---
title: "Security guidelines for system administrators"
manual: "TYPO3 Explained"
version: "main"
permalink: "https://docs.typo3.org/permalink/t3coreapi:security-administrators@main"
source: "Security/GuidelinesAdministrators/Index.rst"
modified: "2026-09-16T13:05:25+00:00"
---

# Security guidelines for system administrators

1.  Follow the [TYPO3 Security Advisories](http://typo3.org/help/security-advisories).
    Subscribe to the advisories via mailing list or RSS feed.
1.  Update the TYPO3 Core or any affected
    third-party extensions as soon as possible after security fixes are released.
1.  Use individual account names. Do not share accounts. For example,
    administrator and system maintainer account names should be something like
    `john.doe`. Do not use general usernames like "admin".
1.  Use different passwords for the
    [Install Tool](https://docs.typo3.org/permalink/t3coreapi:security-install-tool-password@main)
    and your personal backend login. Do not reuse passwords across multiple
    TYPO3 installations.
1.  Follow the guidelines for
    [secure passwords](https://docs.typo3.org/permalink/t3coreapi:security-secure-passwords@main)
    in this document. Implement secure
    [password policies](https://docs.typo3.org/permalink/t3coreapi:password-policies@main).
1.  Never use the same password for a TYPO3 installation and other
    services such as FTP, SSH, etc.
1.  If you are responsible for the setup and configuration of TYPO3,
    carefully follow the
    [Guidelines for TYPO3 integrators](https://docs.typo3.org/permalink/t3coreapi:security-integrators@main)
    which are documented in the next chapter.

Please refer to the chapters below for security-related topics of
interest to administrators:

**Further topics**

-   [Role Definition](https://docs.typo3.org/permalink/t3coreapi:security-administrator-definition@main)
-   [Code Integrity](https://docs.typo3.org/permalink/t3coreapi:security-integrity-packages@main)
-   [File permissions](https://docs.typo3.org/permalink/t3coreapi:security-file-directory-permissions@main)
-   [Restrict HTTP access](https://docs.typo3.org/permalink/t3coreapi:security-restrict-access-server-level@main)
-   [Directory indexing](https://docs.typo3.org/permalink/t3coreapi:security-directory-indexing@main)
-   [File extension handling](https://docs.typo3.org/permalink/t3coreapi:security-file-extension-handling@main)
-   [Content security policy](https://docs.typo3.org/permalink/t3coreapi:content-security-policy@main)
-   [Database access](https://docs.typo3.org/permalink/t3coreapi:security-database-access@main)
-   [Backups](https://docs.typo3.org/permalink/t3coreapi:security-backups@main)
-   [HTTPS & encryption](https://docs.typo3.org/permalink/t3coreapi:security-encrypted-client-server-connection@main)
-   [Insecure Uploads](https://docs.typo3.org/permalink/t3coreapi:security-other-services@main)
-   [Server environment](https://docs.typo3.org/permalink/t3coreapi:security-administrators-furtheractions@main)