Instead of downloading ZIP files, copying folders and checking compatibility manually, you define package requirements in composer.json. Composer then records the exact installed versions in composer.lock, helping development, staging and production environments stay consistent.
This guide explains how to install TYPO3 v14 LTS with Composer, set up TYPO3 v13 LTS when required, configure a local or server environment, install extensions, manage custom packages, update dependencies and deploy safely.
Quick answer: Run composer create-project "typo3/cms-base-distribution:^14" my-typo3-project, point the web server to the project’s public/ directory and complete the installation with ./vendor/bin/typo3 setup.
Why Install TYPO3 with Composer?
Installing TYPO3 with Composer is the preferred approach for professional projects because it simplifies dependency management, improves deployment consistency and makes TYPO3 Core and extension updates easier to control.
With a traditional TYPO3 Installation, teams must download the Core package, upload files manually, install extensions separately and check compatibility each time something changes. This becomes difficult when multiple extensions depend on different TYPO3, PHP or library versions.
Common problems include:
- Finding extensions compatible with the installed TYPO3 Version
- Checking PHP and package requirements manually
- Managing conflicting dependencies
- Reproducing the same setup across local, staging and production environments
- Updating TYPO3 Core and several extensions without breaking the project
Composer solves these problems by reading the dependencies defined in composer.json, selecting compatible package versions and recording the exact installation in composer.lock.
Key Benefits of Using Composer with TYPO3
Using Composer allows TYPO3 teams to:
- Install TYPO3 Core and extensions through the command line
- Resolve package dependencies automatically
- Maintain consistent development, staging and production environments
- Track dependency changes through Git
- Update or remove extensions more safely
- Roll back package changes using
composer.lock - Integrate security checks, testing and CI/CD workflows
- Create faster and more reliable deployment processes
In simple terms, Composer replaces manual package management with a repeatable and controlled workflow. This makes it especially valuable for TYPO3 agencies, development teams and organizations managing long-term or business-critical websites.
Which TYPO3 Version Should You Install?
For a new TYPO3 project, install TYPO3 v14 LTS. It is the current stable release and the version officially recommended for new projects. TYPO3 v13 LTS remains supported for existing websites that are not yet ready to upgrade, while TYPO3 v12 now requires Extended Long Term Support for continued security and compliance updates.
TYPO3 version | Best suited for | Composer constraint |
TYPO3 v14 LTS | New TYPO3 projects |
|
TYPO3 v13 LTS | Existing supported projects |
|
TYPO3 v12 ELTS | Legacy projects with an active ELTS plan | Check the project’s ELTS package |
TYPO3 v14 and v13 System Requirements
Both TYPO3 v14 and v13 support:
- PHP 8.2, 8.3, 8.4 and 8.5
- MariaDB 10.4.3 or later
- MySQL 8.0.17 or later
- PostgreSQL 10 or later
- SQLite 3.8.3 or later
Before installation, confirm that your PHP CLI version, web-server PHP version and database meet the requirements of the selected TYPO3 release.
Important: Commands written for TYPO3 7.6, TYPO3 8.1, PHP 5.3, dev-master or typo3/cms:^7.6 are obsolete. They should not be used for a modern TYPO3 Composer installation.
What Do You Need Before Installing TYPO3?
Before installing TYPO3 with Composer, confirm that your server or local development environment meets the technical requirements. Most installation problems come from incompatible PHP versions, missing extensions, incorrect permissions or a web server pointing to the wrong directory.
TYPO3 Composer Installation Requirements
Make sure your environment includes:
- Linux, macOS or Windows
- Command-line or SSH access
- Composer 2.x
- A PHP version supported by your TYPO3 release
- Required PHP extensions
- A supported MySQL, MariaDB, PostgreSQL or SQLite database
- Valid database credentials
- Permission to create directories and symbolic links
- Access to change the website’s document root
- An empty project directory
Check PHP and Composer
Run these commands before creating the TYPO3 project:
php -v
composer --version
composer diagnose
They confirm the active PHP version, Composer installation and any configuration issues that could affect dependency management.
Check the Command Paths
On managed hosting, the PHP version used in the terminal may be different from the version used by the website. Check the active executable paths with:
which php
which composer
On Windows, use:
where php
where composer
The command-line PHP version and the web-server PHP version should both meet the requirements of the selected TYPO3 release.
Confirm the Web Root
Your hosting environment must allow the domain or virtual host to point to the TYPO3 project’s public/ directory. This keeps configuration, dependencies and application files outside the publicly accessible web root.
Pre-installation check: Do not begin the TYPO3 Composer installation until PHP, Composer, database access, directory permissions and the public/ document root are confirmed.
How Do You Install Composer?
Before installing Composer, check whether it is already available on your local machine or server:
composer --version
If the command returns a Composer 2.x version, you can move directly to the TYPO3 installation.
Important: composer install does not install Composer itself. It installs the dependencies defined in an existing project’s composer.json or composer.lock file.
Install Composer Globally
A global Composer installation allows you to run Composer from any project directory:
composer install
On Windows, the simplest method is to use the official Composer installer, which configures Composer and adds it to the system PATH. On Linux and macOS, follow Composer’s current command-line installation instructions. Avoid copying installer signatures from old tutorials because the verification hash changes when a new installer is released.
Use Composer Locally
When Composer is stored inside the current directory as composer.phar, run commands through PHP:
php composer.phar install
The global and local methods perform the same Composer tasks. Only the command prefix changes.
After installation, verify that Composer is working correctly:
composer --version
composer diagnoseIf the server has multiple PHP versions, confirm which PHP and Composer executables are active:
which php
which composerOn Windows, use:
where php
where composerSome managed hosting environments require full executable paths, such as:
/path/to/php /path/to/composer create-project \
"typo3/cms-base-distribution:^14" my-typo3-projectComposer is PHP’s dependency manager. Packagist is the default public repository from which Composer discovers many packages. They are connected services, but they are not the same tool.
How to Install TYPO3 v14 with Composer
Installing TYPO3 v14 with Composer involves four main steps: creating the project, configuring the public document root, completing TYPO3 setup and verifying the installation.
Step 1: Create the TYPO3 Project
Run the following command from the parent directory in which the new project folder should be created:
composer create-project \
"typo3/cms-base-distribution:^14" \
my-typo3-project
Enter the new project directory:
cd my-typo3-project
The destination directory must be empty. Hidden files created by an IDE, Git initialization or operating system can prevent composer create-project from running successfully.
Composer downloads TYPO3 Core, required system packages and their compatible dependencies. It also creates the initial project structure, including composer.json, composer.lock, public/, packages/, config/, var/ and vendor/.
To create a TYPO3 v13 LTS project instead, change the version constraint:
composer create-project \
"typo3/cms-base-distribution:^13" \
my-typo3-project
Step 2: Point the Web Server to public/
Configure the Apache, Nginx, IIS or hosting document root to point to:
/path/to/my-typo3-project/public
Older TYPO3 Composer projects may use a directory named web but the current Base Distribution uses public/.
This structure prevents configuration files, dependencies and application code from being directly accessible through the browser. Only files intended for public web access should be exposed through public/.
Step 3: Complete the TYPO3 Installation
The recommended command-line method is:
./vendor/bin/typo3 setup
The guided setup asks for:
- Database connection details
- Administrator username and password
- Project or site name
- Initial site configuration
Alternatively, start the browser-based installation wizard by creating an empty FIRST_INSTALL file:
touch public/FIRST_INSTALL
On Windows PowerShell, use:
New-Item public/FIRST_INSTALL -ItemType File
Then open the project URL in a browser. TYPO3 checks the PHP environment, file permissions, database connection and required extensions before completing the installation.
Step 4: Verify the TYPO3 Installation
After setup, confirm that:
- The frontend opens without an installation error
- The backend is available at
/typo3/ - The administrator account works
- The domain points to the
public/directory composer.jsonandcomposer.locexist- The environment scan reports no critical issues
- The database connection works
- Project files are stored in version control
composer.lockis committed to Git
A successful Composer-based installation gives the project a repeatable foundation. The same locked package versions can then be installed across development, staging and production environments using:
composer install
How to Install TYPO3 with DDEV
DDEV is one of the simplest ways to install TYPO3 locally. It creates a consistent Docker-based environment containing the web server, PHP and database, so developers do not need to configure each service manually.
DDEV is designed for local TYPO3 development only. Production websites should be deployed using a separate hosting and deployment workflow.
Prerequisites
Before starting, install:
- Docker
- DDEV
- Git
- A terminal or command-line application
Composer does not need to be installed separately on the host machine because DDEV can run Composer inside its web container.
Step 1: Create the Project Directory
Create an empty folder and move into it:
mkdir my-typo3-project
cd my-typo3-project
Step 2: Configure DDEV for TYPO3
Configure the project as a TYPO3 installation with public/ as its document root:
ddev config \
--project-type=typo3 \
--docroot=public \
--php-version=8.4
The configuration is stored in .ddev/config.yaml, allowing every developer to start the same local environment.
Start the containers:
ddev start
Step 3: Install TYPO3 v14 with Composer
Create the TYPO3 v14 project inside the current directory:
ddev composer create-project “typo3/cms-base-distribution:^14”
DDEV runs Composer inside the container and installs TYPO3 Core, required packages and the standard project structure.
Step 4: Add the Optional Camino Theme
For a ready-to-view demonstration website, install the Camino theme:
ddev composer require typo3/theme-camino
Camino is optional. It provides a quick frontend starting point and can later be replaced with a custom TYPO3 site package.
Step 5: Complete the TYPO3 Setup
Run the TYPO3 setup command using DDEV’s database credentials:
ddev typo3 setup \
--server-type=other \
--driver=mysqli \
--host=db \
--port=3306 \
--dbname=db \
--username=db \
--password=db \
--admin-username=admin \
--admin-user-password="Replace-With-A-Strong-Password" \
--admin-email=admin@example.com \
--project-name="My TYPO3 Website" \
--force
Replace the sample administrator password and email address before running the command. DDEV automatically provides the database named db with the username and password db for local development.
The setup command creates the database connection, administrator account and basic TYPO3 configuration.
Step 6: Open the TYPO3 Website
Launch the Camino demonstration page:
ddev launch /camino
Open the TYPO3 Backend:
ddev launch /typo3/
Sign in using the administrator credentials created during setup.
Verify the DDEV Installation
Check that:
- DDEV starts without container errors
- TYPO3 opens in the browser
- The backend login works
- The document root is set to
public/ composer.jsonandcomposer.locexist- The database connection works
View the project URL, database details and container status with:
ddev describe
To stop the local environment without deleting the project, run:
ddev stop
Start it again later with:
ddev start
Existing TYPO3 project: When working from an existing Git repository, run ddev composer install instead of ddev composer create-project. This installs the exact package versions recorded in the project’s composer.lock file.
Understanding the TYPO3 Composer Project Structure
A Composer-based TYPO3 project separates public files, configuration, custom packages and third-party dependencies.
Path | Purpose |
| Defines required packages and version constraints |
| Stores the exact installed package versions |
| Contains browser-accessible files |
| Stores local Extensions and Site Packages |
| Contains TYPO3 and site configuration |
| Stores cache, logs and runtime files |
| Contains TYPO3 Core and Composer-managed packages |
Commit composer.json and composer.lock to Git. Do not commit vendor/, because Composer can recreate it with:
composer install
Composer, Packagist and TER: What Is the Difference?
- Composer: Installs, updates and removes PHP packages.
- Packagist: Composer’s default public package repository.
- TER: TYPO3’s extension catalogue for discovering extensions and checking compatibility.
composer.typo3.org: An additional repository mainly used for certain legacy packages.
Most modern TYPO3 Extensions are installed through Packagist. Add composer.typo3.org only when an extension’s documentation specifically requires it.
How to Install a TYPO3 Extension with Composer
First, find the extension in the TYPO3 Extension Repository, Packagist or its official documentation and confirm its Composer package name.
Composer package names use this format:
vendor/package-name
For example:
Extension key: extension_builder
Composer package: friendsoftypo3/extension-builder
Install the Extension
To install the TYPO3 News extension, run the following command from the project root:
composer require georgringer/news
Composer will:
- Add the package to
composer.json - Select a version compatible with the project
- Install its dependencies
- Update
composer.lock
TYPO3’s official documentation recommends using the extension’s Composer package name with composer require.
Complete the Extension Setup
After installation, run:
./vendor/bin/typo3 extension:setup
This completes TYPO3-specific setup tasks, including database schema changes and package configuration.
To install a specific major version, use an appropriate constraint:
composer require georgringer/news:"^14"
For most projects, the unversioned command is safer because Composer selects the latest release compatible with the installed TYPO3 version. The current News package supports modern TYPO3 installations.
Avoid using * as a version constraint because it permits an uncontrolled range of releases.
Install a Standard PHP Package
Composer can also install ordinary PHP libraries:
composer require monolog/monolog
Composer makes the package available through the project’s standard autoloader in vendor/autoload.php.
Remove an Extension
To remove the News extension, run:
composer remove georgringer/news
./vendor/bin/typo3 extension:setup
After installing, updating or removing an extension, commit the updated composer.json and composer.lock files so the same dependency versions can be reproduced across development, staging and production.
What Is the Difference Between require, install and update?
Composer commands serve different purposes:
Command | Purpose |
| Adds and installs a new package |
| Installs the exact versions recorded in |
| Updates a package within the allowed version constraints |
| Removes a package and updates Composer files |
| Displays installed packages |
| Lists packages with newer versions available |
Use composer require when adding an extension. Use composer update in development or staging when intentionally changing package versions. Use composer install when setting up or deploying an existing project so every environment receives the same locked versions.
How to Add a Local TYPO3 Extension or Site Package
Store custom extensions and site packages inside the project’s packages/ directory.
If the path is not already registered, add it to the root composer.json:
{
"repositories": [
{
"type": "path",
"url": "./packages/*/"
}
]
}
Install the local package:
composer require vendor/my-site-package:@dev
./vendor/bin/typo3 extension:setup
Composer links the local package to the TYPO3 installation, while extension:setup completes required database migrations and cache updates.
How to Create composer.json for a TYPO3 Extension
Every custom TYPO3 extension requires its own composer.json file in the extension’s root directory.
Jede benutzerdefinierte TYPO3 Extension benötigt eine eigene composer.json-Datei im Stammverzeichnis der Extension.
A minimal example is:
{
"name": "vendor/my-site-package",
"type": "typo3-cms-extension",
"description": "Site package for a TYPO3 project",
"license": "GPL-2.0-or-later",
"require": {
"typo3/cms-core": "^13.4 || ^14.3"
},
"autoload": {
"psr-4": {
"Vendor\\MySitePackage\\": "Classes/"
}
},
"extra": {
"typo3/cms": {
"extension-key": "my_site_package"
}
}
}
Follow these rules:
- Use a lowercase
vendor/package-name - Use
typo3-cms-extensionas the package type - Do not use
typo3as your own vendor name - Map the PHP namespace to
Classes/ - Define the extension key under
extra.typo3/cms - Add every required TYPO3 package under
require
Validate the file and refresh autoloading:
composer validate
composer dump-autoload
The project-level composer.json manages the complete TYPO3 installation. The extension-level file describes only that extension and its dependencies. Current TYPO3 documentation requires a valid extension composer.json, including the package type and extension key.
How to Update TYPO3 Core and Extensions
Composer makes TYPO3 Updates easier to control, but every update should be tested before it reaches production.
Recommended Update Workflow
- Back up the database and project files.
- Perform the update locally or on staging.
- Check available package updates.
- Update TYPO3 Core, one extension or a controlled package group.
- Run TYPO3 setup tasks.
- Test the frontend, backend, forms and integrations.
- Commit the updated
composer.jsonandcomposer.lock. - Deploy the tested lock file using
composer install.
Check outdated packages:
composer outdated
Update one extension and its related dependencies:
composer update vendor/package --with-all-dependencies
./vendor/bin/typo3 extension:setup
When an update is blocked, identify the dependency causing the conflict:
composer why vendor/package
composer why-not vendor/package 1.2.3
For major TYPO3 Upgrades, update the Core version constraints deliberately, confirm extension compatibility and test all database migrations. Avoid running an unrestricted composer update directly on production because it can resolve an untested combination of package versions.
Composer’s update command changes the lock file, while install reproduces the versions already recorded in it.
How to Deploy a Composer-Based TYPO3 Project
A production deployment should use the tested package versions stored in composer.lock.
Run:
composer install --no-dev --optimize-autoloader
./vendor/bin/typo3 extension:setup
A safe deployment process should:
- Resolve and test updates in development or staging
- Commit
composer.jsonandcomposer.lock - Deploy the approved project files
- Install dependencies from the lock file
- Run TYPO3 database and extension setup tasks
- Clear caches where required
- Perform frontend and backend smoke tests
Keep passwords, API keys and environment-specific configuration outside Git. The production domain must also point to the project’s public/ directory.
For larger projects, automate testing and deployment through CI/CD rather than making dependency changes manually on the live server.
How to Secure TYPO3 Composer Dependencies
composer audit
composer outdated
composer validate
composer diagnose
These commands help identify:
- Known security advisories
- Outdated packages
- Abandoned dependencies
- Invalid Composer configuration
- Environment or dependency issues
Pay particular attention to packages that:
- No longer receive maintenance
- Do not support the installed TYPO3 or PHP version
- Handle authentication, permissions or file uploads
- Connect to external APIs
- Contain known security vulnerabilities
Use clear version constraints such as ^14 instead of *. Broad constraints can allow unexpected package versions, while controlled constraints make updates more predictable. Composer can also block insecure or abandoned packages during dependency resolution when the appropriate audit configuration is enabled.
Common TYPO3 Composer Errors
composer: command not found
Confirm that PHP and Composer are installed and available in the system path:
which php
which composer
On Windows, use:
where php
where composer
Some hosting providers require the full path to the PHP and Composer executables.
Project Directory Is Not Empty
composer create-project requires an empty destination directory. Remove hidden files such as .git, .idea or .DS_Store, or create the project in a new folder.
PHP Version or Extension Conflict
Check the active command-line PHP version and platform requirements:
php -v
composer check-platform-reqs
Composer checks the installed PHP version and required PHP extensions against the project’s package requirements.
Package Could Not Be Found
Verify the exact Composer package name in TER, Packagist or the extension’s official documentation. A TYPO3 extension key and its Composer package name may be different.
Dependency Conflict
Use the following command to identify which package is blocking the required version:
composer why-not vendor/package 1.2.3
Composer’s troubleshooting documentation recommends checking package constraints when a dependency cannot be installed or updated.
Extension Installed but Database Changes Are Missing
Run:
./vendor/bin/typo3 extension:setup
This command sets up installed extensions and performs required database migrations.
TYPO3 Installer Does Not Open
Confirm that:
public/FIRST_INSTALLexists- The domain points to the
public/directory - PHP can read and write the required directories
- The web-server PHP version meets TYPO3 requirements
Invalid composer.json
Check the file with:
composer validate
composer diagnose
Look for missing commas, incorrect quotation marks, invalid package names or unsupported version constraints.
Final TYPO3 Composer Checklist
Before considering the TYPO3 installation complete, verify that:
- A supported TYPO3 version is installed
- PHP and the database meet the selected version’s requirements
- Composer 2.x is available
- The domain points to
public/ - TYPO3 setup completed successfully
- The administrator can access
/typo3/ composer.jsonpasses validationcomposer.lockis committed to Git- Extensions are installed through Composer
- Local extensions are managed under
packages/ ./vendor/bin/typo3 extension:setuphas been completed- Updates are tested outside production
composer auditreports no unresolved critical issues- Production deployment uses
composer install
Composer reduces the manual work involved in TYPO3 installation, extension management and deployment. More importantly, it creates a repeatable project setup, so the package versions deployed tomorrow match the versions tested today.
Conclusion
Installing TYPO3 with Composer gives you a cleaner, safer and more repeatable way to manage Core, extensions and dependencies. It simplifies updates, supports reliable deployments and keeps development, staging and production environments aligned.
For modern TYPO3 projects, Composer is not just a convenience. It is the practical foundation for maintainable, secure and scalable development.
FAQs
TYPO3 can still run in Classic mode, but Composer is the preferred approach for professional, team-based and deployment-driven projects.
Choose TYPO3 v14 LTS for a new project. Use TYPO3 v13 LTS when maintaining an existing project whose extensions or infrastructure are not yet ready for v14.
Yes, provided the hosting service offers compatible PHP CLI access, Composer, database access, appropriate permissions and the ability to point the domain to public/.
Yes. For a TYPO3 application, the lock file ensures that developers, CI systems and production servers use the same resolved package versions.
Composer downloads managed packages into vendor/. Local project extensions and site packages should be stored in packages/ and required through Composer.
Usually not. Packagist is the default source for modern Composer packages. Add another repository only when the package’s current documentation requires it.
Yes. Back up the project, inventory Core and extensions, identify their Composer package names, move local packages into a controlled structure, change the web root to public/ and test the complete migration on staging.
Contact for project management and team coordination
Mihaela Angelova
Project Manager - Germany

Be the First to Comment