diff --git a/.gitignore b/.gitignore
index 471f8e6..9fc59ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,5 +7,11 @@
 
 /bin/fluence
 /data/
-/meta/
+
+# meta/ is runtime data (users, ACLs, sessions, the active theme...) and
+# stays out of git, except the shipped example theme under meta/themes/.
+/meta/*
+!/meta/themes
+/meta/themes/*
+!/meta/themes/example
 
diff --git a/config/options.cr b/config/options.cr
index f30b625..b5e1081 100644
--- a/config/options.cr
+++ b/config/options.cr
@@ -32,6 +32,50 @@ module Fluence
       # with FLUENCE_PUBLICDIR.
       @publicdir = ::File.expand_path ENV.fetch("FLUENCE_PUBLICDIR") { default_publicdir }
 
+      # Active theme's name; its override files are read from
+      # metadir/themes/<name>/ (see @themedir below). Defaults to
+      # "default"; set with FLUENCE_THEME. The "example" theme ships in
+      # metadir/themes/example/ as a documented starting point.
+      @theme = ENV.fetch("FLUENCE_THEME", "default")
+
+      # Directory of theming overrides for the active theme: header.html,
+      # footer.html, and nav_extra.html (raw HTML dropped into the layout
+      # as-is), custom.css (appended after the built-in stylesheet), and
+      # custom.js (appended after the built-in scripts, at the end of the
+      # body). Any file that's missing is simply skipped, so a theme can
+      # override as much or as little as it wants without touching the
+      # templates.
+      @themedir = ::File.join(@metadir, "themes", @theme)
+
+      # Text that replaces a link to a page or attachment the reader can't
+      # read, wherever page content links to one (e.g. a page under an
+      # ACL-hidden directory linked from a readable page): the link and
+      # its text are both dropped, so the target's location or title isn't
+      # disclosed either. Set with FLUENCE_INACCESSIBLE_LABEL.
+      @inaccessible_label = ENV.fetch("FLUENCE_INACCESSIBLE_LABEL", "Censored")
+
+      # Text that replaces an `![alt](src)` image embedded directly in
+      # page content (not wrapped in a link) whose attachment the reader
+      # can't read; unlike a hidden link, there's no separate link text to
+      # drop, just the `src` that would otherwise disclose the attachment's
+      # path. Set with FLUENCE_IMAGE_INACCESSIBLE_LABEL.
+      @image_inaccessible_label = ENV.fetch("FLUENCE_IMAGE_INACCESSIBLE_LABEL", "[Image Not Available]")
+
+      # Extra language codes pages can be translated into, e.g. "de,fr".
+      # A page's default-language content lives at "pages/<name>.md" as
+      # usual; a translation lives alongside it at "pages/<name>.<code>.md"
+      # and is reached as "?lang=<code>" on the page's normal URL, so ACLs
+      # (which key off the URL) cover every translation automatically.
+      # Empty (the default) turns the feature off. Set with FLUENCE_LANGUAGES.
+      @languages = ENV.fetch("FLUENCE_LANGUAGES", "").split(",").map(&.strip).reject(&.empty?)
+
+      # Label for the untranslated "pages/<name>.md" content in the
+      # language switcher; purely cosmetic, since that content is always
+      # what's served when no ?lang= (or an unconfigured one) is given.
+      # Set with FLUENCE_DEFAULT_LANG.
+      @default_lang = ENV.fetch("FLUENCE_DEFAULT_LANG", "en")
+      @languages = @languages.reject { |code| code == @default_lang }
+
       # Visible part of URL through which pages are accessed, e.g. /pages/my_page
       @pages_prefix = "/pages"
       # Start page - homepage. Defaults to /pages/home
@@ -78,6 +122,7 @@ module Fluence
 
       Dir.mkdir_p @datadir
       Dir.mkdir_p @metadir
+      Dir.mkdir_p @themedir
     end
 
     getter host : String
@@ -89,6 +134,12 @@ module Fluence
     getter datadir : String
     getter metadir : String
     getter publicdir : String
+    getter theme : String
+    getter themedir : String
+    getter inaccessible_label : String
+    getter image_inaccessible_label : String
+    getter languages : Array(String)
+    getter default_lang : String
     getter homepage : String
     getter pages_prefix : String
     getter media_prefix : String
diff --git a/spec/controllers_spec.cr b/spec/controllers_spec.cr
index 059d756..78b3584 100644
--- a/spec/controllers_spec.cr
+++ b/spec/controllers_spec.cr
@@ -536,7 +536,11 @@ describe "page menu over HTTP" do
         Fluence::Page.new(name).update! SPEC_USER, "# #{name.split('/').last.capitalize}\n"
       end
 
-      body = SpecClient.new.get("/pages/docs/guide").body
+      # The page menu is part of the signed-in layout; guests get a
+      # stripped-down view without it.
+      client = SpecClient.login "editor", "sekrit123"
+
+      body = client.get("/pages/docs/guide").body
       body.should contain %(<a class="tree-link active" href="/pages/docs/guide">Guide</a>)
       body.should contain %(<div class="collapse show" id="tree-docs">)
       body.should contain %(<div class="collapse show" id="tree-docs-guide">)
@@ -546,13 +550,34 @@ describe "page menu over HTTP" do
       body.should contain %(href="/pages/docs" title="Up: Docs">)
       body.should contain %(href="/pages/docs/guide/install" title="Next: Install">)
 
-      body = SpecClient.new.get("/pages/alpha").body
+      body = client.get("/pages/alpha").body
       body.should contain %(<span class="btn btn-outline-secondary text-nowrap disabled">‹ Prev</span>)
       body.should contain %(href="/pages/docs" title="Next: Docs">)
 
       SpecClient.new.get("/sitemap").body.should contain %(<div class="collapse show" id="tree-other">)
     end
   end
+
+  it "omits unreadable pages, and directories left with nothing readable inside, from the tree" do
+    with_each_storage do |_, _|
+      Fluence::Page.new("hidden/secret").update! SPEC_USER, "# Secret\n"
+      Fluence::Page.new("visible").update! SPEC_USER, "# Visible\n"
+
+      Fluence::ACL["guest"]["#{Fluence::OPTIONS.pages_prefix}/hidden/*"] = Acl::Perm::None
+      begin
+        body = SpecClient.new.get("/sitemap").body
+        body.should_not contain "hidden"
+        body.should_not contain "secret"
+        body.should contain %(href="/pages/visible")
+
+        # A logged-in user without the restriction still sees it.
+        client = SpecClient.login "editor", "sekrit123"
+        client.get("/sitemap").body.should contain %(href="/pages/hidden/secret")
+      ensure
+        Fluence::ACL["guest"].delete "#{Fluence::OPTIONS.pages_prefix}/hidden/*"
+      end
+    end
+  end
 end
 
 describe "save and continue over HTTP" do
@@ -666,7 +691,9 @@ describe "attachment list on a page" do
       Fluence::Media.new("parent/own.txt").update! SPEC_USER, "own"
       Fluence::Media.new("parent/child/pic.png").update! SPEC_USER, "png"
 
-      response = SpecClient.new.get "/pages/parent"
+      # The attachments list is part of the signed-in layout; guests get a
+      # stripped-down view without it.
+      response = SpecClient.login("editor", "sekrit123").get "/pages/parent"
       response.status_code.should eq 200
       response.body.should contain %(href="/media/parent/own.txt")
       response.body.should_not contain "/media/parent/child/pic.png"
@@ -733,7 +760,34 @@ describe "attachment list markup" do
 
       SpecClient.new.get("/pages/att-list").body.should_not contain %(name="delete")
       Fluence::Page.new("no-att").update! SPEC_USER, "# No Att\n"
-      SpecClient.new.get("/pages/no-att").body.should contain %(<div id="no-attachments" class="small text-body-secondary">None.</div>)
+      client.get("/pages/no-att").body.should contain %(<div id="no-attachments" class="small text-body-secondary">None.</div>)
+    end
+  end
+end
+
+describe "guest page view" do
+  it "shows only content and navigation, hiding the menu, attachments, and page management" do
+    with_each_storage do |_, _|
+      Fluence::Page.new("guest-view").update! SPEC_USER, "# Guest View\nBody text.\n"
+      Fluence::Media.new("guest-view/a.txt").update! SPEC_USER, "A"
+
+      body = SpecClient.new.get("/pages/guest-view").body
+      body.should contain "Body text."
+      body.should contain %(href="/pages/home">Home</a>)
+      body.should contain %(href="/sitemap")
+      body.should contain %(href="/users/login")
+      body.should contain %(href="/users/register")
+      body.should_not contain "pages-hierarchy"
+      body.should_not contain "page-nav"
+      body.should_not contain "manage-attachments"
+      body.should_not contain "manage-page"
+      body.should_not contain "page-permissions"
+
+      # Signed-in users still get the full view.
+      client = SpecClient.login "editor", "sekrit123"
+      full_body = client.get("/pages/guest-view").body
+      full_body.should contain "pages-hierarchy"
+      full_body.should contain "manage-attachments"
     end
   end
 end
@@ -775,12 +829,16 @@ describe "table of contents" do
     with_each_storage do |_, _|
       Fluence::Page.new("toc-esc").update! SPEC_USER, "# Toc Esc\n## A <b>bold</b> & \"quoted\" one\n"
 
-      body = SpecClient.new.get("/pages/toc-esc").body
+      body = SpecClient.login("editor", "sekrit123").get("/pages/toc-esc").body
       entry = body.match!(/<li><a href="#([^"]*)">(A .*?)<\/a>/)
       entry[1].should eq "a-b-bold-/b-quoted-one"
       entry[2].should eq "A &lt;b&gt;bold&lt;/b&gt; &amp; &quot;quoted&quot; one"
-      body.should contain %(<h2 id="#{entry[1]}">)
       body.should_not contain "<b>bold</b>"
+
+      # Guests get the rendered body (with the heading) but no TOC.
+      guest = SpecClient.new.get("/pages/toc-esc").body
+      guest.should contain %(<h2 id="#{entry[1]}">)
+      guest.should_not contain "<b>bold</b>"
     end
   end
 end
diff --git a/spec/markdown_spec.cr b/spec/markdown_spec.cr
index de6d099..f96d116 100644
--- a/spec/markdown_spec.cr
+++ b/spec/markdown_spec.cr
@@ -28,10 +28,11 @@ describe Fluence::Markdown do
     Fluence::Markdown.to_html("```\n# not a heading\n```\n").should_not contain "<h1"
   end
 
-  it "omits raw HTML and script-capable link targets" do
+  it "escapes disallowed raw HTML and drops script-capable link targets" do
     html = Fluence::Markdown.to_html("<img src=x onerror=alert(1)>\n\ntext <b onclick=alert(2)>bold</b>\n")
-    html.should_not contain "onerror"
-    html.should_not contain "onclick"
+    html.should_not contain "<img"
+    html.should_not contain "<b "
+    html.should contain "&lt;img src=x onerror=alert(1)&gt;"
     html.should contain "text"
 
     html = Fluence::Markdown.to_html("[x](javascript:alert(1)) ![i](data:text/html,x) ![ok](data:image/png;base64,AA==)\n")
@@ -39,6 +40,104 @@ describe Fluence::Markdown do
     html.should_not contain "data:text/html"
     html.should contain %(src="data:image/png;base64,AA==")
   end
+
+  it "lets <i>/<span class=\"...\"> through for icons and custom styling" do
+    html = Fluence::Markdown.to_html(%(An icon <i class="fas fa-running l4"></i> and <span class="highlight">text</span>.))
+    html.should contain %(<i class="fas fa-running l4"></i>)
+    html.should contain %(<span class="highlight">text</span>)
+  end
+
+  it "lets headings, lists, and layout containers through as raw HTML" do
+    html = Fluence::Markdown.to_html(<<-HTML
+      <div class="callout">
+      <article>
+      <h3 class="title">Heading</h3>
+      <ul><li>one</li><li>two</li></ul>
+      <ol><li>first</li></ol>
+      </article>
+      </div>
+      HTML
+    )
+    html.should contain %(<div class="callout">)
+    html.should contain "<article>"
+    html.should contain %(<h3 class="title">Heading</h3>)
+    html.should contain "<ul><li>one</li><li>two</li></ul>"
+    html.should contain "<ol><li>first</li></ol>"
+    html.should contain "</div>"
+  end
+
+  it "still escapes an unsafe tag disguised with a class attribute" do
+    html = Fluence::Markdown.to_html(%(<img class="x" src=y onerror=alert(1)>))
+    html.should_not contain "<img"
+    html.should contain "&lt;img"
+  end
+
+  it "escapes an opening tag carrying an extra attribute besides class" do
+    html = Fluence::Markdown.to_html(%(<span class="x" onclick="alert(1)">text</span>))
+    html.should_not contain %(<span class="x" onclick)
+    html.should contain %(&lt;span class="x" onclick="alert(1)"&gt;)
+  end
+
+  it "leaves links alone when no user is given to check them against" do
+    Fluence::Markdown.to_html("[Secret](/pages/hidden/secret)")
+      .should contain %(<a href="/pages/hidden/secret">Secret</a>)
+  end
+
+  it "replaces a link to an unreadable page or attachment with the inaccessible label, dropping its text" do
+    with_each_storage do |_, _|
+      Fluence::ACL["guest"]["#{Fluence::OPTIONS.pages_prefix}/hidden/*"] = Acl::Perm::None
+      Fluence::ACL["guest"]["#{Fluence::OPTIONS.media_prefix}/hidden/*"] = Acl::Perm::None
+      begin
+        html = Fluence::Markdown.to_html(
+          "[Secret Plans](/pages/hidden/secret) and [a file](/media/hidden/secret/plans.pdf) and [Visible](/pages/visible)",
+          Fluence::USERS.default.not_nil!
+        )
+        html.should_not contain "Secret Plans"
+        html.should_not contain "hidden/secret"
+        html.should contain "#{Fluence::OPTIONS.inaccessible_label}</span>"
+        html.should contain %(<a href="/pages/visible">Visible</a>)
+      ensure
+        Fluence::ACL["guest"].delete "#{Fluence::OPTIONS.pages_prefix}/hidden/*"
+        Fluence::ACL["guest"].delete "#{Fluence::OPTIONS.media_prefix}/hidden/*"
+      end
+    end
+  end
+
+  it "resolves a relative link the same way the page menu and intlinks do, before checking access" do
+    with_each_storage do |_, _|
+      Fluence::ACL["guest"]["#{Fluence::OPTIONS.pages_prefix}/hidden/*"] = Acl::Perm::None
+      begin
+        # Written on page "new-page" (context_name ""), "hidden/test2" is a
+        # sibling target and resolves to /pages/hidden/test2 — same as the
+        # browser resolving the href against the page's own URL.
+        html = Fluence::Markdown.to_html(
+          "[test](hidden/test2)", Fluence::USERS.default.not_nil!, ""
+        )
+        html.should_not contain "hidden/test2"
+        html.should contain "#{Fluence::OPTIONS.inaccessible_label}</span>"
+      ensure
+        Fluence::ACL["guest"].delete "#{Fluence::OPTIONS.pages_prefix}/hidden/*"
+      end
+    end
+  end
+
+  it "replaces an embedded image the reader can't read with the image-inaccessible label, dropping its src" do
+    with_each_storage do |_, _|
+      Fluence::ACL["guest"]["#{Fluence::OPTIONS.media_prefix}/hidden/*"] = Acl::Perm::None
+      begin
+        html = Fluence::Markdown.to_html(
+          "![Secret Diagram](/media/hidden/plans.png) and ![Visible](/media/visible.png)",
+          Fluence::USERS.default.not_nil!
+        )
+        html.should_not contain "Secret Diagram"
+        html.should_not contain "hidden/plans.png"
+        html.should contain "#{Fluence::OPTIONS.image_inaccessible_label}</span>"
+        html.should contain %(<img src="/media/visible.png" alt="Visible" />)
+      ensure
+        Fluence::ACL["guest"].delete "#{Fluence::OPTIONS.media_prefix}/hidden/*"
+      end
+    end
+  end
 end
 
 describe Fluence::WikilinkMigration do
diff --git a/src/controllers/helpers/page.cr b/src/controllers/helpers/page.cr
index bf7d6a5..3bbdc7d 100644
--- a/src/controllers/helpers/page.cr
+++ b/src/controllers/helpers/page.cr
@@ -24,8 +24,11 @@ module Fluence::Helpers::Page
     end
   end
 
-  # Builds the tree of all pages from the catalog in one pass, siblings
-  # ordered by name.
+  # Builds the tree of the pages *current_user* may read, from the
+  # catalog in one pass, siblings ordered by name. A directory carries no
+  # ACL of its own, so an unreadable page simply omits its name from the
+  # tree; a directory that exists only to route to unreadable pages never
+  # gets a node at all, rather than showing as an empty, un-openable entry.
   def page_tree : Array(TreeNode)
     catalog_tree Fluence::PAGES, Fluence::OPTIONS.pages_prefix
   end
@@ -38,7 +41,7 @@ module Fluence::Helpers::Page
   private def catalog_tree(catalog, url_prefix : String) : Array(TreeNode)
     roots = [] of TreeNode
     index = {} of String => TreeNode
-    titles = catalog.titles
+    titles = catalog.titles.select { |name, _| Fluence::ACL.permitted? current_user, "#{url_prefix}/#{name}", Acl::Perm::Read }
     titles.keys.sort!.each do |name|
       siblings = roots
       path = ""
diff --git a/src/controllers/pages_controller.cr b/src/controllers/pages_controller.cr
index 361b524..d9e5f16 100644
--- a/src/controllers/pages_controller.cr
+++ b/src/controllers/pages_controller.cr
@@ -10,7 +10,7 @@ class PagesController < ApplicationController
   def show
     # Permissions are checked against the page's canonical URL rather than
     # the path as typed: /pages/Secret and /pages/secr%65t are "secret".
-    page = Fluence::Page.new params.url["path"]
+    page = Fluence::Page.new params.url["path"], page_lang
     acl_permit! :read, page.url
     flash["danger"] = params.query["flash.danger"] if params.query["flash.danger"]?
     page.process! if page.exists?
@@ -41,7 +41,7 @@ class PagesController < ApplicationController
   private def show_revision(page, rev)
     commit = commit_or_redirect(page, rev) || return
     body = page.read_at commit
-    body_html = Fluence::Markdown.to_html body
+    body_html = Fluence::Markdown.to_html body, current_user, page.name
     writable = Fluence::ACL.permitted? current_user, page.url, Acl::Perm::Write
     tree = page_tree
     title = "#{page.title} @ #{commit.short_oid} - #{title()}"
@@ -74,7 +74,7 @@ class PagesController < ApplicationController
   private def show_show(page, media)
     exists = page.exists?
     body = exists ? (page.read rescue "") : ""
-    body_html = Fluence::Markdown.to_html body
+    body_html = Fluence::Markdown.to_html body, current_user, page.name
     last_commit = exists ? page.history(1).first? : nil
     Fluence::ACL.load!
     writable = Fluence::ACL.permitted? current_user, page.url, Acl::Perm::Write
@@ -96,7 +96,11 @@ class PagesController < ApplicationController
 
     tree = page_tree
 
-    render "show.slang"
+    if user_signed_in?
+      render "show.slang"
+    else
+      render "show_guest.slang"
+    end
   end
 
   # Whether the editor opens in edit mode (as opposed to preview) for
@@ -118,7 +122,7 @@ class PagesController < ApplicationController
 
   # post /pages/*path
   def update
-    page = Fluence::Page.new params.url["path"]
+    page = Fluence::Page.new params.url["path"], page_lang
     acl_permit! :write, page.url
     page.process! if page.exists?
     if params.body["rename"]?
@@ -183,6 +187,7 @@ class PagesController < ApplicationController
 
       pages.each do |page|
         begin
+          page.translations.each { |code| Fluence::Page.new(page.name, code).delete current_user }
           page.delete current_user if page.exists?
           flash["success success-#{page.name}"] = "Page '#{page.name}' has been deleted"
         rescue e
@@ -278,12 +283,19 @@ class PagesController < ApplicationController
       return
     end
     @env.response.status_code = 404 if pages.empty?
-    sections = pages.map { |page| {page, Fluence::Markdown.to_html(page.read)} }
+    sections = pages.map { |page| {page, Fluence::Markdown.to_html(page.read, current_user, page.name)} }
     tree = page_tree
     title = "Pages titled '#{slug}' - #{title()}"
     render "titles.slang"
   end
 
+  # The translation requested via ?lang= (query, or body for POSTs), or nil
+  # for the default language; unconfigured codes fall back to nil too.
+  private def page_lang : String?
+    lang = params.query["lang"]? || params.body["lang"]?
+    lang if lang && Fluence::OPTIONS.languages.includes?(lang)
+  end
+
   private def subtree_of(page)
     prefix = page.name + "/"
     Fluence::PAGES.names.select(&.starts_with?(prefix)).map { |name| Fluence::Page.new(name).process! }
diff --git a/src/markdown.cr b/src/markdown.cr
index 0f55057..6116a5a 100644
--- a/src/markdown.cr
+++ b/src/markdown.cr
@@ -6,16 +6,42 @@ require "./page"
 # relative target), so no preprocessing pass is needed; see
 # `Page::InternalLinks` for how they are recognized and tracked.
 #
-# Rendering is `safe`: raw HTML in the content is omitted and link/image
-# targets with script-capable schemes (javascript:, vbscript:, data:
-# other than images) are dropped. Anyone allowed to edit a page would
-# otherwise be able to run script in every reader's browser.
+# Rendering is `safe`: link/image targets with script-capable schemes
+# (javascript:, vbscript:, data: other than images) are dropped, and raw
+# HTML in the content goes through `Sanitize` (only `Sanitize::ALLOWED_TAGS`,
+# each with a plain class="..." at most, survive; everything else is
+# escaped to literal text). Anyone allowed to edit a page would otherwise
+# be able to run script in every reader's browser.
 struct Fluence::Markdown
   MARKD_OPTIONS = Markd::Options.new(gfm: true, autolink: true, tagfilter: true, emoji: true, safe: true)
 
+  # Allowlist sanitizer for the raw HTML markd's `html_block`/`html_inline`
+  # nodes carry verbatim (`safe: true` would otherwise drop it entirely).
+  # Lets page content use icon fonts (`<i class="fas fa-running">`), lay
+  # out custom structure (headings, lists, article/div sections), and
+  # apply theme CSS classes to any of it, without opening the door to
+  # `<script>`, event-handler attributes, or any other tag.
+  module Sanitize
+    ALLOWED_TAGS = %w[i span h1 h2 h3 h4 h5 ol ul li article div]
+    TAG = /<\/?[a-zA-Z][^<>]*>/
+    SAFE_TAG = /\A<(\/?)(#{ALLOWED_TAGS.join('|')})(?:\s+class="[A-Za-z0-9_ -]*")?\s*>\z/i
+
+    # *html* with every tag not matching `SAFE_TAG` escaped to literal text.
+    def self.call(html : String) : String
+      html.gsub(TAG) { |tag| tag.matches?(SAFE_TAG) ? tag : escape(tag) }
+    end
+
+    # HTML-escapes *text* for use as literal content (`&`/`<`/`>`).
+    def self.escape(text : String) : String
+      text.gsub('&', "&amp;").gsub('<', "&lt;").gsub('>', "&gt;")
+    end
+  end
+
   # HTMLRenderer whose headings carry an id matching the anchors the
   # table-of-contents helper generates (`Fluence::Page.sanitize` of the
-  # heading text), so TOC links actually land on their sections.
+  # heading text), so TOC links actually land on their sections; and
+  # whose raw-HTML nodes are sanitized (see `Sanitize`) rather than
+  # dropped outright.
   class Renderer < Markd::HTMLRenderer
     def heading(node : Markd::Node, entering : Bool) : Nil
       tag_name = HEADINGS[node.data["level"].as(Int32) - 1]
@@ -28,6 +54,16 @@ struct Fluence::Markdown
       end
     end
 
+    def html_block(node : Markd::Node, entering : Bool) : Nil
+      newline
+      literal(Sanitize.call(node.text))
+      newline
+    end
+
+    def html_inline(node : Markd::Node, entering : Bool) : Nil
+      literal(Sanitize.call(node.text))
+    end
+
     private def plain_text(node : Markd::Node) : String
       String.build do |io|
         walker = node.walker
@@ -39,12 +75,62 @@ struct Fluence::Markdown
     end
   end
 
+  # Link to a page or attachment *user* can't read, with its text (title,
+  # image alt text, or whatever markup it carried), replaced by
+  # `Fluence::OPTIONS.inaccessible_label` — so a page linking to a hidden
+  # one doesn't disclose its location or title. Markdown link text can't
+  # itself contain a link, so `.*?</a>` always closes the same tag it
+  # opened, never a nested one.
+  HIDDEN_LINK = /<a href="([^"]*)"[^>]*>.*?<\/a>/m
+
+  # An `![alt](src)` image markd rendered self-closed, whose `src` is what
+  # would disclose an unreadable attachment's path (there's no link text
+  # to drop, unlike `HIDDEN_LINK` — just the tag itself).
+  HIDDEN_IMAGE = /<img src="([^"]*)"[^>]*\/>/
+
   # ```
-  # Fluence::Markdown.to_html("**GFM** with [a link](/pages/home)")
+  # Fluence::Markdown.to_html("**GFM** with [a link](/pages/home)", current_user, page.name)
   # ```
-  def self.to_html(input : String) : String
+  # *user* is who the result is shown to, so links and images they can't
+  # read get hidden (see `HIDDEN_LINK`, `HIDDEN_IMAGE`); omit it to skip
+  # both passes entirely (there is no one to hide anything from).
+  # *context_name* is the page the content belongs to, needed to resolve
+  # relative link targets exactly like `Page::InternalLinks` does (a link
+  # written as "sub/page" on page "a/b" targets "a/sub/page", not
+  # "/pages/sub/page").
+  def self.to_html(input : String, user : Fluence::User? = nil, context_name : String = "") : String
     return "" if input.empty?
     document = Markd::Parser.parse(input, MARKD_OPTIONS)
-    Renderer.new(MARKD_OPTIONS).render(document, nil)
+    html = Renderer.new(MARKD_OPTIONS).render(document, nil)
+    return html unless user
+    html = hide_inaccessible_images html, user
+    hide_inaccessible_links html, user, context_name
+  end
+
+  private def self.hide_inaccessible_links(html : String, user : Fluence::User, context_name : String) : String
+    html.gsub(HIDDEN_LINK) do |tag, match|
+      href = match[1]
+      path = if name = Fluence::Page::InternalLinks.resolve(href, context_name)
+               "#{Fluence::OPTIONS.pages_prefix}/#{name}"
+             elsif href.starts_with?("#{Fluence::OPTIONS.media_prefix}/")
+               href.split(/[?#]/, 2).first
+             end
+      if path && !Fluence::ACL.permitted?(user, path, Acl::Perm::Read)
+        %(<span class="text-body-secondary fst-italic">#{Sanitize.escape(Fluence::OPTIONS.inaccessible_label)}</span>)
+      else
+        tag
+      end
+    end
+  end
+
+  private def self.hide_inaccessible_images(html : String, user : Fluence::User) : String
+    html.gsub(HIDDEN_IMAGE) do |tag, match|
+      src = match[1]
+      if src.starts_with?("#{Fluence::OPTIONS.media_prefix}/") && !Fluence::ACL.permitted?(user, src.split(/[?#]/, 2).first, Acl::Perm::Read)
+        %(<span class="text-body-secondary fst-italic">#{Sanitize.escape(Fluence::OPTIONS.image_inaccessible_label)}</span>)
+      else
+        tag
+      end
+    end
   end
 end
diff --git a/src/page.cr b/src/page.cr
index 26527ca..c69d42e 100644
--- a/src/page.cr
+++ b/src/page.cr
@@ -15,10 +15,15 @@ class Fluence::Page < Fluence::File
 	property toc : Page::TableOfContent::Toc
 	property intlinks : Page::InternalLinks::LinkList
 
-	def initialize(name : String)
+	# Language of this instance, from `Fluence::OPTIONS.languages`; nil for
+	# the default-language content at "pages/<name>.md".
+	getter lang : String?
+
+	def initialize(name : String, @lang : String? = nil)
 		name = Page.sanitize(name).strip "/"
 		title = ::File.basename name
-		super("pages/#{name}.md", name, "#{Fluence::OPTIONS.pages_prefix}/#{name}", title)
+		suffix = @lang ? ".#{@lang}" : ""
+		super("pages/#{name}#{suffix}.md", name, "#{Fluence::OPTIONS.pages_prefix}/#{name}", title)
 
 		@slug = Page.title_to_slug @title
 		@intlinks = Page::InternalLinks::LinkList.new
@@ -27,6 +32,12 @@ class Fluence::Page < Fluence::File
 		jail!
 	end
 
+	# Language codes (from `Fluence::OPTIONS.languages`) this page has a
+	# translation for.
+	def translations : Array(String)
+		Fluence::OPTIONS.languages.select { |code| Page.new(@name, code).exists? }
+	end
+
 	def storage_prefix : String
 		"pages"
 	end
@@ -112,6 +123,11 @@ class Fluence::Page < Fluence::File
 		new_page = Page.new(new_name)
 		old_prefix = "media/#{@name}/"
 		moves = attachment_paths.map { |path| {path, "media/#{new_page.name}/#{path.lchop old_prefix}"} }
+		# Renaming the default-language page takes its translations along;
+		# renaming a translation directly (@lang set) affects only itself.
+		unless @lang
+			moves += translations.map { |code| {Page.new(@name, code).path, Page.new(new_page.name, code).path} }
+		end
 		rename_to new_page, user, overwrite, moves
 	end
 
diff --git a/src/theme.cr b/src/theme.cr
new file mode 100644
index 0000000..7ac6e52
--- /dev/null
+++ b/src/theme.cr
@@ -0,0 +1,28 @@
+# Site-level theming slots: raw HTML/CSS/JS overrides dropped in
+# Fluence::OPTIONS.themedir, read fresh on every render so a site admin
+# can restyle header, footer, nav, stylesheet, and behavior without
+# rebuilding or restarting the binary. Missing files render as empty
+# content — the built-in layout is the default theme.
+module Fluence::Theme
+  SLOTS = %w[header footer nav_extra]
+
+  # Raw HTML for a named slot ("header", "footer", or "nav_extra"), or ""
+  # if the site hasn't overridden it.
+  def self.slot(name : String) : String
+    read ::File.join(Fluence::OPTIONS.themedir, "#{name}.html")
+  end
+
+  # Contents of the site's custom stylesheet, or "" if it has none.
+  def self.custom_css : String
+    read ::File.join(Fluence::OPTIONS.themedir, "custom.css")
+  end
+
+  # Contents of the site's custom script, or "" if it has none.
+  def self.custom_js : String
+    read ::File.join(Fluence::OPTIONS.themedir, "custom.js")
+  end
+
+  private def self.read(path : String) : String
+    ::File.exists?(path) ? ::File.read(path) : ""
+  end
+end
diff --git a/src/views/layouts/_nav.slang b/src/views/layouts/_nav.slang
index b6b5477..6790674 100644
--- a/src/views/layouts/_nav.slang
+++ b/src/views/layouts/_nav.slang
@@ -45,4 +45,7 @@ nav.navbar.navbar-expand-lg.bg-body-tertiary
             a class=login_class href="#{Fluence::OPTIONS.users_prefix}/login" | Login
             - if Fluence::OPTIONS.registration_open?
               li.navbar-text or
-              a class=register_class href="#{Fluence::OPTIONS.users_prefix}/register" Register
\ No newline at end of file
+              a class=register_class href="#{Fluence::OPTIONS.users_prefix}/register" Register
+      - nav_extra = Fluence::Theme.slot "nav_extra"
+      - if !nav_extra.empty?
+        == nav_extra
\ No newline at end of file
diff --git a/src/views/layouts/application.slang b/src/views/layouts/application.slang
index 65f4bf8..6ec32ac 100644
--- a/src/views/layouts/application.slang
+++ b/src/views/layouts/application.slang
@@ -21,8 +21,16 @@ html lang="en" data-bs-theme=theme_attr
     link rel="stylesheet" href="/assets/stylesheet/base.css"
     script src="/assets/javascript/base.js"
     script == "Fluence.settings = #{current_user.settings.to_json};"
+    - custom_css = Fluence::Theme.custom_css
+    - if !custom_css.empty?
+      style == custom_css
 
   body
+    - theme_header = Fluence::Theme.slot "header"
+    - if !theme_header.empty?
+      #theme-header
+        == theme_header
+
     #navbar
       == render_template "layouts/_nav.slang"
 
@@ -37,3 +45,12 @@ html lang="en" data-bs-theme=theme_attr
               .w-100
       #main-content
         == content
+
+    - theme_footer = Fluence::Theme.slot "footer"
+    - if !theme_footer.empty?
+      #theme-footer
+        == theme_footer
+
+    - custom_js = Fluence::Theme.custom_js
+    - if !custom_js.empty?
+      script == custom_js
diff --git a/src/views/pages/show.slang b/src/views/pages/show.slang
index 944e818..0ee1224 100644
--- a/src/views/pages/show.slang
+++ b/src/views/pages/show.slang
@@ -12,6 +12,8 @@
               button.btn.btn-sm.btn-outline-secondary.ms-2 type="button" onclick="Fluence.editor.discardDraft()" Discard draft
             form#edit-page.invisible method="post"
               fieldset
+                - if page.lang
+                  input type="hidden" name="lang" value="#{page.lang}"
                 textarea.form-control name="body" = body
           - else
             #page-body
@@ -43,6 +45,18 @@
                     input type="hidden" name="media-name" value="#{filename}"
                     button.btn.btn-sm.btn-outline-danger.py-0.ms-2 name="delete" value="Delete" type="submit" formaction="#{Fluence::OPTIONS.media_prefix}/#{page.name}/#{filename}" onclick="return Fluence.deleteAttachment(this, '#{filename}')" Delete
     #sidebar.col
+      - if !Fluence::OPTIONS.languages.empty?
+        section#page-languages
+          h6.section-title Language
+          ul.list-unstyled.mb-0
+            - default_class = page.lang.nil? ? "fw-bold" : ""
+            li
+              a class=default_class href="#{page.url}" = Fluence::OPTIONS.default_lang
+            - Fluence::OPTIONS.languages.each do |code|
+              - has_translation = page.translations.includes? code
+              - current_class = page.lang == code ? "fw-bold" : ""
+              li
+                a class=current_class href="#{page.url}?lang=#{code}" = has_translation ? code : "#{code} (untranslated)"
       - if writable
         section#page-content
           h6.section-title Page Content
@@ -83,6 +97,8 @@
               a.section-toggle.collapsed data-bs-toggle="collapse" href="#page-management-body" role="button" aria-expanded="false" aria-controls="page-management-body" Page Management
             #page-management-body.collapse
               form#manage-page method="post"
+                - if page.lang
+                  input type="hidden" name="lang" value="#{page.lang}"
                 .input-group.input-group-sm
                   span.input-group-text id="label-page-name" Page name
                   input.form-control type="text" id="input-page-name" name="input-page-name" aria-describedby="label-page-name" value="#{page.name}"
diff --git a/src/views/pages/show_guest.slang b/src/views/pages/show_guest.slang
new file mode 100644
index 0000000..0138b37
--- /dev/null
+++ b/src/views/pages/show_guest.slang
@@ -0,0 +1,27 @@
+/ Minimal page view for guests (not signed in): page content and the
+/ language switcher only. Navigation (home, sitemap, search, login/
+/ register) comes from the shared layout/_nav.slang, which already hides
+/ what a guest can't use.
+.container-fluid
+  .row
+    - if !Fluence::OPTIONS.languages.empty?
+      .col-md-3
+        section#page-languages
+          h6.section-title Language
+          ul.list-unstyled.mb-0
+            - default_class = page.lang.nil? ? "fw-bold" : ""
+            li
+              a class=default_class href="#{page.url}" = Fluence::OPTIONS.default_lang
+            - Fluence::OPTIONS.languages.each do |code|
+              - has_translation = page.translations.includes? code
+              - current_class = page.lang == code ? "fw-bold" : ""
+              li
+                a class=current_class href="#{page.url}?lang=#{code}" = has_translation ? code : "#{code} (untranslated)"
+    .col
+      - if page.exists?
+        #page-body
+          == body_html
+      - else
+        .small.text-body-secondary This page does not exist yet.
+script
+  | hljs.highlightAll();