---
title: "Security guidelines for system administrators"
manual: "TYPO3 Explained"
version: "12.4"
permalink: "https://docs.typo3.org/permalink/t3coreapi:security-administrators@12.4"
source: "Security/GuidelinesAdministrators/Index.rst"
rendered: "2026-10-21T15:29:37+00:00"
---

> [!WARNING]
> **Attention**
>
> TYPO3 v12 has reached end-of-life as of April 30th 2026 and
> is no longer being maintained. Use the version switcher on the top
> left of this page to select documentation for a supported version of TYPO3.
>
> Need more time before upgrading?
> You can purchase Extended Long Term Support (ELTS) for TYPO3 v12 here:
> [TYPO3 ELTS](https://typo3.com/services/extended-support-elts).

# Security guidelines for system administrators {#security-administrators}

1.  Follow the [TYPO3 Security Advisories](http://typo3.org/help/security-advisories).
    Subscribe to the advisories via mailing list or RSS feed.
1.  Update the TYPO3 Core or any affected
    third-party extensions as soon as possible after security fixes are released.
1.  Use individual account names. Do not share accounts. For example,
    administrator and system maintainer account names should be something like
    `john.doe`. Do not use general usernames like "admin".
1.  Use different passwords for the
    [Install Tool](https://docs.typo3.org/permalink/t3coreapi:security-install-tool-password@12.4)
    and your personal backend login. Do not reuse passwords across multiple
    TYPO3 installations.
1.  Follow the guidelines for
    [secure passwords](https://docs.typo3.org/permalink/t3coreapi:security-secure-passwords@12.4)
    in this document. Implement secure
    [password policies](https://docs.typo3.org/permalink/t3coreapi:password-policies@12.4).
1.  Never use the same password for a TYPO3 installation and other
    services such as FTP, SSH, etc.
1.  If you are responsible for the setup and configuration of TYPO3,
    carefully follow the
    [Guidelines for TYPO3 integrators](https://docs.typo3.org/permalink/t3coreapi:security-integrators@12.4)
    which are documented in the next chapter.

Please refer to the chapters below for security-related topics of
interest to administrators:

**Further topics**

-   [Role Definition](https://docs.typo3.org/permalink/t3coreapi:role-definition-what-is-a-system-administrator@12.4)
-   [Code Integrity](https://docs.typo3.org/permalink/t3coreapi:verify-integrity-of-typo3-code@12.4)
-   [File permissions](https://docs.typo3.org/permalink/t3coreapi:secure-file-permissions-operating-system-level@12.4)
-   [Restrict HTTP access](https://docs.typo3.org/permalink/t3coreapi:restrict-http-access@12.4)
-   [Directory indexing](https://docs.typo3.org/permalink/t3coreapi:disable-directory-indexing@12.4)
-   [File extension handling](https://docs.typo3.org/permalink/t3coreapi:file-extension-handling@12.4)
-   [Content security policy](https://docs.typo3.org/permalink/t3coreapi:content-security-policy@12.4)
-   [Database access](https://docs.typo3.org/permalink/t3coreapi:secure-database-access@12.4)
-   [Backups](https://docs.typo3.org/permalink/t3coreapi:backups-and-recovery@12.4)
-   [HTTPS & encryption](https://docs.typo3.org/permalink/t3coreapi:use-https-and-encrypted-connections@12.4)
-   [Insecure Uploads](https://docs.typo3.org/permalink/t3coreapi:avoid-insecure-file-uploads@12.4)
-   [Server environment](https://docs.typo3.org/permalink/t3coreapi:server-and-environment-level-security@12.4)