The security of a TYPO3 installation is the result of a shared responsibility among all involved parties – system administrators, integrators, developers, and editors. This guide is based on the official TYPO3 Security Guide and summarises all relevant security measures.

Table of Contents  

Quick Checklist  

Sorted by priority – critical measures first.

Critical – Implement Immediately  

High – Authentication & Access  

Medium – Infrastructure  

Maintenance & Recovery  

TYPO3 Security Team 

The TYPO3 Security Team is responsible for coordinating and communicating security vulnerabilities across the entire TYPO3 ecosystem.

Versions & Updates 

Choosing the right TYPO3 version and maintaining a consistent update strategy are fundamental security decisions.

Support Cycles  

Update Categories  

Threat Types 

To effectively protect TYPO3 systems, the most common attack vectors must be understood.

General Guidelines 

These fundamental principles apply to all roles and form the foundation of any security strategy.

Password Hygiene  

Staying Informed  

• Security Bulletins: typo3.org/security
• Newsletter: Subscribe to TYPO3 Security Announcements
• RSS Feed: Automatic notification of new advisories

Client Security  

All devices accessing the TYPO3 backend must be secured:

• Keep operating system and browser up to date
• Activate antivirus software and firewall
• No installation of software from unknown sources
• VPN for access from public networks

System Administration 

System administrators are responsible for the server infrastructure and thus the basis of all security measures.

HTTPS Encryption  

• TLS 1.2 as a minimum, TLS 1.3 preferred
• Let's Encrypt for free certificates
• Set HSTS header (forces HTTPS)
• [BE][lockSSL] = true in TYPO3 configuration

File Permissions  

Correct permissions prevent unauthorised access:

HTTP Access Restriction  

Block access to sensitive files and directories:

# Block configuration files
location ~* /.*\.(?:bak|conf|cfg|yaml|yml|ts|sql|sqlite)$ {
    deny all;
}

# Block Composer files
location ~* composer\.(?:json|lock) {
    deny all;
}

# Block vendor and typo3_src
location ~ ^(?:vendor|typo3_src|typo3temp/var) {
    deny all;
}

# Block private extension directories
location ~ /(?:Configuration|Resources/Private|Tests)/ {
    deny all;
}

Disable Directory Indexing  

Disable automatic directory listing to avoid information leaks:

Options -Indexes

autoindex off;

Security Headers  

HTTP security headers are an important layer of defence against various attacks. The web server sends them and instructs the browser on secure behaviour.

Recommended Headers  

Configuration  

# Security Headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

# Content-Security-Policy (adjust!)
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; frame-ancestors 'self';" always;

Verification  

Test your security headers with these tools:

• securityheaders.com – Quick analysis
• Mozilla Observatory – Comprehensive security check
• Browser DevTools → Network → Response Headers

Database Security  

Backup Strategy  

The official TYPO3 documentation recommends a tiered backup strategy:

Integration & Configuration 

Integrators configure TYPO3 and are responsible for secure system settings.

Install Tool Security  

The Install Tool allows deep system changes and requires special protection:

1. ENABLE_INSTALL_TOOL file in var/transient/ (Composer) or typo3temp/var/transient/ (classic)
2. Separate password (not the admin password!)
3. Auto-deletion after 60 minutes of inactivity

Application Context (TYPO3_CONTEXT)  

The Application Context allows different configurations for different environments. This is critical for security, as debugging options should only be active in development environments.

Recommended Contexts  

Configuration  

# .htaccess
SetEnv TYPO3_CONTEXT Production

Context-Specific Configuration  

TYPO3 automatically loads additional configuration files based on the context:

config/system/
├── settings.php              # Base configuration
├── additional.php            # Additional settings
└── additional_Production.php # Loaded only in Production
└── additional_Development.php # Loaded only in Development

Official documentation: Application Context

Local Development with DDEV  

DDEV is the recommended development environment for TYPO3 projects. The container-based solution offers significant security advantages over classic LAMP setups.

# New project
mkdir my-typo3-project && cd my-typo3-project
ddev config --project-type=typo3 --php-version=8.2
ddev start
ddev composer create "typo3/cms-base-distribution:^12"
ddev launch

Global Configuration  

All security-relevant settings in config/system/settings.php or config/system/additional.php:

<?php
// =====================================================
// BACKEND SECURITY (v12+)
// =====================================================

// Force HTTPS for backend (CRITICAL) - v12+
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockSSL'] = true;

// Security warnings via e-mail - v12+
$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr'] = 'security@example.com';
$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_mode'] = 2;

// Session security - v12+
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockIP'] = 4;
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockIPv6'] = 8;
$GLOBALS['TYPO3_CONF_VARS']['BE']['sessionTimeout'] = 3600;

// Cookie security - v12+
$GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite'] = 'strict';

// Password hashing - v12+ (Argon2id is the most secure algorithm)
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']['className'] = 
    \TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2idPasswordHash::class;

// Password policies - v12+ (configurable password policies)
$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy'] = 'default';

// =====================================================
// FRONTEND SECURITY (v12+)
// =====================================================

// Prevent cache poisoning (CRITICAL) - v12+
$GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['enforceValidation'] = true;

// Frontend session security - v12+
$GLOBALS['TYPO3_CONF_VARS']['FE']['lockIP'] = 2;
$GLOBALS['TYPO3_CONF_VARS']['FE']['lockIPv6'] = 2;

// Frontend password policies - v12+
$GLOBALS['TYPO3_CONF_VARS']['FE']['passwordPolicy'] = 'default';

// =====================================================
// SYSTEM SECURITY (v12+)
// =====================================================

// Trusted Hosts Pattern (CRITICAL) - v12+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] = 
    'www\.example\.com|example\.com';

// Do not show errors in frontend (CRITICAL) - v12+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['displayErrors'] = 0;

// Restrict DevIP - v12+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['devIPmask'] = '';

// Referrer check for backend forms - v12+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.backend.enforceReferrer'] = true;

// =====================================================
// CONTENT SECURITY POLICY (v12.3+)
// =====================================================

// Enable CSP for frontend - v12.3+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.enforceContentSecurityPolicy'] = true;

// Enable CSP for backend (active by default) - v12.3+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.backend.enforceContentSecurityPolicy'] = true;

// =====================================================
// TYPO3 v13+ SPECIFIC SETTINGS
// =====================================================

// Force MFA for all admins - v13+ (alternatively via UserTSconfig)
// $GLOBALS['TYPO3_CONF_VARS']['BE']['requireMfa'] = 1; // v13+

// Rate limiting for login attempts - v13+
$GLOBALS['TYPO3_CONF_VARS']['BE']['loginRateLimit'] = 5; // v13+
$GLOBALS['TYPO3_CONF_VARS']['BE']['loginRateLimitInterval'] = '15 minutes'; // v13+
$GLOBALS['TYPO3_CONF_VARS']['FE']['loginRateLimit'] = 5; // v13+
$GLOBALS['TYPO3_CONF_VARS']['FE']['loginRateLimitInterval'] = '15 minutes'; // v13+

// IP lockout after too many failed attempts - v13+
$GLOBALS['TYPO3_CONF_VARS']['BE']['loginRateLimitIpExcludeList'] = ''; // v13+

// Subresource Integrity (SRI) for assets - v13+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.allowSvgScriptExecution'] = false; // v13+

// =====================================================
// TYPO3 v14+ SPECIFIC SETTINGS (Sprint Release)
// Warning: May change before the LTS version!
// =====================================================

// Store Install Tool session in Redis - v14+
$GLOBALS['TYPO3_CONF_VARS']['BE']['installToolSessionStorageBackend'] = 
    \TYPO3\CMS\Install\Service\Session\RedisSessionStorage::class; // v14+

// Redis authentication with username/password - v14+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['redis']['hostname'] = '127.0.0.1'; // v14+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['redis']['port'] = 6379; // v14+
$GLOBALS['TYPO3_CONF_VARS']['SYS']['redis']['username'] = 'typo3'; // v14+ (Redis 6+)
$GLOBALS['TYPO3_CONF_VARS']['SYS']['redis']['password'] = 'secure-password'; // v14+

Users & Permissions  

Principle of Least Privilege (PoLP)  

Every user receives only the minimum necessary privileges:

• Editors: Access only to relevant page trees and file areas
• Administrators: No System Maintainer status unless required
• System Maintainers: Restrict to the absolute minimum (1-2 people)

Multi-Factor Authentication (MFA)  

Extension Management  

• Only extensions from trusted sources (TER, Packagist)
• Regular updates of all extensions
• Remove unused extensions – every extension expands the attack surface
• Monitor security bulletins for extensions too

The process after a report  

When a security vulnerability in a TER extension is reported, the Security Team follows the Extension Security Policy:

1. Notification – Security Team confidentially informs the extension developer
2. Reaction required – Developer must demonstrate that the extension is actively maintained
3. Provide fix – Patch is developed and tested in a private repository
4. Coordinated release – Security bulletin + new extension version simultaneously

If there is no reaction: The Security Team publishes a Removal Bulletin and the extension is removed from the TER. (Source)

Security Warnings after Login  

TYPO3 displays security warnings after backend login. Take these seriously and resolve them promptly:

• Outdated core version
• Insecure extensions
• Missing configuration

Extension Development 

Developers bear a special responsibility, as insecure code endangers the entire installation.

Input Validation  

Validate all input server-side:

• Type check: Integer, String, Boolean
• Length limits: Maximum number of characters
• Whitelist: Accept only permitted values
• Encoding: Force UTF-8

Preventing SQL Injection  

// NEVER use string concatenation with user input!
$query = "SELECT * FROM users WHERE email = '" . $userInput . "'";

Preventing XSS  

Fluid escapes output by default. Note the exceptions:

Extbase Security  

• Property Mapping: Accept only explicitly permitted properties
• __trustedProperties: Prevents mass assignment through cryptographic validation
• Validation: Use Extbase Validators for domain objects

Editor Security 

Editors can also expose security vulnerabilities through unsafe behaviour.

Secure Content Entry  

• Use the Rich Text Editor instead of raw HTML
• No unknown embeds (YouTube, Twitter, etc.) from insecure sources
• Check links before inserting – no redirects to unknown domains
• No scripts in the RTE (they are often blocked, but not always)

Upload Guidelines  

• Check file names: No special characters that enable injection
• Observe file sizes: Report suspiciously large files
• Verify origin: Do not upload files from unknown sources

Phishing Awareness  

• Never share login credentials via e-mail
• Check the URL before entering passwords
• Report suspicious e-mails to IT
• If unsure: Ask instead of clicking

After an Attack 

Despite all precautions, a compromise can never be entirely ruled out. A clear emergency plan is essential.

Recognising Signs  

Immediate Actions  

Conducting Analysis  

Recovery  

Recommended procedure:

1. Identify a clean backup (created before the attack)
2. Fresh installation on a cleaned server
3. Restore the database from backup
4. Update TYPO3 and extensions to the latest versions
5. Close the security vulnerability that allowed the attack
6. Renew all passwords
7. Only then go online

Preventive Measures after Recovery  

• Document and resolve the vulnerability
• Conduct a security audit
• Intensify monitoring
• Train the team
• Update the incident response plan

Composer & Code Integrity 

Security Advantages  

Secure Update Strategy  

# 1. Create a backup
mysqldump -u user -p database > backup.sql

# 2. Update dependencies
composer update typo3/cms-* --with-dependencies

# 3. Perform a security audit
composer audit

# 4. Update database schema
vendor/bin/typo3 database:updateschema

# 5. Flush caches
vendor/bin/typo3 cache:flush

Summary  

Resources  

• TYPO3 Security Guide – Official documentation
• TYPO3 Security Team – Report vulnerabilities
• Security Advisories – Current warnings
• ELTS programme – Extended Long Term Support