---
title: "Security guidelines"
manual: "TYPO3 Explained"
version: "main"
permalink: "https://docs.typo3.org/permalink/t3coreapi:security@main"
source: "Security/Index.rst"
modified: "2026-09-15T19:16:38+00:00"
---

# Security guidelines

TYPO3 is built with strong security principles, but maintaining a secure
installation requires ongoing attention from everyone involved —
administrators, integrators, developers, and editors.

This guide provides practical recommendations to protect your TYPO3
instance from common threats such as unauthorized access, insecure
configurations, extension vulnerabilities, and more.

It also explains how to respond to incidents, how the TYPO3 Security
Team operates, and where to stay informed about updates and security
advisories.

Each section focuses on a particular role, topic, or concern, helping you
quickly find the information most relevant to your responsibilities or
situation.

-   [Overview](https://docs.typo3.org/permalink/t3coreapi:security-introduction@main)
-   [Security Team](https://docs.typo3.org/permalink/t3coreapi:security-team@main)
-   [Versions & Updates](https://docs.typo3.org/permalink/t3coreapi:security-general-information@main)
-   [Security Threats](https://docs.typo3.org/permalink/t3coreapi:security-threats@main)
-   [Guidelines](https://docs.typo3.org/permalink/t3coreapi:security-general-guidelines@main)
-   [System Administrators](https://docs.typo3.org/permalink/t3coreapi:security-administrators@main)
    -   [Role Definition](https://docs.typo3.org/permalink/t3coreapi:security-administrator-definition@main)
    -   [Code Integrity](https://docs.typo3.org/permalink/t3coreapi:security-integrity-packages@main)
    -   [File permissions](https://docs.typo3.org/permalink/t3coreapi:security-file-directory-permissions@main)
    -   [Restrict HTTP access](https://docs.typo3.org/permalink/t3coreapi:security-restrict-access-server-level@main)
    -   [Directory indexing](https://docs.typo3.org/permalink/t3coreapi:security-directory-indexing@main)
    -   [File extension handling](https://docs.typo3.org/permalink/t3coreapi:security-file-extension-handling@main)
    -   [Content security policy](https://docs.typo3.org/permalink/t3coreapi:content-security-policy@main)
    -   [Database access](https://docs.typo3.org/permalink/t3coreapi:security-database-access@main)
    -   [Backups](https://docs.typo3.org/permalink/t3coreapi:security-backups@main)
    -   [HTTPS & encryption](https://docs.typo3.org/permalink/t3coreapi:security-encrypted-client-server-connection@main)
    -   [Insecure Uploads](https://docs.typo3.org/permalink/t3coreapi:security-other-services@main)
    -   [Server environment](https://docs.typo3.org/permalink/t3coreapi:security-administrators-furtheractions@main)
-   [Extension development](https://docs.typo3.org/permalink/t3coreapi:security-extension-development@main)
-   [Integration](https://docs.typo3.org/permalink/t3coreapi:security-integrators@main)
    -   [Install tool](https://docs.typo3.org/permalink/t3coreapi:security-install-tool@main)
    -   [Global TYPO3 configuration options](https://docs.typo3.org/permalink/t3coreapi:global-typo3-configuration-options@main)
    -   [Security-related warnings after login](https://docs.typo3.org/permalink/t3coreapi:security-related-warnings-after-login@main)
    -   [Reports and logs](https://docs.typo3.org/permalink/t3coreapi:security-reports-logs@main)
    -   [Users and access privileges](https://docs.typo3.org/permalink/t3coreapi:users-and-access-privileges@main)
    -   [Extensions](https://docs.typo3.org/permalink/t3coreapi:security-extensions@main)
    -   [TypoScript](https://docs.typo3.org/permalink/t3coreapi:security-typoscript@main)
    -   [Content elements](https://docs.typo3.org/permalink/t3coreapi:security-content-elements@main)
-   [Editor security](https://docs.typo3.org/permalink/t3coreapi:security-editors@main)
-   [Analyze & Repair](https://docs.typo3.org/permalink/t3coreapi:security-detect-analyze-repair@main)
    -   [Detect a hacked website](https://docs.typo3.org/permalink/t3coreapi:detect-a-hacked-website@main)
    -   [Take a hacked website offline](https://docs.typo3.org/permalink/t3coreapi:take-a-hacked-website-offline@main)
    -   [Analyzing a hacked site](https://docs.typo3.org/permalink/t3coreapi:analyzing-a-hacked-site@main)
    -   [Repair/restore](https://docs.typo3.org/permalink/t3coreapi:security-repair-restore@main)
    -   [Further actions](https://docs.typo3.org/permalink/t3coreapi:security-further-actions@main)