---
title: "SYS - System configuration"
manual: "TYPO3 Explained"
version: "11.5"
permalink: "https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys@11.5"
source: "Configuration/Typo3ConfVars/SYS.rst"
rendered: "2026-10-21T15:30:00+00:00"
---

> [!WARNING]
> **Attention**
>
> TYPO3 v11 has reached end-of-life as of October 31th 2024 and
> is no longer being maintained. Use the version switcher on the top
> left of this page to select documentation for a supported version of TYPO3.
>
> Need more time before upgrading?
> You can purchase Extended Long Term Support (ELTS) for TYPO3 v11 here:
> [TYPO3 ELTS](https://typo3.com/services/extended-support-elts).

# SYS - System configuration {#typo3confvars-sys}

The following configuration variables can be used for system wide
configurations.

-   [fileCreateMask](https://docs.typo3.org/permalink/t3coreapi:filecreatemask@11.5)
-   [folderCreateMask](https://docs.typo3.org/permalink/t3coreapi:foldercreatemask@11.5)
-   [createGroup](https://docs.typo3.org/permalink/t3coreapi:creategroup@11.5)
-   [sitename](https://docs.typo3.org/permalink/t3coreapi:sitename@11.5)
-   [defaultScheme](https://docs.typo3.org/permalink/t3coreapi:defaultscheme@11.5)
-   [encryptionKey](https://docs.typo3.org/permalink/t3coreapi:encryptionkey@11.5)
-   [cookieDomain](https://docs.typo3.org/permalink/t3coreapi:cookiedomain@11.5)
-   [trustedHostsPattern](https://docs.typo3.org/permalink/t3coreapi:trustedhostspattern@11.5)
-   [devIPmask](https://docs.typo3.org/permalink/t3coreapi:devipmask@11.5)
-   [ddmmyy](https://docs.typo3.org/permalink/t3coreapi:ddmmyy@11.5)
-   [hhmm](https://docs.typo3.org/permalink/t3coreapi:hhmm@11.5)
-   [$GLOBALS['TYPO3_CONF_VARS']['SYS']['USdateFormat']](https://docs.typo3.org/permalink/t3coreapi:globals-typo3-conf-vars-sys-usdateformat@11.5)
-   [loginCopyrightWarrantyProvider](https://docs.typo3.org/permalink/t3coreapi:logincopyrightwarrantyprovider@11.5)
-   [loginCopyrightWarrantyURL](https://docs.typo3.org/permalink/t3coreapi:logincopyrightwarrantyurl@11.5)
-   [textfile_ext](https://docs.typo3.org/permalink/t3coreapi:textfile-ext@11.5)
-   [mediafile_ext](https://docs.typo3.org/permalink/t3coreapi:mediafile-ext@11.5)
-   [binPath](https://docs.typo3.org/permalink/t3coreapi:binpath@11.5)
-   [binSetup](https://docs.typo3.org/permalink/t3coreapi:binsetup@11.5)
-   [setMemoryLimit](https://docs.typo3.org/permalink/t3coreapi:setmemorylimit@11.5)
-   [phpTimeZone](https://docs.typo3.org/permalink/t3coreapi:phptimezone@11.5)
-   [UTF8filesystem](https://docs.typo3.org/permalink/t3coreapi:utf8filesystem@11.5)
-   [systemLocale](https://docs.typo3.org/permalink/t3coreapi:systemlocale@11.5)
-   [reverseProxyIP](https://docs.typo3.org/permalink/t3coreapi:reverseproxyip@11.5)
-   [reverseProxyHeaderMultiValue](https://docs.typo3.org/permalink/t3coreapi:reverseproxyheadermultivalue@11.5)
-   [reverseProxyPrefix](https://docs.typo3.org/permalink/t3coreapi:reverseproxyprefix@11.5)
-   [reverseProxySSL](https://docs.typo3.org/permalink/t3coreapi:reverseproxyssl@11.5)
-   [reverseProxyPrefixSSL](https://docs.typo3.org/permalink/t3coreapi:reverseproxyprefixssl@11.5)
-   [$GLOBALS['TYPO3_CONF_VARS']['SYS']['defaultCategorizedTables']](https://docs.typo3.org/permalink/t3coreapi:globals-typo3-conf-vars-sys-defaultcategorizedtables@11.5)
-   [displayErrors](https://docs.typo3.org/permalink/t3coreapi:displayerrors@11.5)
-   [productionExceptionHandler](https://docs.typo3.org/permalink/t3coreapi:productionexceptionhandler@11.5)
-   [debugExceptionHandler](https://docs.typo3.org/permalink/t3coreapi:debugexceptionhandler@11.5)
-   [errorHandler](https://docs.typo3.org/permalink/t3coreapi:errorhandler@11.5)
-   [errorHandlerErrors](https://docs.typo3.org/permalink/t3coreapi:errorhandlererrors@11.5)
-   [exceptionalErrors](https://docs.typo3.org/permalink/t3coreapi:exceptionalerrors@11.5)
-   [belogErrorReporting](https://docs.typo3.org/permalink/t3coreapi:belogerrorreporting@11.5)
-   [generateApacheHtaccess](https://docs.typo3.org/permalink/t3coreapi:generateapachehtaccess@11.5)
-   [ipAnonymization](https://docs.typo3.org/permalink/t3coreapi:ipanonymization@11.5)
-   [systemMaintainers](https://docs.typo3.org/permalink/t3coreapi:systemmaintainers@11.5)
-   [features](https://docs.typo3.org/permalink/t3coreapi:features@11.5)
-   [availablePasswordHashAlgorithms](https://docs.typo3.org/permalink/t3coreapi:availablepasswordhashalgorithms@11.5)
-   [linkHandler](https://docs.typo3.org/permalink/t3coreapi:linkhandler@11.5)

> [!NOTE]
> The configuration values listed here are keys in the global PHP array
> `$GLOBALS['TYPO3_CONF_VARS']['SYS']`.
>
> This variable can be set in one of the following files:
>
> -   [typo3conf/LocalConfiguration.php](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-localconfiguration@11.5)
> -   [typo3conf/AdditionalConfiguration.php](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-additionalconfiguration@11.5)

## fileCreateMask {#typo3confvars-sys-filecreatemask}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['fileCreateMask'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* 0664

    File mode mask for Unix file systems (when files are uploaded/created).

## folderCreateMask {#typo3confvars-sys-foldercreatemask}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['folderCreateMask'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* 2775

    As above, but for folders.

## createGroup {#typo3confvars-sys-creategroup}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['createGroup'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    Group for newly created files and folders (Unix only). Group ownership can
    be changed on Unix file systems (see above). Set this if you want to change
    the group ownership of created files/folders to a specific group.

    This makes sense in all cases where the webserver is running with a
    different user/group as you do. Create a new group on your system and add
    you and the webserver user to the group. Now you can safely set the last
    bit in fileCreateMask/folderCreateMask to 0 (for example 770). Important: The
    user who is running your webserver needs to be a member of the group you
    specify here! Otherwise you might get some error messages.

## sitename {#typo3confvars-sys-sitename}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['sitename'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* 'TYPO3'

    Name of the base-site.

## defaultScheme {#typo3confvars-sys-defaultscheme}

<!-- TODO: no Markdown rendering for "versionadded" -->

The setting defaultScheme was added in TYPO3 v12 to make it possible to
configure the default URI scheme when links are created by the Core.
Previously, 'http' was always used.

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['defaultScheme'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* 'http'

    Set the default URI scheme. This is used within links if no scheme is given.
    One can set this to `'https'` if this should be used by default.

## encryptionKey {#typo3confvars-sys-encryptionkey}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['encryptionKey'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    This is a "salt" used for various kinds of encryption, CRC checksums and
    validations. You can enter any rubbish string here but try to keep it
    secret. You should notice that a change to this value might invalidate
    temporary information, URLs etc. At least, clear all cache if you change
    this so any such information can be rebuilt with the new key.

## cookieDomain {#typo3confvars-sys-cookiedomain}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['cookieDomain'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    Restricts the domain name for FE and BE session cookies. When setting the
    value to ".example.org" (replace example.org with your domain!), login
    sessions will be shared across subdomains. Alternatively, if you have more
    than one domain with sub-domains, you can set the value to a regular
    expression to match against the domain of the HTTP request. This however requires
    that all sub-domains are within the same TYPO3 instance, because a session can be tied
    to only one database.

    The result of the match is used as the domain for the cookie. for example :
    php:`/.(example1|example2).com$/` or `/\.(example1\.com)|(example2\.net)$/`.
    Separate domains for FE and BE can be set using
    [$TYPO3_CONF_VARS\[FE\]\[cookieDomain\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-fe-cookiedomain@11.5) and
    [$TYPO3_CONF_VARS\[BE\]\[cookieDomain\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-be-cookiedomain@11.5)
    respectively.

## trustedHostsPattern {#typo3confvars-sys-trustedhostspattern}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['trustedHostsPattern'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* 'SERVER_NAME'

    Regular expression pattern that matches all allowed hostnames (including
    their ports) of this TYPO3 installation, or the string `SERVER_NAME`
    (default).

    The default value `SERVER_NAME` checks if the HTTP Host header equals
    the SERVER_NAME and SERVER_PORT. This is secure in correctly configured
    hosting environments and does not need further configuration. If you cannot
    change your hosting environment, you can enter a regular expression here.

    Examples:

    `.*\.example\.org` matches all hosts that end with
    `.example.org` with all corresponding subdomains.

    `.*\.example\.(org|com)` matches all hostnames with
    subdomains from `.example.org` and `.example.com`.

    Be aware that HTTP Host header may also contain a port. If your installation

    runs on a specific port, you need to explicitly allow this in your pattern,

    for example `example\.org:88` allows only `example.org:88`,
    **not** `example.org`. To disable this check completely
    (not recommended because it is **insecure**) you can use `.*` as pattern.

    Have also a look into the [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-trustedhostspattern@11.5).

## devIPmask {#typo3confvars-sys-devipmask}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['devIPmask'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* '127.0.0.1,::1'

    Defines a list of IP addresses which will allow development output to
    display. The `debug()` function will use this as a filter. See the
    function `\TYPO3\CMS\Core\Utility\GeneralUtilitycmpIP()` for details
    on syntax. Setting this to blank value will deny all.
    Setting to "\*" will allow all.

    Have also a look into the [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-devipmask@11.5).

## ddmmyy {#typo3confvars-sys-ddmmyy}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['ddmmyy'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* 'd-m-y'

    Format of Day-Month-Year - see PHP-function [date()](https://www.php.net/manual/en/function.date.php)

## hhmm {#typo3confvars-sys-hhmm}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['hhmm'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* 'H:i'

    Format of Hours-Minutes - see PHP-function [date()](https://www.php.net/manual/en/function.date.php)

## $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['USdateFormat'\] {#typo3confvars-sys-usdateformat}

-   **USdateFormat**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* bool
    -   *Default:* false

    If `TRUE`, dates entered in the TCEforms of the backend will be
    formatted `mm-dd-yyyy`

## loginCopyrightWarrantyProvider {#typo3confvars-sys-logincopyrightwarrantyprovider}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['loginCopyrightWarrantyProvider'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    If you provide warranty for TYPO3 to your customers insert you (company)
    name here. It will appear in the login-dialog as the warranty provider.
    (You must also set URL below).

## loginCopyrightWarrantyURL {#typo3confvars-sys-logincopyrightwarrantyurl}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['loginCopyrightWarrantyURL'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    Add the URL where you explain the extend of the warranty you provide.
    This URL is displayed in the login dialog as the place where people can
    learn more about the conditions of your warranty. Must be set
    (more than 10 chars) in addition with the
    [loginCopyrightWarrantyProvider](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-logincopyrightwarrantyprovider@11.5)
    message.

## textfile_ext {#typo3confvars-sys-textfile-ext}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['textfile_ext'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* 'txt,ts,typoscript,html,htm,css,tmpl,js,sql,xml,csv,xlf,yaml,yml'

    Text file extensions. Those that can be edited. Executable PHP files may not
    be editable if disallowed!

## mediafile_ext {#typo3confvars-sys-mediafile-ext}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['mediafile_ext'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* 'gif,jpg,jpeg,bmp,png,pdf,svg,ai,mp3,wav,mp4,ogg,flac,opus,webm,youtube,vimeo'

    Commalist of file extensions perceived as media files by TYPO3.
    Must be written in lower case with no spaces between.

## binPath {#typo3confvars-sys-binpath}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['binPath'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    List of absolute paths where external programs should be searched for.
    for example `/usr/local/webbin/,/home/xyz/bin/`. (ImageMagick path have to
    be configured separately)

## binSetup {#typo3confvars-sys-binsetup}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['binSetup'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* multiline
    -   *Default:* ''

    List of programs (separated by newline or comma). By default programs
    will be searched in default paths and the special paths defined by
    [binPath](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-binpath@11.5). When PHP has `openbasedir`
    enabled, the programs can not be found and have to be configured here.

    Example: `perl=/usr/bin/perl,unzip=/usr/local/bin/unzip`

## setMemoryLimit {#typo3confvars-sys-setmemorylimit}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['setMemoryLimit'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* int
    -   *Default:*

    Memory limit in MB: If more than 16, TYPO3 will try to use `ini_set()`
    to set the memory limit of PHP to the value. This works only if the function
    `ini_set()` is not disabled by your sysadmin.

## phpTimeZone {#typo3confvars-sys-phptimezone}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['phpTimeZone'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    Timezone to force for all `date()` and `mktime()` functions.
    A list of supported values can be found at
    [php.net](https://www.php.net/manual/en/timezones.php).

    If blank, a valid fallback will be searched for by PHP (php.inis
    [date.timezone](https://www.php.net/manual/en/datetime.configuration.php#ini.date.timezone)
    setting, server defaults, etc); and if no fallback is found, the value of
    "UTC" is used instead.

## UTF8filesystem {#typo3confvars-sys-utf8filesystem}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['UTF8filesystem'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* bool
    -   *Default:* false

    If TRUE then TYPO3 uses utf-8 to store file names. This allows for accented
    latin letters as well as any other non-latin characters like Cyrillic and
    Chinese.

    **IMPORTANT** This requires a UTF-8 compatible locale in order to work.
    Otherwise problems with filenames containing special characters will occur.
    See [\[SYS\]\[systemLocale\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-utf8filesystem@11.5) and
    [php function setlocale()](https://www.php.net/manual/en/function.setlocale.php).

## systemLocale {#typo3confvars-sys-systemlocale}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['systemLocale'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    Locale used for certain system related functions, for example escaping shell
    commands. If problems with filenames containing special characters occur,
    the value of this option is probably wrong. See
    [php function setlocale()](https://www.php.net/manual/en/function.setlocale.php).

## reverseProxyIP {#typo3confvars-sys-reverseproxyip}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['reverseProxyIP'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* list
    -   *Default:* ''

    List of IP addresses. If TYPO3 is behind one or more (intransparent) reverse
    proxies the IP addresses must be added here.

## reverseProxyHeaderMultiValue {#typo3confvars-sys-reverseproxyheadermultivalue}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['reverseProxyHeaderMultiValue'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *allowedValues:*

        -   **none**

            Do not evaluate the reverse proxy header

        -   **first**

            Use the first IP address in the proxy header

        -   **last**

            Use the last IP address in the proxy header

    -   *Default:* 'none'

    Defines which values of a proxy header (for example HTTP_X_FORWARDED_FOR) to use,
    if more than one is found.

## reverseProxyPrefix {#typo3confvars-sys-reverseproxyprefix}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['reverseProxyPrefix'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    Optional prefix to be added to the internal URL (SCRIPT_NAME and
    REQUEST_URI).

    Example: When proxying `external.example.org` to `internal.example.org/prefix` this has to
    be set to `prefix`

## reverseProxySSL {#typo3confvars-sys-reverseproxyssl}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['reverseProxySSL'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    `*` or a list of IP addresses of proxies that use SSL (https) for
    the connection to the client, but an unencrypted connection (http) to
    the server. If php:`*` all proxies defined in
    [\[SYS\]\[reverseProxyIP\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-reverseproxyip@11.5) use SSL.

## reverseProxyPrefixSSL {#typo3confvars-sys-reverseproxyprefixssl}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['reverseProxyPrefixSSL'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* text
    -   *Default:* ''

    Prefix to be added to the internal URL (SCRIPT_NAME and REQUEST_URI)
    when accessing the server via an SSL proxy. This setting overrides
    [\[SYS\]\[reverseProxyPrefix\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-reverseproxyprefix@11.5).

## $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['defaultCategorizedTables'\] {#typo3confvars-sys-defaultcategorizedtables}

-   **defaultCategorizedTables**

    -   *type:* list
    -   *Default:* ''

    List of comma separated tables that are categorizable by default.

## displayErrors {#typo3confvars-sys-displayerrors}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['displayErrors'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* int
    -   *Default:* -1
    -   *allowedValues:*

        -   **`-1`**

            TYPO3 does not touch the PHP setting. If
            [\[SYS\]\[devIPmask\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-devipmask@11.5) matches the users
            IP address, the configured
            [\[SYS\]\[debugExceptionHandler\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-debugexceptionhandler@11.5)
            is used instead of the
            [\[SYS\]\[productionExceptionHandler\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-productionexceptionhandler@11.5)
            to handle exceptions.

        -   **`0`**

            Live: Do not display any PHP error message. Sets `display_errors=0`.
            Overrides the value of
            [\[SYS\]\[exceptionalErrors\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-exceptionalerrors@11.5)
            and sets it to 0
            (= no errors are turned into exceptions). The configured
            [\[SYS\]\[productionExceptionHandler\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-productionexceptionhandler@11.5)
            is used as exception handler.

        -   **`1`**

            Debug: Display error messages with the registered
            [\[SYS\]\[errorHandler\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-errorhandler@11.5).
            Sets `display_errors=1`. The configured
            [\[SYS\]\[debugExceptionHandler\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-debugexceptionhandler@11.5)
            is used as exception handler.

    Configures whether PHP errors or exceptions should be displayed,
    effectively setting the PHP option `display_errors` during runtime.

    Have also a look into the [security guidelines](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options-displayerrors@11.5).

## productionExceptionHandler {#typo3confvars-sys-productionexceptionhandler}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['productionExceptionHandler'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* phpClass
    -   *Default:* `\TYPO3\CMS\Core\Error\ProductionExceptionHandler::class`

    Classname to handle exceptions that might happen in the TYPO3-code. Leave
    this empty to disable exception handling.  The default exception handler displays
    a nice error message when something goes wrong. The error message is
    logged to the configured logs.

    Note: The configured "productionExceptionHandler" is used if
    [\[SYS\]\[displayErrors\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-displayerrors@11.5) is set to "0"
    or is set to "-1" and
    [\[SYS\]\[devIPmask\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-devipmask@11.5) doesnt match the user's IP.

## debugExceptionHandler {#typo3confvars-sys-debugexceptionhandler}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['debugExceptionHandler'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* phpClass
    -   *Default:* `\TYPO3\CMS\Core\Error\DebugExceptionHandler::class`

    Classname to handle exceptions that might happen in the TYPO3 code. Leave
    empty to disable the exception handling. The default exception handler
    displays the complete stack trace of any encountered exception. The error
    message and the stack trace is logged to the configured logs.

    Note: The configured "debugExceptionHandler" is used if
    [\[SYS\]\[displayErrors\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-displayerrors@11.5) is set to "1" or
    is set to "-1" or "2" and the [\[SYS\]\[devIPmask\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-devipmask@11.5)
    matches the users IP.

## errorHandler {#typo3confvars-sys-errorhandler}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['errorHandler'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* phpClass
    -   *Default:* `TYPO3CMSCoreErrorErrorHandler::class`

    Classname to handle PHP errors.
    This class displays and logs all errors that are registered as
    [\[SYS\]\[errorHandlerErrors\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-errorhandlererrors@11.5).
    Leave empty to disable error handling. Errors will be logged and can be sent
    to the optionally installed developer log or to the `syslog` database table.
    If an error is registered in
    [\[SYS\]\[exceptionalErrors\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-exceptionalerrors@11.5)
    it will be turned into an exception to be handled by the configured
    exceptionHandler.

## errorHandlerErrors {#typo3confvars-sys-errorhandlererrors}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['errorHandlerErrors'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* errors
    -   *Default:* `E_ALL & ~(E_STRICT | E_NOTICE | E_COMPILE_WARNING | E_COMPILE_ERROR | E_CORE_WARNING | E_CORE_ERROR | E_PARSE | E_ERROR)`

    The E\_\* constants that will be handled by the
    [\[SYS\]\[errorHandler\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-errorhandler@11.5). Not all PHP error
    types can be handled:

    `E_USER_DEPRECATED` will always be handled, regardless of this setting.
    Default is 30466 =
    `E_ALL & ~(E_STRICT | E_NOTICE | E_COMPILE_WARNING | E_COMPILE_ERROR | E_CORE_WARNING | E_CORE_ERROR | E_PARSE | E_ERROR)`
    (see [PHP documentation](https://www.php.net/manual/en/errorfunc.constants.php)).

## exceptionalErrors {#typo3confvars-sys-exceptionalerrors}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['exceptionalErrors'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* errors
    -   *Default:* `E_ALL & ~(E_STRICT | E_NOTICE | E_COMPILE_WARNING | E_COMPILE_ERROR | E_CORE_WARNING | E_CORE_ERROR | E_PARSE | E_ERROR | E_DEPRECATED | E_USER_DEPRECATED | E_WARNING | E_USER_ERROR | E_USER_NOTICE | E_USER_WARNING)`

    The E\_\* constant that will be converted into an exception by the default
    [\[SYS\]\[errorHandler\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-sys-errorhandler@11.5). Default is
    4096 = `E_ALL & ~(E_STRICT | E_NOTICE | E_COMPILE_WARNING | E_COMPILE_ERROR | E_CORE_WARNING | E_CORE_ERROR | E_PARSE | E_ERROR | E_DEPRECATED | E_USER_DEPRECATED | E_WARNING | E_USER_ERROR | E_USER_NOTICE | E_USER_WARNING)`
    (see [PHP documentation](https://www.php.net/manual/en/errorfunc.constants.php)).

    E_USER_DEPRECATED is always excluded to avoid exceptions to be thrown for deprecation messages.

## belogErrorReporting {#typo3confvars-sys-belogerrorreporting}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['belogErrorReporting'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* errors
    -   *Default:* `E_ALL & ~(E_STRICT | E_NOTICE)`

    Configures which PHP errors should be logged to the "syslog" database table
    (extension belog). If set to "0" no PHP errors are logged to the
    `sys_log` table. Default is 30711 =
    `E_ALL & ~(E_STRICT | E_NOTICE)`
    (see [PHP documentation](https://www.php.net/manual/en/errorfunc.constants.php)).

## generateApacheHtaccess {#typo3confvars-sys-generateapachehtaccess}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['generateApacheHtaccess'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* bool
    -   *Default:* 1

    TYPO3 can create `.htaccess` files which are used by Apache Webserver.
    They are useful for access protection or performance improvements. Currently
    `.htaccess` files in the following directories are created,
    if they do not exist: typo3temp/compressor/.

    You want to disable this feature, if you are not running Apache or
    want to use own rule sets.

## ipAnonymization {#typo3confvars-sys-ipanonymization}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['ipAnonymization'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* int
    -   *Default:* 1
    -   *allowedValues:*

        -   **0**

            Disabled - Do not modify IP addresses at all

        -   **1**

            Mask the last byte for IPv4 addresses / Mask the Interface ID for
            IPv6 addresses (default)

        -   **2**

            Mask the last two bytes for IPv4 addresses / Mask the Interface
            ID and SLA ID for IPv6 addresses

    Configures if and how IP addresses stored via TYPO3s API should be anonymized
    ("masked") with a zero-numbered replacement. This is respected within
    anonymization task only, not while creating new log entries.

## systemMaintainers {#typo3confvars-sys-systemmaintainers}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['systemMaintainers'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]
    -   *type:* array
    -   *Default:* null

    A list of backend user IDs allowed to access the Install Tool

## features {#typo3confvars-sys-features}

New features of TYPO3 that are activated on new installations but upgrading
installations may still use the old behaviour.

These settings are [feature toggles](https://docs.typo3.org/permalink/t3coreapi:feature-toggles@11.5) and can be
changed in the Backend module **Settings** in the section
**Feature Toggles**, but not in **Configure Installation-Wide Options**.

### form.legacyUploadMimeTypes {#typo3confvars-sys-features-form-legacyuploadmimetypes}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]\['form.legacyUploadMimeTypes'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]
    -   *type:* bool
    -   *Default:* true

    If on, some mime types are predefined for the "FileUpload" and "ImageUpload"
    elements of the "form" extension, which always allows file uploads of these
    types, no matter the specific form element definition.

### redirects.hitCount {#typo3confvars-sys-features-redirects-hitcount}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]\['redirects.hitCount'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]
    -   *type:* bool
    -   *Default:* false

    If on, and if extension "redirects" is loaded, each performed redirect is
    counted and last hit time is logged to the database.

### security.backend.enforceReferrer {#typo3confvars-sys-features-security-backend-enforcereferrer}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]\['security.backend.enforceReferrer'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]
    -   *type:* bool
    -   *Default:* true

    If on, HTTP referrer headers are enforced for backend and install tool requests to mitigate
    potential same-site request forgery attacks. The behavior can be disabled in case HTTP proxies filter
    required referer header. As this is a potential security risk, it is recommended to enable this option.

### yamlImportsFollowDeclarationOrder {#typo3confvars-sys-features-yamlimportsfollowdeclarationorder}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]\['yamlImportsFollowDeclarationOrder'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]
    -   *type:* bool
    -   *Default:* false

    If on, the YAML imports are imported in the order they are defined in the importing YAML configuration.

### security.frontend.allowInsecureSiteResolutionByQueryParameters {#typo3confvars-sys-features-security-frontend-allowinsecuresiteresolutionbyqueryparameters}

<!-- TODO: no Markdown rendering for "versionadded" -->

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]\['security.frontend.allowInsecureSiteResolutionByQueryParameters'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]
    -   *type:* bool
    -   *Default:* false

    > [!NOTE]
    > This change was introduced as part of the
    > [TYPO3 12.4.4 and 11.5.30 security releases](https://typo3.org/security/advisory/typo3-core-sa-2023-003).

    Resolving sites by the `id` and `L` HTTP query parameters is now denied by
    default. However, it is still allowed to resolve a particular page by, for
    example, "example.org" - as long as the page ID `123` is in the scope of the
    site configured for the base URL "example.org".

    The flag can be used to reactivate the previous behavior:

    ```php
    $GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.allowInsecureSiteResolutionByQueryParameters'] = true;
    ```

## availablePasswordHashAlgorithms {#typo3confvars-sys-availablepasswordhashalgorithms}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['availablePasswordHashAlgorithms'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['features'\]
    -   *type:* array
    -   *Default:*

    A list of available password hash mechanisms. Extensions may register
    additional mechanisms here.

## linkHandler {#typo3confvars-sys-linkhandler}

-   **$GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['linkHandler'\]**

    -   *Path:* $GLOBALS\['TYPO3_CONF_VARS'\]\['SYS'\]\['linkHandler'\]
    -   *type:* array

    Links entered in the TYPO3 backend are stored in an internal format in the
    database, like `t3://page?uid=42`. The handlers for the different resource
    keys (like `page` in the example) are registered as link handlers.

    The TYPO3 Core registers the following link handlers:

    -   `page` (see [EXT:core/Classes/LinkHandling/PageLinkHandler.php (GitHub)](https://github.com/typo3/typo3/blob/11.5/typo3/sysext/core/Classes/LinkHandling/PageLinkHandler.php))
    -   `file` (see [EXT:core/Classes/LinkHandling/FileLinkHandler.php (GitHub)](https://github.com/typo3/typo3/blob/11.5/typo3/sysext/core/Classes/LinkHandling/FileLinkHandler.php))
    -   `folder` (see [EXT:core/Classes/LinkHandling/FolderLinkHandler.php (GitHub)](https://github.com/typo3/typo3/blob/11.5/typo3/sysext/core/Classes/LinkHandling/FolderLinkHandler.php))
    -   `url` (see [EXT:core/Classes/LinkHandling/UrlLinkHandler.php (GitHub)](https://github.com/typo3/typo3/blob/11.5/typo3/sysext/core/Classes/LinkHandling/UrlLinkHandler.php))
    -   `email` (see [EXT:core/Classes/LinkHandling/EmailLinkHandler.php (GitHub)](https://github.com/typo3/typo3/blob/11.5/typo3/sysext/core/Classes/LinkHandling/EmailLinkHandler.php))
    -   `record` (see [EXT:core/Classes/LinkHandling/RecordLinkHandler.php (GitHub)](https://github.com/typo3/typo3/blob/11.5/typo3/sysext/core/Classes/LinkHandling/RecordLinkHandler.php))
    -   `phone` (see [EXT:core/Classes/LinkHandling/TelephoneLinkHandler.php (GitHub)](https://github.com/typo3/typo3/blob/11.5/typo3/sysext/core/Classes/LinkHandling/TelephoneLinkHandler.php))

    Additional link handlers can be added by extensions.

    > [!NOTE]
    > **See also**
    >
    > [Link handling](https://docs.typo3.org/permalink/t3coreapi:linkhandling@11.5)