Typo3 Security
Identifies and remediates common Typo3 vulnerabilities, improving site security based on dirnbauer's expertise.
Install on your platform
We auto-selected Claude Code based on this skill’s supported platforms.
Run in terminal (recommended)
claude mcp add typo3-security npx -- -y @trustedskills/typo3-security
Or manually add to ~/.claude/settings.json
{
"mcpServers": {
"typo3-security": {
"command": "npx",
"args": [
"-y",
"@trustedskills/typo3-security"
]
}
}
}Requires Claude Code (claude CLI). Run claude --version to verify your install.
About This Skill
What it does
This skill, "Typo3 Security," helps AI agents harden Typo3 websites by applying security best practices based on dirnbauer’s expertise. It focuses on configuring critical settings within the config/system/settings.php file to improve backend and frontend security. The skill is compatible with TYPO3 version 14.x and emphasizes utilizing existing TYPO3 APIs rather than creating custom solutions.
When to use it
- When securing a new Typo3 v14 installation.
- During routine security audits of an existing Typo3 website.
- To enforce stricter password policies on backend user accounts.
- To disable debug mode in production environments.
Key capabilities
- Disables debugging in production (
BE.debugandFE.debug). - Configures session locking based on IP address (
BE.lockIP,BE.lockIPv6,FE.lockIP). - Sets session timeouts for both backend and frontend users (
BE.sessionTimeout,FE.sessionTimeout). - Enforces HTTPS requirements for the backend (
BE.lockSSL). - Implements Argon2id password hashing for improved security.
- Provides guidance on enforcing HTTPS at the web server/proxy level using HSTS.
Example prompts
- "Harden the Typo3 backend security settings."
- "Disable debug mode in the Typo3 frontend configuration."
- "Set the backend session timeout to 1 hour."
- “Apply Argon2id password hashing for all TYPO3 users.”
Tips & gotchas
- This skill is specifically designed for Typo3 version 14.x. Compatibility with other versions is not guaranteed.
FE.lockSSLhas been removed in v12; enforce HTTPS at the web server/proxy level instead, using HSTS headers.- Always consult the official TYPO3 documentation to verify API availability and avoid deprecated methods.
Tags
TrustedSkills Verification
Unlike other registries that point to live repositories, TrustedSkills pins every skill to a verified commit hash. This protects you from malicious updates — what you install today is exactly what was reviewed and verified.
Security Audits
| Gen Agent Trust Hub | Pass |
| Socket | Pass |
| Snyk | Pass |
🌐 Community
Passed automated security scans.