---
title: "Flag files (ENABLE_INSTALL_TOOL, LOCK_BACKEND, ...)"
manual: "TYPO3 Explained"
version: "main"
permalink: "https://docs.typo3.org/permalink/t3coreapi:flag-files@main"
source: "Administration/DirectoryStructure/FlagFiles.rst"
rendered: "2026-09-18T15:39:49+00:00"
---

# Flag files (ENABLE_INSTALL_TOOL, LOCK_BACKEND, ...) {#flag-files}

TYPO3 uses a set of special files known as flag files or indicator files to
control and manage low-level configurations, behaviors, and security settings
of the system. These files act as triggers that enable or disable specific
features or functionalities in TYPO3, often without requiring direct
modifications to the core configuration files.

Flag files are typically placed in specific locations within the TYPO3 file
system and are usually named in a way that reflects their purpose.

Below is a list of commonly used TYPO3 flag files, along with explanations of
their functions and typical use cases.

-   **LOCK_BACKEND**

    -   *Path (Composer):* var/lock/LOCK_BACKEND
    -   *Path (Classic):* config/LOCK_BACKEND
    -   *Configuration:* `$GLOBALS['TYPO3_CONF_VARS']['BE']['lockBackendFile']`
    -   *Command:* `vendor/bin/typo3 backend:lock`, `vendor/bin/typo3 backend:unlock`

    If the file exists in the location specified by `$GLOBALS['TYPO3_CONF_VARS']['BE']['lockBackendFile']`
    or the default and is empty, an error message is displayed when you try to log into
    the backend:

    > [!WARNING]
    > Backend access by browser is locked for maintenance. Remove lock by
    > removing the file "var/lock/LOCK_BACKEND" or use CLI-scripts.

    **Console commands to lock/unlock the backend**

    ```bash
    # Lock the TYPO3 Backend for everyone including administrators
    vendor/bin/typo3 backend:lock

    # Unlock the TYPO3 Backend after it has been locked
    vendor/bin/typo3 backend:unlock
    ```

    This file locks access to the TYPO3 backend. When present, it prevents
    users from logging into the backend, often used during maintenance or
    for security reasons.

    If the file contains an URI, users will be forwarded to that URI when
    they try to lock into the backend.

    If you want locked backend state to persist between deployments, ensure that the
    used directory (`var/lock` by default) is shared between deployment releases.

    The backend locking functionality is now contained in a distinct service class
    `\TYPO3\CMS\Backend\Authentication\BackendLocker` to allow future flexibility.

    **Use Case**: Temporarily restrict backend access to prevent unauthorized
    changes or when performing critical updates.

-   **FIRST_INSTALL**

    -   *Path (Composer):* public/FIRST_INSTALL
    -   *Path (Classic):* \<webroot>/FIRST_INSTALL
    -   *Command:* `vendor/bin/typo3 setup`

    This file initiates the TYPO3 installation process. If the file exists,
    TYPO3 directs the user to the installation wizard.

    **Use Case**: Automatically initiate the installation process on a
    fresh TYPO3 setup.

    See also: [Installing TYPO3](https://docs.typo3.org/m/typo3/tutorial-getting-started/main/en-us/Installation/Install.html#install).

    There is also a console command available to do the first installation:

    **Console command for first install**

    ```bash
    # Lock the TYPO3 Backend for everyone including administrators
    vendor/bin/typo3 setup
    ```

-   **ENABLE_INSTALL_TOOL**

    -   *Path (Composer):* config/ENABLE_INSTALL_TOOL
    -   *Path (Classic):* typo3conf/ENABLE_INSTALL_TOOL
    -   *Command:* None

    <!-- TODO: no Markdown rendering for "versionchanged" -->

    The location of this file has been changed for Composer-based
    installations from typo3conf/ENABLE_INSTALL_TOOL to
    config/ENABLE_INSTALL_TOOL or
    var/transient/ENABLE_INSTALL_TOOLWhen this file is set, it allows access to the TYPO3 Install Tool.
    See also [The ENABLE_INSTALL_TOOL file](https://docs.typo3.org/permalink/t3coreapi:security-install-tool-access-enable-file@main).

    **Composer-based installation**

    -   `var/transient/ENABLE_INSTALL_TOOL`
    -   `config/ENABLE_INSTALL_TOOL`

    **Classic mode installation (No Composer)**

    -   `typo3temp/var/transient/ENABLE_INSTALL_TOOL`
    -   `typo3conf/ENABLE_INSTALL_TOOL`

    This file unlocks the Install Tool, allowing access for configuration
    and maintenance tasks.

    **Use Case**: Temporarily enable the Install Tool for performing system
    configurations or updates, then remove the file to re-secure the tool.

    If you are working with the [`helhum/typo3-console`](https://packagist.org/packages/helhum/typo3-console) there are
    also console commands available to enable or disable the install tool:

    -   [install:lock](https://docs.typo3.org/p/helhum/typo3-console/main/en-us/CommandReference/InstallLock.html#typo3_console-command-reference-install-lock)
    -   [install:unlock](https://docs.typo3.org/p/helhum/typo3-console/main/en-us/CommandReference/InstallUnlock.html#typo3_console-command-reference-install-unlock)