Securing a TYPO3 installation is a shared responsibility across everyone involved: system administrators, integrators, developers and editors. This guide draws on the official TYPO3 Security Guide and pulls together all the security measures that matter.

Table of Contents  

Quick Checklist  

Sorted by priority – critical measures first.

Critical – Implement Immediately  

High – Authentication & Access  

Medium – Infrastructure  

Maintenance & Recovery  

TYPO3 Security Team 

The TYPO3 Security Team coordinates and communicates security vulnerabilities across the entire TYPO3 ecosystem.

Versions & Updates 

Choosing the right TYPO3 version and sticking to a consistent update strategy are fundamental security decisions.

Support Cycles  

Update Categories  

Threat Types 

To protect TYPO3 systems effectively, you first need to understand the most common attack vectors.

General Guidelines 

These core principles apply to every role and underpin any security strategy.

Password Hygiene  

Staying Informed  

• Security Bulletins: typo3.org/security
• Newsletter: Subscribe to TYPO3 Security Announcements
• RSS Feed: Automatic notification of new advisories

Client Security  

All devices accessing the TYPO3 backend must be secured:

• Keep operating system and browser up to date
• Enable anti-virus software and firewall
• No installation of software from unknown sources
• VPN for access from public networks

System Admin 

System administrators own the server infrastructure, and with it the foundation on which every other security measure rests.

HTTPS Encryption  

• TLS 1.2 as a minimum, TLS 1.3 preferred
• Let's Encrypt for free certificates
• Set HSTS header (forces HTTPS)
• [BE][lockSSL] = true in TYPO3 configuration

File Permissions  

Correct permissions prevent unauthorised access:

HTTP Access Restriction  

Block access to sensitive files and directories:

# Block configuration files
location ~* /.*\.(?:bak|conf|cfg|yaml|yml|ts|sql|sqlite)$ {
    deny all;
}

# Block Composer files
location ~* composer\.(?:json|lock) {
    deny all;
}

# Block vendor and typo3_src
location ~ ^(?:vendor|typo3_src|typo3temp/var) {
    deny all;
}

# Block private extension directories
location ~ /(?:Configuration|Resources/Private|Tests)/ {
    deny all;
}

Disable Directory Indexing  

Disable automatic directory listing to avoid information leaks:

Options -Indexes

autoindex off;

Security Headers  

HTTP security headers add a crucial layer of defence against a range of attacks. The web server sends them to tell the browser how to behave securely.

Recommended Headers  

Configuration  

# Security Headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

# Content-Security-Policy (adjust!)
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; frame-ancestors 'self';" always;

Verification  

Test your security headers with these tools:

• securityheaders.com – Quick analysis
• Mozilla Observatory – Comprehensive security check
• Browser DevTools → Network → Response Headers

Database Security  

Backup Strategy  

The official TYPO3 documentation recommends a tiered backup strategy:

Integration & Configuration 

Integrators configure TYPO3 and are responsible for getting the system settings right.

Securing the Install Tool  

The Install Tool can make far-reaching changes to the system, so it needs particular protection:

1. ENABLE_INSTALL_TOOL file in var/transient/ (Composer) or typo3temp/var/transient/ (Classic)
2. Separate password (not the admin password!)
3. Auto-deletion after 60 minutes of inactivity

Application Context (TYPO3_CONTEXT)  

The Application Context lets you run different configurations per environment. This is critical for security, since debugging options should only ever be active in development.

Recommended Contexts  

Configuration  

# .htaccess
SetEnv TYPO3_CONTEXT Production

Context-specific Configuration  

TYPO3 automatically loads additional configuration files based on the Context:

config/system/
├── settings.php              # Base configuration
├── additional.php            # Additional settings
└── additional_Production.php # Only loaded in Production
└── additional_Development.php # Only loaded in Development

Official documentation: Application Context

Local Development with DDEV  

DDEV is the recommended development environment for TYPO3 projects. This container-based solution offers clear security advantages over classic LAMP setups.

# New project
mkdir my-typo3-project && cd my-typo3-project
ddev config --project-type=typo3 --php-version=8.2
ddev start
ddev composer create "typo3/cms-base-distribution:^12"
ddev launch

Global Configuration  

All security-relevant settings in config/system/settings.php or config/system/additional.php:

<?php
// =====================================================
// BACKEND SECURITY (v12+)
// =====================================================

// Force HTTPS for backend (CRITICAL) - v12+
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockSSL'] = true;

// Security warnings via e-mail - v12+
$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr'] = 'security@example.com';
$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_mode'] = 2;

// Session security - v12+
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockIP'] = 4;
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockIPv6'] = 8;
$GLOBALS['TYPO3_CONF_VARS']['BE']['sessionTimeout'] = 3600;

// Cookie security - v12+
$GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite'] = 'strict';

// Password hashing - v12+ (Argon2id is the most secure algorithm)
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']['className'] = 
    \TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2idPasswordHash::class;

// Password policies - v12+ (configurable password policies)
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy'] = 'default';

// =====================================================
// FRONTEND SECURITY (v12+)
// =====================================================

// Prevent cache poisoning (CRITICAL) - v12+
// Default is false – recommended hardening measure: set to true
$GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['enforceValidation'] = true;

// Frontend session security - v12+
$GLOBALS['TYPO3_CONF_VARS']['FE']['lockIP'] = 2;
$GLOBALS['TYPO3_CONF_VARS']['FE']['lockIPv6'] = 2;

// Frontend password policies - v12+
$GLOBALS['TYPO3_CONF_VARS']['FE']['passwordPolicy'] = 'default';

// =====================================================
// SYSTEM SECURITY (v12+)
// =====================================================

// Trusted Hosts Pattern (CRITICAL) - v12+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] = 
    'www\.example\.com|example\.com';

// Do not display errors in frontend (CRITICAL) - v12+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['displayErrors'] = 0;

// Restrict DevIP - v12+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['devIPmask'] = '';

// Referrer check for backend forms - v12+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.backend.enforceReferrer'] = true;

// =====================================================
// CONTENT SECURITY POLICY (v12.3+)
// =====================================================

// Enable CSP for frontend - v12.3+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.enforceContentSecurityPolicy'] = true;

// CSP for backend (enabled by default) - v12.3+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.backend.enforceContentSecurityPolicy'] = true;

// =====================================================
// TYPO3 v13+ SPECIFIC SETTINGS
// =====================================================

// Force MFA for all admins - v13+ (alternatively via UserTSconfig)
// $GLOBALS['TYPO3_CONF_VARS']['BE']['requireMfa'] = 1; // v13+

// Rate limiting for login attempts - v13+
$GLOBALS['TYPO3_CONF_VARS']['BE']['loginRateLimit'] = 5; // v13+
$GLOBALS['TYPO3_CONF_VARS']['BE']['loginRateLimitInterval'] = '15 minutes'; // v13+
$GLOBALS['TYPO3_CONF_VARS']['FE']['loginRateLimit'] = 10; // v13+
$GLOBALS['TYPO3_CONF_VARS']['FE']['loginRateLimitInterval'] = '15 minutes'; // v13+

// IP lockout after too many failed attempts - v13+
$GLOBALS['TYPO3_CONF_VARS']['BE']['loginRateLimitIpExcludeList'] = ''; // v13+

// Subresource Integrity (SRI) for assets - v13+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.allowSvgScriptExecution'] = false; // v13+

// =====================================================
// TYPO3 v14+ SPECIFIC SETTINGS (upcoming LTS release)
// Attention: May change until the LTS version!
// =====================================================

// Store Install Tool session in Redis - v14+
$GLOBALS['TYPO3_CONF_VARS']['BE']['installToolSessionHandler'] =
    \TYPO3\CMS\Install\Service\Session\RedisSessionHandler::class; // v14+

// Redis connection options - v14+
$GLOBALS['TYPO3_CONF_VARS']['BE']['installToolSessionHandler']['options']['host'] = '127.0.0.1'; // v14+
$GLOBALS['TYPO3_CONF_VARS']['BE']['installToolSessionHandler']['options']['port'] = 6379; // v14+
$GLOBALS['TYPO3_CONF_VARS']['BE']['installToolSessionHandler']['options']['database'] = 2; // v14+

Users & Permissions  

Principle of Least Privilege (PoLP)  

Every user receives only the minimally necessary permissions:

• Editors: Access only to relevant page trees and file areas
• Administrators: No System Maintainer status unless required
• System Maintainers: Restrict to an absolute minimum (1-2 people)

Multi-Factor Authentication (MFA)  

Extension Management  

• Only extensions from trusted sources (TER, Packagist)
• Regular updates of all extensions
• Remove unused extensions – every extension widens the attack surface
• Watch the Security Bulletins for extensions too, not just the Core

The Process after a Report  

When a vulnerability in a TER extension is reported, the Security Team follows the Extension Security Policy:

1. Notification – the Security Team confidentially informs the extension developer
2. Response required – the developer must show that the extension is actively maintained
3. Provide a fix – a patch is developed and tested in a private repository
4. Coordinated release – the Security Bulletin and the new extension version go out together

If the developer doesn't respond: the Security Team publishes a Removal Bulletin and the extension is removed from the TER. (Source)

Security Warnings after Login  

TYPO3 shows security warnings after you log in to the backend. Take them seriously and resolve them promptly:

• Outdated Core version
• Insecure extensions
• Missing configuration

Development 

Developers carry a special responsibility, because insecure code puts the entire installation at risk.

Input Validation  

Validate all inputs on the server side:

• Type checking: Integer, String, Boolean
• Length limits: Maximum character count
• Whitelist: Only accept permitted values
• Encoding: Force UTF-8

Preventing SQL Injection  

// NEVER use string concatenation with user input!
$query = "SELECT * FROM users WHERE email = '" . $userInput . "'";

Preventing XSS  

Fluid escapes output by default. Note the exceptions:

Extbase Security  

• Property Mapping: Only accept explicitly allowed properties
• __trustedProperties: Prevents mass assignment via cryptographic validation
• Validation: Use Extbase validators for domain objects

Editors 

Editors can inadvertently open up security holes through unsafe day-to-day practices.

Secure Content Entry  

• Use the Rich Text Editor instead of direct HTML
• No unknown embeds (YouTube, Twitter, etc.) from untrusted sources
• Check links before inserting them – no redirects to unknown domains
• No scripts inside the RTE (often blocked, but not always)

Upload Guidelines  

• Check file names: No special characters that enable injection
• Observe file size: Report suspiciously large files
• Verify origin: Do not upload files from unknown sources

Phishing Awareness  

• Never share login credentials via e-mail
• Check URL before entering passwords
• Report suspicious e-mails to IT
• If unsure: Ask instead of clicking

Emergency 

No matter how many precautions you take, a compromise can never be ruled out entirely. A clear emergency plan is essential.

Recognising the Signs  

Immediate Measures  

Conduct Analysis  

Recovery  

Recommended approach:

1. Identify a clean backup (created before the attack)
2. Fresh installation on a cleaned server
3. Restore database from backup
4. Update TYPO3 and extensions to the latest versions
5. Close the security hole that allowed the attack
6. Reset all passwords
7. Only then go live

Preventative Measures after Recovery  

• Document and fix the vulnerability
• Conduct a security audit
• Intensify monitoring
• Train the team
• Update incident response plan

Composer & Code Integrity 

Security Advantages  

Secure Update Strategy  

# 1. Create backup
mysqldump -u user -p database > backup.sql

# 2. Update dependencies
composer update typo3/cms-* --with-dependencies

# 3. Conduct security audit
composer audit

# 4. Update database schema
vendor/bin/typo3 database:updateschema

# 5. Flush cache
vendor/bin/typo3 cache:flush

Summary  

Resources  

• TYPO3 Security Guide – Official documentation
• TYPO3 Security Team – Reporting vulnerabilities
• Security Advisories – Current warnings
• ELTS programme – Extended Long Term Support