---
title: "Guidelines for System Administrators"
manual: "TYPO3 Explained"
version: "11.5"
permalink: "https://docs.typo3.org/permalink/t3coreapi:security-administrators@11.5"
source: "Security/GuidelinesAdministrators/Index.rst"
rendered: "2026-10-21T15:30:00+00:00"
---

> [!WARNING]
> **Attention**
>
> TYPO3 v11 has reached end-of-life as of October 31th 2024 and
> is no longer being maintained. Use the version switcher on the top
> left of this page to select documentation for a supported version of TYPO3.
>
> Need more time before upgrading?
> You can purchase Extended Long Term Support (ELTS) for TYPO3 v11 here:
> [TYPO3 ELTS](https://typo3.com/services/extended-support-elts).

# Guidelines for System Administrators {#security-administrators}

## General Rules {#general-rules}

1.  Subscribe to the "TYPO3 Announce" mailing list at
    [https://lists.typo3.org](https://lists.typo3.org), so that you are
    informed about TYPO3 security bulletins and TYPO3 updates.
1.  React as soon as possible and update the relevant components of the
    site(s) when new vulnerabilities become public (e.g. security issues
    published in the mailing list).
1.  Use different passwords for the Install Tool and the backend login.
    Follow the guidelines for secure passwords in this document.
1.  If you are administrating several TYPO3 installations, use different
    passwords for all logins and components for every installation.
1.  Never use the same password for a TYPO3 installation and any other
    service such as `FTP`, `SSH`, etc.
1.  Change the username and password of the "admin" account after the
    installation of TYPO3 immediately.
1.  If you are also responsible for the setup and configuration of TYPO3,
    follow the steps for TYPO3 integrators carefully, documented in the
    next chapter.

## Further topics {#further-topics}

Please see the chapters below for further security related topics of interest
for administrators:

-   [Role Definition](https://docs.typo3.org/permalink/t3coreapi:role-definition@11.5)
-   [Integrity of TYPO3 Packages](https://docs.typo3.org/permalink/t3coreapi:integrity-of-typo3-packages@11.5)
-   [File/directory permissions](https://docs.typo3.org/permalink/t3coreapi:file-directory-permissions@11.5)
-   [Restrict access to files on a server-level](https://docs.typo3.org/permalink/t3coreapi:restrict-access-to-files-on-a-server-level@11.5)
-   [Disable directory indexing](https://docs.typo3.org/permalink/t3coreapi:disable-directory-indexing@11.5)
-   [File extension handling](https://docs.typo3.org/permalink/t3coreapi:file-extension-handling@11.5)
-   [Content security policy](https://docs.typo3.org/permalink/t3coreapi:content-security-policy@11.5)
-   [Database access](https://docs.typo3.org/permalink/t3coreapi:database-access@11.5)
-   [Encrypted Client/server Communication](https://docs.typo3.org/permalink/t3coreapi:encrypted-client-server-communication@11.5)
-   [Other Services](https://docs.typo3.org/permalink/t3coreapi:other-services@11.5)
-   [Further Actions](https://docs.typo3.org/permalink/t3coreapi:further-actions@11.5)