Installing TYPO3: Complete Installation Guide (2026)

Your PHP compatibility and security support and upgrade strategy will depend on your TYPO3 version.

LTS (Long-Term Support)

• The system provides security maintenance support for multiple years.
• The system provides security maintenance support for all new production projects.
• The system maintains stable performance which enables safe system upgrades.

ELTS (Extended Long-Term Support)

• The system offers paid security support for all previous LTS releases.
• The system works best with existing enterprise systems that require long-term support.
• The system works best with existing systems which need no updates.

Sprint Releases

• The system provides a brief time frame for support.
• The system focuses on developing new features.
• The system only functions as a testing tool and early adopter platform.

PHP Compatibility

The system supports specific PHP versions which are associated with each TYPO3 release. Users must check official system requirements to verify system compatibility before starting installation. Using PHP versions which the system does not support will cause the main system and its extensions to stop working.

Recommendation:

The organization should use the latest LTS version for all upcoming projects. The organization should use ELTS when they face limitations which prevent them from performing upgrades. Organizations should not use sprint releases for their production environment.

If you are currently running an older TYPO3 version, review the upgrade implications before installing or migrating. Our guide, Top Reasons to Upgrade from TYPO3 v12 to v13, explains the benefits, risks, and preparation steps in detail.

The installation of TYPO3 requires different methods which depend on your existing infrastructure and planned maintenance procedures.

The installation method affects all aspects of system operation including upgrade management and security protection and system capacity to grow over time.

Composer Installation (Recommended)

The official installation method provides modern installation capabilities

• TYPO3 operates as a dependency which Composer installation method manages
• The system enables users to update core components and extension files with greater efficiency
• The system allows users to control versioning while implementing continuous integration and deployment processes
• The system provides business advantages which make it suitable for enterprise development work.

Classic Source Package

• The user must obtain files through manual download to perform their installation.
• The installation process needs the user to create their FIRST_INSTALL file.
• The system provides functions that work in shared hosting environments.
• The system enables users to execute system upgrades through a less organized procedure.

Local Development (DDEV / XAMPP)

The system prepares software for testing and development work before it goes to production.

DDEV (Recommended)

• The system uses Docker technology which enables it to create production environment simulations.
• The system provides a development environment which enables teams to work together effectively.

XAMPP

• The system creates an uncomplicated local testing environment.
• The system enables users to perform fundamental testing operations.
• The system does not meet the requirements for testing in commercial business settings.

Installation Method Overview

Recommendation: For modern TYPO3 projects, use Composer for production and DDEV for local development.

Composer is the recommended method for installing TYPO3 in modern production environments. It ensures clean dependency management, easier updates, and long-term maintainability.

Step 1: Create TYPO3 Project via Composer

Connect to your server via SSH and navigate to the directory where you want to create your project.

Run:

composer create-project typo3/cms-base-distribution my-typo3-site

This command:

• Downloads the latest compatible TYPO3 core
• Sets up the standard project structure
• Installs required dependencies
• Creates the /public directory for web access

After installation, navigate into your project folder:

cd my-typo3-site

Step 2: Configure Document Root (/public)

For security reasons, TYPO3 must run from the /public directory.

Set your web server document root to:
/path-to-your-project/public

• In Apache or NGINX configuration, ensure the root points to this directory.
• Do not point your domain to the project root, only to /public.

If this is misconfigured, TYPO3 will not load correctly and may expose sensitive files.

The classic source package installation is suitable for shared hosting environments or setups without SSH/Composer access. This method involves uploading TYPO3 files manually and starting the installation via the browser.

Note: The FIRST_INSTALL file is required only for the classic source package installation. It is not needed when installing via Composer.

Step 1: Download TYPO3 LTS

• Visit the official TYPO3 download page.
• Select the latest LTS (Long-Term Support) version.
• Download the source package (.zip or .tar.gz).

Using the LTS version ensures long-term stability and security updates.

TYPO3 guides you through final configuration steps after you open the installation tool through either Composer or traditional installation method. The current stage establishes a database connection while checking server conditions and setting up backend entry to the system.

Enter Database Credentials

Provide the database details created earlier:

• Host (usually localhost)
• Database name
• Database username
• Database password

TYPO3 will attempt to establish a connection.

The connection fails because one of the following conditions exists:

• Database server is running
• Credentials are correct
• User has full privileges
• Correct character set (utf8mb4 recommended)

TYPO3 automatically generates necessary database tables after establishing a successful connection.

System Environment Check

TYPO3 conducts an automatic system check before allowing any further system operations.

The check includes:

• PHP version validation
• Required PHP extensions
• File and folder permissions
• Database connectivity
• Memory limits

If the system generates warnings or errors:

• Users need to fix critical errors without delay.
• Users should check all warnings before moving to production phase.

The system performance and stability will suffer if users choose to disregard environmental warnings.

Create Administrator Account

Next, the backend administrator credentials require definition which includes two elements:

• Secure username
• Strong password
• Valid email address

The account provides complete system access to the user.

A strong password should be created for backend access which should also limit system entry rights after the system installation process.

Choose Installation Type (Introduction vs Blank)

The initial site setup selection process requires you to make your choice now. 

Introduction Package

• The introduction package installs both demo content and example layouts
• The introduction package provides resources for learning TYPO3
• The introduction package should not be used in actual production settings

Blank Installation

• The blank installation creates an empty TYPO3 system
• The system will not include any sample content
• The system appears to be most suitable for professional use in production environments

For most real-world projects, choose Blank Installation and build your structure intentionally.

The Blank Installation process should be used for actual projects because it allows users to design their project framework.

After completing these steps, TYPO3 finalizes the configuration and redirects you to the backend login at: https:// yourdomain.com/typo3

Your TYPO3 installation is now fully operational and ready for further configuration.

A fresh TYPO3 installation must be secured before going live.

Remove FIRST_INSTALL (Classic Only)

• Delete immediately after installation
• Not required for Composer setups

Disable or Protect Install Tool

• Ensure it is password-protected
• Restrict access in production
• Remove unnecessary installation access

Configure Trusted Hosts

Define allowed domains via trustedHostsPattern to prevent host header attacks.

Example:

^(www\.)?yourdomain\.com$

Avoid wildcard patterns in production.

Verify File Permissions

Only required directories should be writable:

• var/
• public/fileadmin/
• config/

Never use 777 permissions.

Secure Backend Access

Backend URL: /typo3

• Enforce HTTPS
• Use strong credentials
• Restrict access via IP if possible
• Enable two-factor authentication

A default installation is functional but not optimized. Establish production settings before launch.

Enable Caching

• Ensure TYPO3 caches are active
• Disable development settings
• Configure reverse proxy caching if used

Avoid unnecessary cache flushing in production.

Configure PHP Memory

For production:

• memory_limit ≥ 512MB
• Appropriate max_execution_time
• Proper upload_max_filesize

Insufficient memory is a common cause of backend instability.

Enable OPcache

• Activate OPcache in PHP
• Allocate sufficient memory
• Improves response time and reduces CPU load

Set Production Context

For Composer setups, ensure production context:

Example:

APP_ENV=Production

or

TYPO3_CONTEXT=Production

Disable debug output and detailed error messages in live environments.

A properly configured performance baseline ensures TYPO3 is stable, secure, and ready for production workloads.

Installation is only the first step. Long-term stability depends on structured maintenance. Review our TYPO3 Website Maintenance Checklist to ensure your system remains secure and upgrade-ready.

Use this condensed checklist to verify your TYPO3 installation is complete, secure, and production-ready.

1. Select the Correct TYPO3 Version
   1. Latest LTS for new projects
   2. Verify PHP compatibility
2. Confirm Server Requirements
   1. Supported PHP version
   2. Required extensions enabled
   3. Database available (utf8mb4 recommended)
3. Choose Installation Method
   1. Composer (recommended)
   2. Source package (shared hosting)
   3. Local setup for development
4. Set Document Root to /public
   1. Mandatory for security
   2. Verify Apache/NGINX configuration
5. Create and Configure Database
   1. Dedicated user with full privileges
   2. Confirm connection during install tool
6. Complete Install Tool Setup
   1. Pass system environment checks
   2. Create secure administrator account
   3. Choose Blank installation for production
7. Remove FIRST_INSTALL (Classic Install Only)
   1. Delete immediately after installation
8. Secure Your Installation
   1. Configure trusted hosts
   2. Verify file permissions
   3. Protect backend access with HTTPS
9. Enable Clean URLs & Site Configuration
   1. Confirm rewrite rules
   2. Configure base URL
   3. Activate XML sitemap
10. Set Performance Baseline
    1. Enable caching
    2. Configure PHP memory
    3. Ensure OPcache is active
    4. Confirm production mode

If all ten steps are complete, your TYPO3 installation is structured correctly and ready for further development or deployment.