $user_since    The version the site started on.
+	 * @param bool   $has_copyright Whether the copyright section registers.
+	 */
+	public function test_the_footer_toggle_sits_in_the_global_footer_settings( $user_since, $has_copyright ) {
+		update_option( \Neve\Core\Migration_Flags::USER_SINCE_VERSION, $user_since );
+
+		$wp_customize = $this->register_customizer();
+
+		$this->assert_toggle_setting( $wp_customize, 'neve_disable_footer' );
+
+		$section = $wp_customize->get_section( 'neve_global_footer_settings' );
+		$this->assertNotNull( $section );
+		$this->assertSame( 'hfg_footer', $section->panel );
+		$this->assertSame( 'neve_global_footer_settings', $wp_customize->get_control( 'neve_disable_footer' )->section );
+
+		// The copyright section sits right above it on newer sites.
+		$this->assertSame( $has_copyright, $wp_customize->get_section( 'neve_footer_copyright_section' ) !== null );
+	}
+
+	/**
+	 * The builder panels hide every section by default, so the toggles' sections have to be named in the styles.
+	 *
+	 * Without this rule the sections register, render and stay invisible.
+	 */
+	public function test_the_sections_are_whitelisted_in_the_builder_panel_styles() {
+		$path = get_theme_file_path( 'assets/apps/customizer-controls/src/scss/_general.scss' );
+		$this->assertFileExists( $path );
+
+		$scss = file_get_contents( $path );
+
+		$panels = array(
+			'hfg_header' => 'neve_pro_global_header_settings',
+			'hfg_footer' => 'neve_global_footer_settings',
+		);
+
+		foreach ( $panels as $panel => $section ) {
+			$this->assertStringContainsString(
+				'#sub-accordion-panel-' . $panel . ' #accordion-section-' . $section,
+				(string) $scss,
+				'Sections in the builder panels stay hidden unless this rule names them.'
+			);
+		}
+	}
+	/*
+	|--------------------------------------------------------------------------
+	| Other plugins that render into the header
+	|--------------------------------------------------------------------------
+	*/
+
+	/**
+	 * The AMP state elements outlive a disabled header.
+	 *
+	 * They are printed around the header but one of them drives the WooCommerce shop
+	 * sidebar, which is still on the page when the header is gone.
+	 */
+	public function test_amp_states_survive_a_disabled_header() {
+		$this->unhook_around_the_header();
+		$GLOBALS['neve_tests_is_amp'] = true;
+		$amp                          = new \Neve\Compatibility\Amp();
+		$amp->register_hooks();
+
+		$with_header = $this->render_header();
+		$this->assertStringContainsString( '<header', $with_header );
+		$this->assertStringContainsString( 'nvAmpWooSidebarExpanded', $with_header );
+
+		set_theme_mod( 'neve_disable_header', true );
+		$without_header = $this->render_header();
+
+		$this->assertStringNotContainsString( '<header', $without_header );
+		$this->assertStringContainsString( 'nvAmpWooSidebarExpanded', $without_header );
+		$this->assertStringContainsString( 'nvAmpMenuExpanded', $without_header );
+	}
+
+	/**
+	 * The AMP scroll to top animations outlive a disabled header.
+	 *
+	 * The button is hidden until an animation shows it, so it never appears when the
+	 * animations are gone.
+	 */
+	public function test_amp_scroll_to_top_animations_survive_a_disabled_header() {
+		$this->unhook_around_the_header();
+		$GLOBALS['neve_tests_is_amp'] = true;
+		$scroll_to_top                = new \Neve\Views\Scroll_To_Top();
+		$scroll_to_top->init();
+
+		$with_header = $this->render_header();
+		$this->assertStringContainsString( '<header', $with_header );
+		$this->assertStringContainsString( 'id="showAnim"', $with_header );
+
+		set_theme_mod( 'neve_disable_header', true );
+		$without_header = $this->render_header();
+
+		$this->assertStringNotContainsString( '<header', $without_header );
+		$this->assertStringContainsString( 'id="showAnim"', $without_header );
+		$this->assertStringContainsString( 'id="hideAnim"', $without_header );
+	}
+
+	/**
+	 * The AMP position observer watches an element that scrolls out of view.
+	 *
+	 * Left without a target it watches its own parent, which is the page wrapper. The
+	 * wrapper is never out of the viewport, so the animation that shows the button
+	 * never starts.
+	 */
+	public function test_amp_scroll_to_top_observer_watches_an_element_that_scrolls_away() {
+		$GLOBALS['neve_tests_is_amp'] = true;
+		$scroll_to_top                = new \Neve\Views\Scroll_To_Top();
+		$scroll_to_top->init();
+
+		set_theme_mod( 'neve_disable_header', true );
+		$markup = $this->render_header();
+
+		$this->assertStringContainsString( 'id="nv-scroll-to-top-anchor"', $markup );
+		$this->assertStringContainsString( 'target="nv-scroll-to-top-anchor"', $markup );
+	}
+
+	/**
+	 * The AMP infinite scroll steps aside when the footer is off.
+	 *
+	 * It wraps the footer and replaces the pagination, so a page without the footer
+	 * keeps its regular pagination instead of losing both.
+	 */
+	public function test_amp_infinite_scroll_steps_aside_without_the_footer() {
+		update_option( 'posts_per_page', 1 );
+		$post_ids = self::factory()->post->create_many( 3 );
+		set_theme_mod( 'neve_pagination_type', 'infinite' );
+		set_theme_mod( 'neve_default_sidebar_layout', 'full-width' );
+
+		$this->go_to( home_url( '/' ) );
+		$GLOBALS['post'] = get_post( $post_ids[0] );
+		$amp             = new \Neve\Compatibility\Amp();
+
+		$this->assertTrue( $amp->should_display_infinite_scroll() );
+
+		set_theme_mod( 'neve_disable_footer', true );
+
+		$this->assertFalse( $amp->should_display_infinite_scroll() );
+	}
+}
diff --git a/tests/test-neve-local-font-previews.php b/tests/test-neve-local-font-previews.php
new file mode 100644
index 0000000000..0cc321d9ad
--- /dev/null
+++ b/tests/test-neve-local-font-previews.php
@@ -0,0 +1,293 @@
+<?php
+/**
+ * Tests for the customizer font previews when fonts are hosted locally.
+ *
+ * @package neve
+ */
+
+use Neve\Core\Settings\Config;
+use Neve\Views\Font_Manager;
+
+/**
+ * Class TestNeveLocalFontPreviews
+ */
+class TestNeveLocalFontPreviews extends WP_UnitTestCase {
+
+	/**
+	 * Fonts folder base path used instead of wp-content.
+	 *
+	 * @var string
+	 */
+	private $base_path;
+
+	/**
+	 * Filesystem instance to restore after each test.
+	 *
+	 * @var WP_Filesystem_Base|null
+	 */
+	private $wp_filesystem;
+
+	/**
+	 * Filesystem method WordPress resolves to in the current test.
+	 *
+	 * @var string
+	 */
+	private $filesystem_method = '';
+
+	/**
+	 * Cached stylesheet a frontend visit would have downloaded.
+	 *
+	 * @var string
+	 */
+	private $cached_css = "@font-face {\n  font-family: 'Roboto Slab';\n  font-style: normal;\n  font-weight: 400;\n  src: url(http://example.org/wp-content/fonts/roboto-slab/abc.woff2) format('woff2');\n}\n";
+
+	/**
+	 * Point the webfont loader at a fresh temporary folder.
+	 */
+	public function set_up(): void {
+		parent::set_up();
+
+		$this->base_path = get_temp_dir() . uniqid( 'neve-local-font-previews-', true );
+
+		if ( ! wp_mkdir_p( $this->base_path . '/fonts' ) ) {
+			$this->fail( 'Could not create the fonts fixture folder.' );
+		}
+
+		add_filter( 'wptt_get_local_fonts_base_path', array( $this, 'get_base_path' ) );
+		$GLOBALS['wp_styles'] = null;
+		$this->wp_filesystem  = $GLOBALS['wp_filesystem'] ?? null;
+	}
+
+	/**
+	 * Drop the fixtures and every hook, option and style the tests touched.
+	 */
+	public function tear_down(): void {
+		foreach ( glob( $this->base_path . '/fonts/*' ) as $file ) {
+			unlink( $file );
+		}
+		rmdir( $this->base_path . '/fonts' );
+		rmdir( $this->base_path );
+
+		remove_filter( 'wptt_get_local_fonts_base_path', array( $this, 'get_base_path' ) );
+		remove_filter( 'neve_load_remote_fonts_locally', '__return_true' );
+		remove_filter( 'filesystem_method', array( $this, 'get_filesystem_method' ) );
+		$GLOBALS['wp_filesystem'] = $this->wp_filesystem;
+		delete_option( Config::OPTION_LOCAL_GOOGLE_FONTS_HOSTING );
+		wp_clear_scheduled_hook( 'delete_fonts_folder' );
+		$GLOBALS['wp_styles'] = null;
+
+		parent::tear_down();
+	}
+
+	/**
+	 * Fonts folder base path.
+	 *
+	 * @return string
+	 */
+	public function get_base_path(): string {
+		return $this->base_path;
+	}
+
+	/**
+	 * Store a stylesheet the frontend local hosting would have cached.
+	 */
+	private function cache_downloaded_font(): void {
+		file_put_contents( $this->base_path . '/fonts/' . md5( 'roboto-slab' ) . '.css', $this->cached_css );
+	}
+
+	/**
+	 * Enqueue the customizer controls and return the remote preview stylesheet URLs.
+	 *
+	 * @return list<string>
+	 */
+	private function enqueue_controls(): array {
+		$fonts  = function (): array {
+			return array( 'Roboto', 'Roboto Slab', 'Lato', 'Inter', 'Arvo' );
+		};
+		$styles = wp_styles();
+
+		add_filter( 'neve_google_fonts_array', $fonts );
+
+		try {
+			( new \Neve\Customizer\Loader() )->enqueue_customizer_controls();
+		} finally {
+			remove_filter( 'neve_google_fonts_array', $fonts );
+		}
+
+		$urls = array();
+		foreach ( $styles->queue as $handle ) {
+			if ( strpos( $handle, 'neve-fonts-control-google-fonts-' ) === 0 ) {
+				$urls[] = $styles->registered[ $handle ]->src;
+			}
+		}
+
+		return $urls;
+	}
+
+	/**
+	 * Inline styles attached to the controls stylesheet.
+	 *
+	 * @return string
+	 */
+	private function get_controls_inline_css(): string {
+		return implode( "\n", (array) wp_styles()->get_data( 'react-controls', 'after' ) );
+	}
+
+	/**
+	 * Downloaded faces are previewed locally and left out of the Google requests.
+	 */
+	public function testDownloadedFontsPreviewLocally(): void {
+		update_option( Config::OPTION_LOCAL_GOOGLE_FONTS_HOSTING, true );
+		$this->cache_downloaded_font();
+
+		$urls = implode( "\n", $this->enqueue_controls() );
+
+		$this->assertStringContainsString( $this->cached_css, $this->get_controls_inline_css() );
+		$this->assertStringNotContainsString( 'Roboto Slab', $urls );
+		$this->assertStringContainsString( 'Lato', $urls );
+	}
+
+	/**
+	 * Neve Pro enables local hosting through the filter, not the option.
+	 */
+	public function testFilterEnabledLocalHostingPreviewsLocally(): void {
+		add_filter( 'neve_load_remote_fonts_locally', '__return_true' );
+		$this->cache_downloaded_font();
+
+		$urls = implode( "\n", $this->enqueue_controls() );
+
+		$this->assertStringContainsString( $this->cached_css, $this->get_controls_inline_css() );
+		$this->assertStringNotContainsString( 'Roboto Slab', $urls );
+	}
+
+	/**
+	 * Previews stay remote while local hosting is off.
+	 */
+	public function testRemotePreviewsWhenLocalHostingOff(): void {
+		$this->cache_downloaded_font();
+
+		$urls = implode( "\n", $this->enqueue_controls() );
+
+		$this->assertSame( '', $this->get_controls_inline_css() );
+		$this->assertStringContainsString( 'Roboto Slab', $urls );
+	}
+
+	/**
+	 * Filesystem method forced for the current test.
+	 *
+	 * @return string
+	 */
+	public function get_filesystem_method(): string {
+		return $this->filesystem_method;
+	}
+
+	/**
+	 * Filesystem methods that leave no usable filesystem.
+	 *
+	 * @return array{'no method': array{0: ''}, 'ftp without credentials': array{0: 'ftpext'}}
+	 */
+	public function provideUnusableFilesystems(): array {
+		return array(
+			'no method'               => array( '' ),
+			'ftp without credentials' => array( 'ftpext' ),
+		);
+	}
+
+	/**
+	 * The controls still load when the filesystem cannot be set up.
+	 *
+	 * @dataProvider provideUnusableFilesystems
+	 *
+	 * @param string $method Filesystem method WordPress resolves to.
+	 */
+	public function testRemotePreviewsWithoutFilesystem( string $method ): void {
+		update_option( Config::OPTION_LOCAL_GOOGLE_FONTS_HOSTING, true );
+		$this->cache_downloaded_font();
+
+		$GLOBALS['wp_filesystem'] = null;
+		$this->filesystem_method  = $method;
+		add_filter( 'filesystem_method', array( $this, 'get_filesystem_method' ) );
+
+		$urls = implode( "\n", $this->enqueue_controls() );
+
+		$this->assertSame( '', $this->get_controls_inline_css() );
+		$this->assertStringContainsString( 'Roboto Slab', $urls );
+	}
+
+	/**
+	 * Run the selected-font enqueue, optionally from inside the Customizer controls.
+	 *
+	 * @param bool         $in_controls Whether core is enqueueing the Customizer controls.
+	 * @param list<string> $weights     Weights selected for Roboto Slab.
+	 */
+	private function register_selected_fonts( bool $in_controls, array $weights = array( '400' ) ): void {
+		$families = Font_Manager::$font_families;
+
+		Font_Manager::$font_families = array(
+			'Roboto Slab' => $weights,
+			'Lato'        => array( '400' ),
+		);
+
+		if ( $in_controls ) {
+			$GLOBALS['wp_current_filter'][] = 'customize_controls_enqueue_scripts';
+		}
+
+		try {
+			( new Font_Manager() )->register_google_fonts();
+		} finally {
+			if ( $in_controls ) {
+				array_pop( $GLOBALS['wp_current_filter'] );
+			}
+			Font_Manager::$font_families = $families;
+		}
+	}
+
+	/**
+	 * The Customizer widgets editor does not request cached fonts from Google.
+	 */
+	public function testCustomizerSkipsRemoteSelectedFontsWhenCached(): void {
+		update_option( Config::OPTION_LOCAL_GOOGLE_FONTS_HOSTING, true );
+		$this->cache_downloaded_font();
+
+		$this->register_selected_fonts( true );
+
+		$this->assertFalse( wp_style_is( 'neve-google-font-roboto-slab', 'enqueued' ) );
+		$this->assertTrue( wp_style_is( 'neve-google-font-lato', 'enqueued' ) );
+	}
+
+	/**
+	 * A selected weight missing from the cache keeps the remote stylesheet.
+	 */
+	public function testCustomizerKeepsRemoteFontForUncachedWeight(): void {
+		update_option( Config::OPTION_LOCAL_GOOGLE_FONTS_HOSTING, true );
+		$this->cache_downloaded_font();
+
+		$this->register_selected_fonts( true, array( '700' ) );
+
+		$this->assertTrue( wp_style_is( 'neve-google-font-roboto-slab', 'enqueued' ) );
+	}
+
+	/**
+	 * Outside the Customizer controls the selected fonts are still enqueued.
+	 */
+	public function testSelectedFontsStayEnqueuedOutsideCustomizer(): void {
+		update_option( Config::OPTION_LOCAL_GOOGLE_FONTS_HOSTING, true );
+		$this->cache_downloaded_font();
+
+		$this->register_selected_fonts( false );
+
+		$this->assertTrue( wp_style_is( 'neve-google-font-roboto-slab', 'enqueued' ) );
+	}
+
+	/**
+	 * Fonts not downloaded yet keep their remote previews.
+	 */
+	public function testRemotePreviewsWithEmptyFontCache(): void {
+		update_option( Config::OPTION_LOCAL_GOOGLE_FONTS_HOSTING, true );
+
+		$urls = implode( "\n", $this->enqueue_controls() );
+
+		$this->assertSame( '', $this->get_controls_inline_css() );
+		$this->assertStringContainsString( 'Roboto Slab', $urls );
+	}
+}
diff --git a/tests/test-neve-metabox-content-width.php b/tests/test-neve-metabox-content-width.php
new file mode 100644
index 0000000000..9e781190dc
--- /dev/null
+++ b/tests/test-neve-metabox-content-width.php
@@ -0,0 +1,140 @@
+<?php
+/**
+ * Tests for the per-post content width meta.
+ *
+ * @package neve
+ */
+
+use Neve\Views\Pluggable\Metabox_Settings;
+
+/**
+ * Class TestNeveMetaboxContentWidth
+ */
+class TestNeveMetaboxContentWidth extends WP_UnitTestCase {
+
+	/**
+	 * Page carrying the content width meta.
+	 *
+	 * @var int
+	 */
+	private $page_id;
+
+	/**
+	 * Global post in place before the test replaced it.
+	 *
+	 * @var WP_Post|null
+	 */
+	private $previous_post;
+
+	/**
+	 * Global post type in place before the test replaced it.
+	 *
+	 * @var string|null
+	 */
+	private $previous_post_type;
+
+	/**
+	 * Setup.
+	 */
+	public function setUp(): void {
+		global $post, $post_type;
+
+		parent::setUp();
+
+		$this->previous_post      = $post;
+		$this->previous_post_type = $post_type;
+
+		// The test case unregisters every meta key on teardown.
+		$manager = new \Neve\Admin\Metabox\Manager();
+		$manager->neve_register_meta();
+
+		$this->page_id = self::factory()->post->create( array( 'post_type' => 'page' ) );
+
+		$post      = get_post( $this->page_id );
+		$post_type = 'page';
+
+		wp_register_style( 'neve-gutenberg-style', false, array(), '1' );
+	}
+
+	/**
+	 * Teardown.
+	 */
+	public function tearDown(): void {
+		global $post, $post_type;
+
+		$post      = $this->previous_post;
+		$post_type = $this->previous_post_type;
+
+		wp_deregister_style( 'neve-gutenberg-style' );
+
+		parent::tearDown();
+	}
+
+	/**
+	 * Store a meta value the way it sits in the database, without the registered sanitizer.
+	 *
+	 * @param string $key the meta key.
+	 * @param string $value the raw meta value.
+	 */
+	private function store_raw_meta( string $key, string $value ): void {
+		global $wpdb;
+
+		$wpdb->insert(
+			$wpdb->postmeta,
+			array(
+				'post_id'    => $this->page_id,
+				'meta_key'   => $key,
+				'meta_value' => $value,
+			)
+		);
+		wp_cache_delete( $this->page_id, 'post_meta' );
+	}
+
+	/**
+	 * Render the editor width styles for the test page.
+	 *
+	 * @param string $container the container layout of the page.
+	 * @param string $width the stored content width.
+	 *
+	 * @return string
+	 */
+	private function render_editor_styles( string $container, string $width ): string {
+		update_post_meta( $this->page_id, Metabox_Settings::CONTAINER, $container );
+		update_post_meta( $this->page_id, Metabox_Settings::ENABLE_CONTENT_WIDTH, 'on' );
+		$this->store_raw_meta( Metabox_Settings::CONTENT_WIDTH, $width );
+
+		( new Metabox_Settings() )->editor_content_width();
+
+		return implode( '', (array) wp_styles()->get_data( 'neve-gutenberg-style', 'after' ) );
+	}
+
+	/**
+	 * Metadata written outside the editor, as an import does, is stored as a number.
+	 */
+	public function test_imported_width_is_stored_as_integer(): void {
+		add_post_meta( $this->page_id, Metabox_Settings::CONTENT_WIDTH, 'abc' );
+		add_post_meta( $this->page_id, Metabox_Settings::ENABLE_CONTENT_WIDTH, 'on' );
+
+		$this->assertSame( '0', get_post_meta( $this->page_id, Metabox_Settings::CONTENT_WIDTH, true ) );
+		$this->assertSame( 'on', get_post_meta( $this->page_id, Metabox_Settings::ENABLE_CONTENT_WIDTH, true ) );
+	}
+
+	/**
+	 * A non-numeric stored width falls back to the default width in a contained layout.
+	 */
+	public function test_non_numeric_width_does_not_break_contained_editor(): void {
+		$styles = $this->render_editor_styles( 'contained', 'abc' );
+
+		$this->assertMatchesRegularExpression( '/max-width: [1-9]\d*px;/', $styles );
+	}
+
+	/**
+	 * A stored width carrying CSS only contributes its number in a full-width layout.
+	 */
+	public function test_css_in_width_is_not_printed_in_full_width_editor(): void {
+		$styles = $this->render_editor_styles( 'full-width', '60;} body { display: none' );
+
+		$this->assertStringContainsString( 'max-width: 60%;', $styles );
+		$this->assertStringNotContainsString( 'display: none', $styles );
+	}
+}
diff --git a/tests/test-neve-nav-walker-aria-label.php b/tests/test-neve-nav-walker-aria-label.php
index 2c6913debb..f6ddb2680f 100644
--- a/tests/test-neve-nav-walker-aria-label.php
+++ b/tests/test-neve-nav-walker-aria-label.php
@@ -5,17 +5,13 @@
  * @package neve
  */
 
+require_once __DIR__ . '/fixtures/trait-submenu-nav-menu.php';
+
 /**
  * Class TestNeveNavWalkerAriaLabel
  */
 class TestNeveNavWalkerAriaLabel extends WP_UnitTestCase {
-
-	/**
-	 * ID of the parent menu item created by render_sidebar_menu().
-	 *
-	 * @var int
-	 */
-	private $parent_id;
+	use NeveSubmenuNavMenuFixture;
 
 	/**
 	 * Save titles as an administrator. The bootstrap sets $current_user without
@@ -26,66 +22,23 @@ public function set_up() {
 		wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
 	}
 
-	/**
-	 * Render a sidebar menu whose only parent item has one child.
-	 *
-	 * @param string $parent_title Title of the parent item.
-	 *
-	 * @return string
-	 */
-	private function render_sidebar_menu( $parent_title ) {
-		$menu_id         = wp_create_nav_menu( 'Aria Label Test ' . $parent_title );
-		$this->parent_id = wp_update_nav_menu_item(
-			$menu_id,
-			0,
-			array(
-				'menu-item-title'  => $parent_title,
-				'menu-item-url'    => home_url( '/shop/' ),
-				'menu-item-type'   => 'custom',
-				'menu-item-status' => 'publish',
-			)
-		);
-		wp_update_nav_menu_item(
-			$menu_id,
-			0,
-			array(
-				'menu-item-title'     => 'Cart',
-				'menu-item-url'       => home_url( '/cart/' ),
-				'menu-item-type'      => 'custom',
-				'menu-item-status'    => 'publish',
-				'menu-item-parent-id' => $this->parent_id,
-			)
-		);
-
-		return wp_nav_menu(
-			array(
-				'menu'        => $menu_id,
-				'menu_id'     => 'nv-primary-navigation-mobile-sidebar',
-				'container'   => '',
-				'echo'        => false,
-				'fallback_cb' => false,
-				'walker'      => new \Neve\Views\Nav_Walker(),
-			)
-		);
-	}
-
 	/**
 	 * strip_tags() reads a lone `<` as the start of a tag and drops the rest of the
 	 * title. An editor with unfiltered_html can save such a title, so the item name
 	 * must survive in the label.
 	 */
 	public function test_toggle_aria_label_keeps_a_title_with_a_lone_less_than() {
-		$html = $this->render_sidebar_menu( 'Kids <12' );
+		$menu = $this->render_submenu_nav_menu( 'Kids <12', 'nv-primary-navigation-mobile-sidebar' );
 
-		$this->assertSame( 'Kids <12', get_post( $this->parent_id )->post_title );
-		$this->assertStringContainsString( 'aria-label="Kids &lt;12 submenu"', $html );
+		$this->assertSame( 'Kids <12', get_post( $menu['parent_id'] )->post_title );
+		$this->assertStringContainsString( 'aria-label="Kids &lt;12 submenu"', $menu['html'] );
 	}
 
 	/**
 	 * Line breaks, tabs and repeated spaces in the title collapse to one space.
 	 */
 	public function test_toggle_aria_label_collapses_whitespace_in_the_title() {
-		$html = $this->render_sidebar_menu( "Shop \n\t Now" );
+		$html = $this->render_submenu_nav_menu( "Shop \n\t Now", 'nv-primary-navigation-mobile-sidebar' )['html'];
 
 		$this->assertStringContainsString( 'aria-label="Shop Now submenu"', $html );
 	}
diff --git a/tests/test-neve-sanitization.php b/tests/test-neve-sanitization.php
index e02a740a30..74551e0895 100644
--- a/tests/test-neve-sanitization.php
+++ b/tests/test-neve-sanitization.php
@@ -134,6 +134,44 @@ public function test_sanitize_responsive_int_json() {
 		$this->do_assertion_for_sanitize_responsive_int_json( $input_value, $expected_value );
 	}
 
+	/**
+	 * Responsive sanitizer accepts the decoded array and non-string input (neve#4651).
+	 */
+	public function test_sanitize_responsive_int_json_with_native_array_and_non_string_values() {
+		$default = '{"mobile":0,"tablet":0,"desktop":0}';
+		$array   = [
+			'mobile'  => '1',
+			'tablet'  => 2,
+			'desktop' => '3',
+			'suffix'  => [
+				'mobile'  => 'em',
+				'tablet'  => 'px',
+				'desktop' => 'rem',
+			],
+		];
+
+		$this->assertSame(
+			'{"mobile":1,"tablet":2,"desktop":3,"suffix":{"mobile":"em","tablet":"px","desktop":"rem"}}',
+			$this->sanitization->sanitize_responsive_int_json( $array )
+		);
+		$this->assertSame( $default, $this->sanitization->sanitize_responsive_int_json( [] ) );
+		$this->assertSame( $default, $this->sanitization->sanitize_responsive_int_json( null ) );
+		$this->assertSame( $default, $this->sanitization->sanitize_responsive_int_json( 12 ) );
+		$this->assertSame( $default, $this->sanitization->sanitize_responsive_int_json( false ) );
+	}
+
+	/**
+	 * Plain JSON sanitizer accepts the decoded array and non-string input.
+	 */
+	public function test_sanitize_json_with_native_array_and_non_string_values() {
+		$this->assertSame( '{"a":1}', $this->sanitization->sanitize_json( '{"a":1}' ) );
+		$this->assertSame( '{"a":1}', $this->sanitization->sanitize_json( [ 'a' => 1 ] ) );
+		$this->assertSame( '', $this->sanitization->sanitize_json( [] ) );
+		$this->assertSame( '', $this->sanitization->sanitize_json( null ) );
+		$this->assertSame( '', $this->sanitization->sanitize_json( 12 ) );
+		$this->assertSame( '', $this->sanitization->sanitize_json( 'not json' ) );
+	}
+
 	/**
 	 * Test that color sanitization does not fatal on array or non-string values.
 	 */
@@ -232,6 +270,74 @@ public function test_sanitize_colors_rejects_fake_css_vars() {
 		$this->assertSame( 'var(--x, var(--y, #fff))', neve_sanitize_colors( 'var(--x, var(--y, #fff))' ) );
 	}
 
+	/**
+	 * Gradient picker output is kept; anything beyond a single gradient function is rejected.
+	 */
+	public function test_sanitize_colors_gradients(): void {
+		$valid = [
+			'linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%)',
+			'radial-gradient(rgb(6,147,227) 0%,rgb(155,81,224) 100%)',
+			'radial-gradient(circle at center, #fff 0%, #000 100%)',
+			'conic-gradient(from 90deg, red, blue)',
+			'repeating-linear-gradient(45deg, #FFF 0 10px, transparent 10px 20px)',
+			'linear-gradient(var(--nv-primary-accent), var(--nv_c-1, #fff))',
+			'linear-gradient(hsl(120 50% 50% / .5), transparent)',
+		];
+
+		foreach ( $valid as $value ) {
+			$this->assertSame( $value, neve_sanitize_colors( $value ), $value . ' should be kept' );
+		}
+
+		$this->assertSame( 'linear-gradient(red, blue)', neve_sanitize_colors( ' linear-gradient(red, blue) ' ) );
+
+		$invalid = [
+			'linear-gradient(red,blue)</style><script>alert(1)</script>',
+			'linear-gradient(red,blue);}body{display:none',
+			'linear-gradient(red,blue),url(//example.com/t.png)',
+			'linear-gradient(red,blue))',
+			'linear-gradient(red,"blue")',
+			'x gradient',
+			'notagradient(red, blue)',
+			'linear-gradient',
+		];
+
+		foreach ( $invalid as $value ) {
+			$this->assertSame( '', neve_sanitize_colors( $value ), $value . ' should be rejected' );
+		}
+	}
+
+	/**
+	 * Color slugs that are not CSS identifiers are dropped from both color settings.
+	 */
+	public function test_global_color_slugs_must_be_css_identifiers(): void {
+		$colors_background = new \Neve\Customizer\Options\Colors_Background();
+
+		$global = neve_get_global_colors_default();
+		$global['palettes']['base']['colors']['x:red}</style><script>alert(1)</script>'] = '#ffffff';
+
+		$sanitized = $colors_background->sanitize_global_colors( $global );
+
+		$this->assertSame(
+			array_keys( neve_get_global_colors_default()['palettes']['base']['colors'] ),
+			array_keys( $sanitized['palettes']['base']['colors'] )
+		);
+
+		$custom = $colors_background->sanitize_global_custom_colors(
+			[
+				'custom-1'                                  => [
+					'label' => 'Kept',
+					'val'   => '#ffffff',
+				],
+				'custom-2:red}</style><script>alert(1)<'    => [
+					'label' => 'Dropped',
+					'val'   => '#000000',
+				],
+			]
+		);
+
+		$this->assertSame( [ 'custom-1' ], array_keys( $custom ) );
+	}
+
 	/**
 	 * Private reusable function for the assertion of sanitize responsive int json.
 	 *