Quick Guide to Harden TYPO3 Security

History says TYPO3 is one of the most secure OpenSource CMS. But, security is a never-ending task, In this article, I want to introduce Helmut’s popular “TYPO3 Secure Web” package to more secure your TYPO3 site.

We as a whole see that it is so essential to maintain the TYPO3 Security of your site. Google blacklists around 10,000+ websites every day for malware and around 50,000 for phishing continuously.

Fortunately, TYPO3 has better built-in firewall security because the core architecture of TYPO3 is robust. But, TYPO3 security never-ends. The TYPO3 community is always serious about security and performance, and always develops something which improves security.

“If you spend more time on coffee than on IT security, you will be hacked. What’s more, you deserve to be hacked.
- Richard Clarke”

Pre-requisite and Dependencies

Care to the Conflict

Let’s get ready to implement a TYPO3 secure web package to your composer based TYPO3 installation, Our technical team develops TYPO3 projects with best practices of Docker, DDEV, Composer as below.

Step 1: Create a project folder

mkdir my-typo3-site
cd my-typo3-site

Step 2: Configure PHP version

ddev config --project-type php --php-version 7.2

Step 3: Download latest version through Composer

ddev composer create typo3/cms-base-distribution ^10 --no-interaction
ddev config --project-type typo3
ddev start

Step 4: Run TYPO3 Installation Wizard

touch public/FIRST_INSTALL

Step 5: At composer.json, Setup private and public folders

"extra": {
    "typo3/cms": {
    "root-dir": "private",
    "web-dir": "public"
    }
}

Step 6: Secure your TYPO3 with folders structure private and public

ddev composer require helhum/typo3-secure-web

When you have effectively installed TYPO3-secure-web bundle, it will organize entire files and folders architecture at your server as follows: 

• This bundle will at that point set up the web server document root inside the public folder and TYPO3 inside the private folder. 
• The private folder will look familiar and will contain typo3, typo3conf, fileadmin, typo3temp, uploaded folders
• The public folder will just have the entry scripts and connections to fileadmin, typo3temp/assets and, Resources/Public of all installed (framework) extensions.

• In spite of the fact that the TYPO3 is made robust and secure, Let's keep it safer through the extraordinary typo3-secure-web composer package. 
• Remember to say "thanks and Donate to Helmut" for his extraordinary endeavors to the TYPO3 people community. 

Are you encountering any issues during setup? Please feel free to connect with us for support. Do you know any other tips and tricks to secure TYPO3? We would love to receive your feedback in the comment box below.

Inspiring People To Secure!