diff --git a/engine/client/keys.h b/engine/client/keys.h
index 2cf736dcb..8600dddb4 100644
--- a/engine/client/keys.h
+++ b/engine/client/keys.h
@@ -176,9 +176,9 @@ typedef enum {
 #define K_GP_DIAMOND_CONFIRM	K_GP_DIAMOND_DOWN	//roughly equivelent to k_return for menu behaviours
 #define K_GP_DIAMOND_CANCEL		K_GP_DIAMOND_RIGHT	//roughly like escape, at least in menus
 #define K_GP_DIAMOND_ALTCONFIRM	K_GP_DIAMOND_UP		//for more negative confirmations.
-	K_GP_VIEW,
+	K_GP_VIEW, //aka back (near left stick)
 	K_GP_GUIDE,
-	K_GP_MENU,
+	K_GP_MENU,	//aka options/start (near right stick)
 	K_GP_LEFT_STICK,
 	K_GP_RIGHT_STICK,
 	K_GP_LEFT_SHOULDER,
diff --git a/engine/common/net_ice.c b/engine/common/net_ice.c
index aae1f0027..67d9fc632 100644
--- a/engine/common/net_ice.c
+++ b/engine/common/net_ice.c
@@ -2129,7 +2129,7 @@ static qboolean QDECL ICE_Set(struct icestate_s *con, const char *prop, const ch
 					else if (net_enable_dtls.ival >= 3)
 					{	//peer doesn't seem to support dtls.
 						con->state = ICE_FAILED;
-						Con_Printf(CON_WARNING"WARNING: [%s]: peer does not support dtls. Set net_enable_dtls to 0 to make optional.\n", con->friendlyname);
+						Con_Printf(CON_WARNING"WARNING: [%s]: peer does not support dtls. Set net_enable_dtls to 1 to make optional.\n", con->friendlyname);
 					}
 					else if (con->state == ICE_CONNECTING && net_enable_dtls.ival>=2)
 						Con_Printf(CON_WARNING"WARNING: [%s]: peer does not support dtls.\n", con->friendlyname);
@@ -2147,7 +2147,10 @@ static qboolean QDECL ICE_Set(struct icestate_s *con, const char *prop, const ch
 			else if (!con->dtlsstate && con->cred.peer.hash)
 			{
 				if (!con->peersctpoptional)
-					Con_Printf(CON_WARNING"WARNING: [%s]: peer is trying to use dtls.\n", con->friendlyname);
+				{
+					con->state = ICE_FAILED;
+					Con_Printf(CON_WARNING"WARNING: [%s]: peer is trying to use dtls.%s\n", con->friendlyname, net_enable_dtls.ival?"":" Set ^[/net_enable_dtls 1^].");
+				}
 			}
 #endif
 		}
diff --git a/engine/common/net_wins.c b/engine/common/net_wins.c
index ff1bd3da0..da8c970c5 100644
--- a/engine/common/net_wins.c
+++ b/engine/common/net_wins.c
@@ -2136,6 +2136,10 @@ qboolean NET_IsEncrypted(netadr_t *adr)
 #ifdef SUPPORT_ICE
 	if (adr->type == NA_ICE && ICE_IsEncrypted(adr))
 		return true;
+#endif
+#if defined(FTE_TARGET_WEB)
+	if (adr->prot == NP_RTC_TLS)	//web port works a bit differently... webrtc is ALWAYS encrypted, but only report it as secure when the broker connection is encrypted too.
+		return true;
 #endif
 	if (adr->prot == NP_DTLS || adr->prot == NP_TLS || adr->prot == NP_WSS)
 		return true;
@@ -9352,7 +9356,7 @@ void NET_InitServer(void)
 #ifdef HAVE_DTLS
 		Cvar_ForceCallback(&net_enable_dtls);
 #endif
-#ifdef SUPPORT_ICE
+#if defined(SUPPORT_ICE) || defined(FTE_TARGET_WEB)
 		Cvar_ForceCallback(&sv_public);
 #endif
 	}
diff --git a/engine/server/sv_main.c b/engine/server/sv_main.c
index 1fd6e6cbd..a53adf56e 100644
--- a/engine/server/sv_main.c
+++ b/engine/server/sv_main.c
@@ -105,7 +105,7 @@ cvar_t	allow_download_other		= CVARD("allow_download_other", "0", "0 blocks down
 
 extern cvar_t sv_allow_splitscreen;
 
-#ifdef SUPPORT_ICE
+#if defined(SUPPORT_ICE) || defined(FTE_TARGET_WEB)
 static void QDECL SV_Public_Callback(struct cvar_s *var, char *oldvalue)
 {
 	char name[64], *e;
@@ -116,7 +116,11 @@ static void QDECL SV_Public_Callback(struct cvar_s *var, char *oldvalue)
 		FTENET_AddToCollection(svs.sockets, var->name, va("/%s", (*name == '/')?name+1:name), NA_INVALID, NP_RTC_TLS);
 		var->value = var->ival = 2;	//so other stuff sees us as holepunched.
 	}
+#ifdef FTE_TARGET_WEB
+	else if (var->ival)	//any kind of public is webrtc public, browsers don't allow more.
+#else
 	else if (var->ival == 2)
+#endif
 		FTENET_AddToCollection(svs.sockets, var->name, "/", NA_INVALID, NP_RTC_TLS);
 	else
 		FTENET_AddToCollection(svs.sockets, var->name, "", NA_INVALID, NP_INVALID);
diff --git a/engine/web/ftejslib.js b/engine/web/ftejslib.js
index 6e6c5def5..05afc6b56 100644
--- a/engine/web/ftejslib.js
+++ b/engine/web/ftejslib.js
@@ -260,7 +260,9 @@ mergeInto(LibraryManager.library,
 					//we don't steal that because its impossible to leave it again once used.
 					if (FTEC.evcb.key != 0 && event.keyCode != 122)
 					{
-						if ({{{makeDynCall('iiiii','FTEC.evcb.key')}}}(0, event.type=='keydown', event.keyCode, 0))
+						var codepoint = event.key.codePointAt(1)?0:event.key.codePointAt(0); // only if its a single codepoint - none of this 'Return' nonsense.
+						if (codepoint < ' ') codepoint = 0; //don't give a codepoint for c0 chars - like tab.
+						if ({{{makeDynCall('iiiii','FTEC.evcb.key')}}}(0, event.type=='keydown', event.keyCode, codepoint))
 							event.preventDefault();
 					}
 					break;
@@ -269,6 +271,7 @@ mergeInto(LibraryManager.library,
 				case 'touchcancel':
 				case 'touchleave':
 				case 'touchmove':
+					event.preventDefault();
 					var touches = event.changedTouches;
 					for (var i = 0; i < touches.length; i++)
 					{
@@ -278,12 +281,11 @@ mergeInto(LibraryManager.library,
 						if (FTEC.evcb.button)
 						{
 							if (event.type == 'touchstart')
-								{{{makeDynCall('viii','FTEC.evcb.button')}}}(t.identifier+1, 1, 0);
+								{{{makeDynCall('viii','FTEC.evcb.button')}}}(t.identifier+1, 1, -1);
 							else if (event.type != 'touchmove')
-								{{{makeDynCall('viii','FTEC.evcb.button')}}}(t.identifier+1, 0, 0);
+								{{{makeDynCall('viii','FTEC.evcb.button')}}}(t.identifier+1, 0, -1);
 						}
 					}
-					event.preventDefault();
 					break;
 				case 'dragenter':
 				case 'dragover':
@@ -921,10 +923,14 @@ mergeInto(LibraryManager.library,
 
 		try
 		{
-			if (1)
+			try
+			{
 				desc = JSON.parse(offer);
-			else
+			}
+			catch(e)
+			{
 				desc = {sdp:offer, type:offertype};
+			}
 
 			s.pc.setRemoteDescription(desc).then(() =>
 					{
@@ -966,10 +972,14 @@ mergeInto(LibraryManager.library,
 		try	//don't screw up if the peer is trying to screw with us.
 		{
 			var desc;
-			if (1)
+			try
+			{
 				desc = JSON.parse(offer);
-			else
+			}
+			catch(e)
+			{
 				desc = {candidate:offer, sdpMid:null, sdpMLineIndex:0};
+			}
 			s.pc.addIceCandidate(desc);
 		} catch(err) { console.log(err); }
 	},
@@ -977,7 +987,6 @@ mergeInto(LibraryManager.library,
 	emscriptenfte_async_wget_data2 : function(url, ctx, onload, onerror, onprogress)
 	{
 		var _url = UTF8ToString(url);
-//		console.log("Attempting download of " + _url);
 		var http = new XMLHttpRequest();
 		try
 		{
@@ -993,7 +1002,6 @@ mergeInto(LibraryManager.library,
 
 		http.onload = function(e)
 		{
-//console.log("onload: " + _url + " status " + http.status);
 			if (http.status == 200)
 			{
 				if (onload)
@@ -1008,7 +1016,8 @@ mergeInto(LibraryManager.library,
 
 		http.onerror = function(e)
 		{
-//console.log("onerror: " + _url);
+			//Note: Unfortunately it is not possible to distinguish between dns, network, certificate, or CORS errors (other than viewing the browser's log).
+			//      This is apparently intentional to prevent sites probing lans - cors will make them all seem dead and thus uninteresting targets.
 			if (onerror)
 				{{{makeDynCall('vii','onerror')}}}(ctx, 0);
 		};
diff --git a/engine/web/gl_vidweb.c b/engine/web/gl_vidweb.c
index aff448fb1..b37851008 100644
--- a/engine/web/gl_vidweb.c
+++ b/engine/web/gl_vidweb.c
@@ -172,14 +172,14 @@ static int DOM_KeyEvent(unsigned int devid, int down, int scan, int uni)
 //	Con_Printf("Key %s %i %i:%c\n", down?"down":"up", scan, uni, uni?(char)uni:' ');
 	if (shift_down)
 	{
-		uni = domkeytoshift(scan);
+//		uni = domkeytoshift(scan);
 		scan = domkeytoquake(scan);
-		uni = (uni >= 32 && uni <= 127)?uni:0;
+//		uni = (uni >= 32 && uni <= 127)?uni:0;
 	}
 	else
 	{
 		scan = domkeytoquake(scan);
-		uni = (scan >= 32 && scan <= 127)?scan:0;
+//		uni = (scan >= 32 && scan <= 127)?scan:0;
 	}
 	IN_KeyEvent(keyboardid[devid], down, scan, uni);
 	//Chars which don't map to some printable ascii value get preventDefaulted.
@@ -192,8 +192,31 @@ static int DOM_KeyEvent(unsigned int devid, int down, int scan, int uni)
 		return true;
 //	return false;
 }
+static int RemapTouchId(int id, qboolean final)
+{
+	static int touchids[8];
+	int i;
+	if (!id)
+		return id;
+	for (i = 1; i < countof(touchids); i++)
+		if (touchids[i] == id)
+		{
+			if (final)	
+				touchids[i] = 0;
+			return i;
+		}
+	for (i = 1; i < countof(touchids); i++)
+		if (touchids[i] == 0)
+		{
+			if (!final)
+				touchids[i] = id;
+			return i;
+		}
+	return id;
+}
 static void DOM_ButtonEvent(unsigned int devid, int down, int button)
 {
+	devid = RemapTouchId(devid, !down);
 	if (down == 2)
 	{
 		//fixme: the event is a float. we ignore that.
@@ -216,11 +239,16 @@ static void DOM_ButtonEvent(unsigned int devid, int down, int button)
 		else if (button == 1)
 			button = 2;
 
-		IN_KeyEvent(mouseid[devid], down, K_MOUSE1+button, 0);
+		if (button < 0)
+			button = K_TOUCH;
+		else
+			button += K_MOUSE1;
+		IN_KeyEvent(mouseid[devid], down, button, 0);
 	}
 }
 static void DOM_MouseMove(unsigned int devid, int abs, float x, float y, float z, float size)
 {
+	devid = RemapTouchId(devid, false);
 	IN_MouseMove(mouseid[devid], abs, x, y, z, size);
 }