diff --git a/App/pages/foto-upload.php b/App/pages/foto-upload.php
index 44b4389..867a414 100644
--- a/App/pages/foto-upload.php
+++ b/App/pages/foto-upload.php
@@ -13,6 +13,52 @@
 require_once __DIR__ . '/../php/config/app.php';
 $bp = BASE_PATH;
 
+/* ---------- PIN-Schranke (im Browser gespeichert, 1 Jahr) ---------- */
+$PIN = '0815';
+$pinFehler = false;
+if (isset($_POST['pin'])) {
+    if ($_POST['pin'] === $PIN) {
+        setcookie('ggs_foto_pin', $PIN, time() + 60 * 60 * 24 * 365, '/');
+        header('Location: ' . strtok($_SERVER['REQUEST_URI'], '?'));
+        exit;
+    }
+    $pinFehler = true;
+}
+if (($_COOKIE['ggs_foto_pin'] ?? '') !== $PIN) {
+    ?>
+    <!DOCTYPE html>
+    <html lang="de">
+    <head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>📷 Foto-Backend · PIN</title>
+    <style>
+      body { background: #edeae0; margin: 0; font-family: system-ui, -apple-system, "Segoe UI", sans-serif; color: #2f3e46;
+             min-height: 100vh; display: flex; align-items: center; justify-content: center; }
+      .box { background: #fdfbf4; border-radius: 14px; box-shadow: 0 4px 18px rgba(47,62,70,.15); padding: 30px 34px; text-align: center; max-width: 320px; }
+      .box h1 { font-size: 20px; margin: 0 0 6px; }
+      .box p { color: #6b6659; font-size: 14px; margin: 0 0 16px; }
+      input[type=password] { width: 130px; text-align: center; font-size: 26px; letter-spacing: 8px; border: 1.5px solid #c9c2ae;
+             border-radius: 10px; padding: 10px 6px; background: #fff; }
+      button { display: block; margin: 14px auto 0; background: #4f7f5e; color: #fff; border: 0; border-radius: 10px;
+             padding: 11px 30px; font-size: 15px; font-weight: 800; cursor: pointer; }
+      .err { color: #a33227; font-weight: 700; font-size: 14px; margin-top: 10px; }
+    </style>
+    </head>
+    <body>
+      <form class="box" method="post">
+        <h1>📷 Foto-Backend</h1>
+        <p>Bitte PIN eingeben — dein Browser merkt sie sich.</p>
+        <input type="password" name="pin" inputmode="numeric" pattern="[0-9]*" maxlength="8" autofocus autocomplete="current-password">
+        <button type="submit">Öffnen</button>
+        <?php if ($pinFehler): ?><div class="err">PIN stimmt nicht.</div><?php endif; ?>
+      </form>
+    </body>
+    </html>
+    <?php
+    exit;
+}
+
 $UPLOAD_BASE = __DIR__ . '/../uploads/buch-fotos';
 $MAX_BYTES   = 40 * 1024 * 1024;   // 40 MB je Datei
 $MAX_FILES   = 12;                 // je Absenden
