---
title: "Security guidelines"
manual: "TYPO3 Explained"
version: "11.5"
permalink: "https://docs.typo3.org/permalink/t3coreapi:security@11.5"
source: "Security/Index.rst"
rendered: "2026-10-21T15:30:00+00:00"
---

> [!WARNING]
> **Attention**
>
> TYPO3 v11 has reached end-of-life as of October 31th 2024 and
> is no longer being maintained. Use the version switcher on the top
> left of this page to select documentation for a supported version of TYPO3.
>
> Need more time before upgrading?
> You can purchase Extended Long Term Support (ELTS) for TYPO3 v11 here:
> [TYPO3 ELTS](https://typo3.com/services/extended-support-elts).

# Security guidelines {#security}

This chapter describes some typical risks and advises how to protect a
TYPO3 site in order to ensure it is and stays secure and stable.

-   [Introduction](https://docs.typo3.org/permalink/t3coreapi:introduction@11.5)
-   [The TYPO3 Security Team](https://docs.typo3.org/permalink/t3coreapi:the-typo3-security-team@11.5)
-   [General Information](https://docs.typo3.org/permalink/t3coreapi:general-information@11.5)
-   [Types of Security Threats](https://docs.typo3.org/permalink/t3coreapi:types-of-security-threats@11.5)
-   [General guidelines](https://docs.typo3.org/permalink/t3coreapi:general-guidelines@11.5)
-   [Guidelines for System Administrators](https://docs.typo3.org/permalink/t3coreapi:guidelines-for-system-administrators@11.5)
    -   [Role Definition](https://docs.typo3.org/permalink/t3coreapi:role-definition@11.5)
    -   [Integrity of TYPO3 Packages](https://docs.typo3.org/permalink/t3coreapi:integrity-of-typo3-packages@11.5)
    -   [File/directory permissions](https://docs.typo3.org/permalink/t3coreapi:file-directory-permissions@11.5)
    -   [Restrict access to files on a server-level](https://docs.typo3.org/permalink/t3coreapi:restrict-access-to-files-on-a-server-level@11.5)
    -   [Disable directory indexing](https://docs.typo3.org/permalink/t3coreapi:disable-directory-indexing@11.5)
    -   [File extension handling](https://docs.typo3.org/permalink/t3coreapi:file-extension-handling@11.5)
    -   [Content security policy](https://docs.typo3.org/permalink/t3coreapi:content-security-policy@11.5)
    -   [Database access](https://docs.typo3.org/permalink/t3coreapi:database-access@11.5)
    -   [Encrypted Client/server Communication](https://docs.typo3.org/permalink/t3coreapi:encrypted-client-server-communication@11.5)
    -   [Other Services](https://docs.typo3.org/permalink/t3coreapi:other-services@11.5)
    -   [Further Actions](https://docs.typo3.org/permalink/t3coreapi:further-actions@11.5)
-   [Guidelines for extension development](https://docs.typo3.org/permalink/t3coreapi:guidelines-for-extension-development@11.5)
-   [Guidelines for TYPO3 integrators](https://docs.typo3.org/permalink/t3coreapi:guidelines-for-typo3-integrators@11.5)
    -   [Install tool](https://docs.typo3.org/permalink/t3coreapi:install-tool@11.5)
    -   [Global TYPO3 configuration options](https://docs.typo3.org/permalink/t3coreapi:global-typo3-configuration-options@11.5)
    -   [Security-related warnings after login](https://docs.typo3.org/permalink/t3coreapi:security-related-warnings-after-login@11.5)
    -   [Reports and logs](https://docs.typo3.org/permalink/t3coreapi:reports-and-logs@11.5)
    -   [Users and access privileges](https://docs.typo3.org/permalink/t3coreapi:users-and-access-privileges@11.5)
    -   [TYPO3 extensions](https://docs.typo3.org/permalink/t3coreapi:typo3-extensions@11.5)
    -   [TypoScript](https://docs.typo3.org/permalink/t3coreapi:typoscript@11.5)
    -   [Content elements](https://docs.typo3.org/permalink/t3coreapi:content-elements@11.5)
-   [Guidelines for editors](https://docs.typo3.org/permalink/t3coreapi:guidelines-for-editors@11.5)
-   [Backup strategy](https://docs.typo3.org/permalink/t3coreapi:backup-strategy@11.5)
-   [Detect, analyze and repair a hacked site](https://docs.typo3.org/permalink/t3coreapi:detect-analyze-and-repair-a-hacked-site@11.5)
    -   [Detect a hacked website](https://docs.typo3.org/permalink/t3coreapi:detect-a-hacked-website@11.5)
    -   [Take the website offline](https://docs.typo3.org/permalink/t3coreapi:take-the-website-offline@11.5)
    -   [Analyzing a hacked site](https://docs.typo3.org/permalink/t3coreapi:analyzing-a-hacked-site@11.5)
    -   [Repair/restore](https://docs.typo3.org/permalink/t3coreapi:repair-restore@11.5)
    -   [Further actions](https://docs.typo3.org/permalink/t3coreapi:further-actions@11.5)