We make your TYPO3 website more secure

Why You Should Invest in Security and Privacy

• Data misuse: Misuse of data by third parties causes reputational damage and can result in very high fines under the GDPR.
• Server misuse: Websites infected with viruses are often misused for other purposes (e.g. search engine spamming, "cryptojacking", DDoS attacks) and can cause liability damage as well as ranking losses, up to blacklisting by search engines.
• Data loss/dysfunction: While backups usually protect against data loss, a virus infection often goes unnoticed for a long time – by then, even older backups may no longer help. In the worst case, the website has to be completely rebuilt.

Why Is TYPO3 Very Secure by Design?

TYPO3 is considered a particularly secure CMS because security is firmly anchored in the project, both organizationally and technically:

• A dedicated TYPO3 Security Team reviews reported vulnerabilities and publishes coordinated security updates as well as transparent security advisories.
• TYPO3 has a very detailed role and permission system – editors and administrators can be restricted precisely to the pages, files and functions they need.
• Security features such as multi-factor authentication, configurable password policies, access protection and Content Security Policy are built into the system or available via official components.
• Extensive official security guidelines and best practices exist for administrators, developers, integrators and editors.
• As an open-source system, the source code is publicly reviewable – security issues can thus be discovered and transparently fixed by the community and specialized developers.

What matters most, however: TYPO3 is not automatically secure just because it's used. An installation only remains secure if the core, extensions, PHP and server are regularly updated, user permissions are assigned sensibly, and backups, monitoring and security processes are put in place.

Measures to Make the TYPO3 Backend More Secure

To specifically secure the TYPO3 backend, the following measures are especially important:

• Enable multi-factor authentication: Administrators in particular should log in with an authenticator app or another second factor in addition to their password. TYPO3 already supports MFA in the core.
• Assign permissions on the principle of least privilege: Editors should only be able to see and edit the modules, pages, file directories and fields they actually need – ideally via user groups rather than individually.
• Strictly limit admin rights: Regular editors need neither administrator nor system maintainer rights. Technically responsible staff should also work with a restricted account wherever possible.
• Use personal user accounts: No shared logins – this way, changes and incidents can be clearly attributed to a specific person.
• Disable accounts that are no longer needed immediately: Access for former employees, agencies or service providers must be revoked promptly.
• Require strong, unique passwords: No reuse across TYPO3 systems and no identical passwords for the backend and Install Tool.
• Run the backend exclusively over HTTPS: Unencrypted connections or invalid certificates are unacceptable, as credentials could otherwise be intercepted.
• Limit login attempts: Enable the built-in rate limiting against brute-force attacks.
• Additionally restrict backend access: Depending on the organization, e.g. via VPN, IP allowlisting, reverse proxy, or upstream access controls.
• Monitor logins and activity: Failed login attempts, active sessions and unusual access should be checked regularly.
• Keep the core and extensions up to date: Security updates for TYPO3, extensions, PHP and server components must be installed promptly.
• Restrict file access: File mounts and file operations must be configured so that editors can only access their designated directories.
• Carry out regular user and permission reviews: At least annually, and after staffing or role changes.

How We Protect Your Website Visitors

To make the TYPO3 frontend more secure and, in particular, to protect visitors, the following measures are important:

• Consistently enforce HTTPS: The entire website, forms, downloads and embedded resources must be transmitted encrypted – HSTS additionally prevents an accidental fallback to HTTP.
• Set up a Content Security Policy: A CSP defines which sources scripts, stylesheets, images, frames and forms may be loaded from, making cross-site scripting and data theft harder. TYPO3 already supports CSP via its own API.
• Set additional security headers: Protection against clickjacking, a secure referrer policy, X-Content-Type-Options, and a restrictive permissions policy reduce various attack surfaces.
• Secure forms in particular: Validate and filter input server-side and escape it on output; use CSRF protection, spam protection, size limits and, where relevant, rate limiting.
• Don't unnecessarily request sensitive data: Contact forms should only collect information that is actually needed.
• Strictly control file uploads: Only allow required file types, limit file sizes, regenerate file names, and store uploads outside directly executable web directories.
• Configure cookies securely: Set Secure, HttpOnly and an appropriate SameSite value on session and login cookies.
• Reduce external services: Analytics, video, map, font or social media services increase the attack surface and should only be loaded after review and, where applicable, only after consent.
• Review JavaScript and third-party code: Outdated libraries, widgets and tracking scripts can cause security vulnerabilities – remove scripts that aren't needed and keep dependencies up to date.
• Keep TYPO3 and extensions up to date: Install security updates for TYPO3, extensions, PHP, web server and operating system promptly; replace or remove unmaintained extensions.
• Limit error messages: Visitors must not be able to see PHP errors, database messages, file paths or stack traces.
• Control downloads and protected content: Confidential files must not be protected solely by a hard-to-guess URL.

We Review Your Privacy Policy

As part of a review of your privacy policy, we offer the following services:

• Comparing the privacy policy with the cookies, tracking tools and consent management actually in use
• Reviewing embedded third parties such as Google Maps, YouTube, Vimeo, social media, fonts or CDN services
• Checking contact forms, newsletter sign-ups, application forms and file uploads
• Determining which personal data is technically transmitted, stored or logged
• Analyzing server log files, IP addresses, retention periods and hosting providers
• Reviewing web analytics systems such as Matomo or Google Analytics
• Checking external scripts, iframes and API connections
• Comparing the cookies and retention periods stated in the policy with the cookies actually set
• Checking whether services are loaded before consent is given
• Checking privacy notices directly on forms and consent fields
• Identifying missing or outdated information about technical service providers
• Documenting identified discrepancies and concrete recommendations for action

Introducing a Professional Backup Strategy

An important part of running a website with as little downtime as possible is maintaining a backup. Since functional errors, data loss or malicious code are usually only detected late, backups should be available not just from the previous day but over a longer period. We recommend the following backup intervals:

• a daily backup
• a backup from the last 7 days
• a backup from the last month
• a backup from the last six months
• a backup from the last 12 months

Important Legal Basics

TYPO3 and GDPR

TYPO3 provides a good technical foundation for GDPR-compliant websites, for example through flexible cookie and consent solutions, controlled data processing and detailed user permissions. What matters is the specific configuration, especially for forms, tracking, external services, and the storage of personal data.

TYPO3 and NIS2

NIS2 imposes higher requirements on cybersecurity, risk management and reporting processes – including for organizations that use TYPO3 as a central web system. What matters is secure configuration, regular updates, clear responsibilities and documented security measures.