diff --git a/setup/index.php b/setup/index.php
index 71868d0e..8a8aaa47 100644
--- a/setup/index.php
+++ b/setup/index.php
@@ -126,15 +126,8 @@ if (isset($_POST['add_database'])) {
 
 }
 
-<?php
 if (isset($_POST['restore'])) {
 
-    // ---------- Optional CSRF check (requires a hidden "csrf" in your restore form) ----------
-    if (!hash_equals($_SESSION['csrf'] ?? '', $_POST['csrf'] ?? '')) {
-        http_response_code(403);
-        exit("Invalid CSRF token.");
-    }
-
     // ---------- Inline helpers (guarded) ----------
     if (!function_exists('recursiveCopy')) {
         function recursiveCopy(string $src, string $dst): void {