TYPO3: the European enterprise CMS
TYPO3 is a free content management system for professional websites, portals and intranets. It is one of Europe's oldest and most widely used enterprise CMSs – particularly popular in the German-speaking region, with industry, SMEs, universities and the public sector. TYPO3 is licensed under the GPL, belongs to nobody but its community and can be operated entirely on your own infrastructure. At Dreistein, TYPO3 has been the core technology since 2005 – and with dAi Pro we now bring AI capabilities directly into this CMS.
History: from 1997 to today
TYPO3 was started in the late 1990s by Danish developer Kasper Skårhøj and released as free software under the GPL in 2001. Since then the project has grown into one of Europe's largest open-source communities: the TYPO3 Association (founded 2004) coordinates development and funds core work, while the TYPO3 GmbH (2016) offers official services such as long-term support extensions. In 2012 the parallel project "Neos" was split off and is independent today. TYPO3 itself is released in a reliable rhythm of long-term support versions – currently TYPO3 v13 LTS and v14; each LTS version is maintained for several years and can be covered by paid ELTS contracts afterwards.
The architecture
Technically, TYPO3 is a PHP application on a modern foundation: Composer-based installation, Symfony components in the core, Doctrine DBAL as database abstraction (MySQL, MariaDB, PostgreSQL, SQLite), PSR-compliant middlewares and a consistent dependency-injection system. Content, configuration and presentation are cleanly separated: the page tree organises the structure, TypoScript and site sets configure the rendering, Fluid templates produce the HTML. Custom content types are created comfortably via Content Blocks today, or classically via TCA. This clear architecture is why TYPO3 projects can be maintained for decades – and why extensions such as dAi integrate seamlessly.
For editors: the backend
Editors work in a tidy backend with a page tree, modules and fine-grained permissions:
- Content – content elements via drag and drop, rich-text editing (CKEditor 5), preview before publishing.
- Media – central file management (FAL) with metadata, image editing and automatic image sizes.
- Scheduling – timed publishing with start/stop dates; workspaces for approval workflows with draft and live stages.
- Permissions – users and groups controllable down to field level: who may edit which pages, languages and content types?
- SEO built in – titles, descriptions, canonicals, hreflang, sitemap and redirects without extra plugins.
With dTranslate and the editorial copilot of dAi Pro, AI assistance enters this workflow directly – translating, drafting and summarising without leaving the backend.
Permissions and roles in detail
The permission system is one of TYPO3's greatest strengths – going far beyond "admin or editor":
- Backend groups bundle permissions and can be stacked – for example "basic editing" plus "news team" plus "French language".
- Access lists control down to field level which tables, content types and fields a group may see and edit.
- Page and file mounts give each team only its slice of the page tree and media storage – in a corporation, a country team sees only its country site.
- Language permissions limit who may touch which language versions.
- Frontend users with their own groups protect content in the frontend – the basis for portals, extranets and login areas.
Relevant for AI projects: dAi Pro has its own per-collection user and group management that fits into this model.
Content elements and Content Blocks
Content in TYPO3 is built from typed content elements – not from one big wall of text:
- Bundled types: headers, text with images and media, galleries, tables, lists, dividers, HTML, menu elements (such as sitemaps or subpage lists) and plug-in containers for extensions.
- Custom types with Content Blocks: a small YAML definition produces the backend form, database fields and template wiring – accordions, card grids, hero areas or quotes are built quickly and are foolproof for editors.
- Reuse: elements can be referenced instead of copied – central content is maintained in one place and stays current everywhere.
- Structural layouts: multi-column grids and containers arrange elements without editors touching HTML.
This structure pays straight into AI: because content is typed, dAi Pro can extract it cleanly and hand it to the chatbot as clearly delimited knowledge units.
Forms: the Form Framework
TYPO3 ships a fully-fledged form builder:
- Backend form editor – editors build multi-step forms via drag and drop: input fields, selections, file uploads, conditions, mandatory fields and validation.
- Finishers process submissions: email to team and sender, redirects, storage, confirmation pages – combinable and extensible.
- YAML definitions – developers version forms in code while editors use them in the backend; custom field types and finishers integrate cleanly.
- Spam protection – from honeypots to external verification services.
For anything beyond classic forms – such as a guided, conversational product finder – dAi Pro takes over, its chat leading visitors to their goal step by step.
Media management: the File Abstraction Layer
All files in TYPO3 pass through the File Abstraction Layer (FAL) – media management with a concept:
- Storage abstraction – media live locally, on network shares or in cloud storage via drivers; editors notice no difference.
- Central metadata – title, alternative text and copyright are maintained on the file and applied everywhere, including translated metadata.
- Focus point and cropping – separate crops per usage (square for teasers, wide for stages), rendered by the system in all sizes.
- Reference safety – TYPO3 counts where a file is used and warns before deleting media still in use.
- Responsive delivery – image variants and modern formats for fast load times.
dAi Pro docks in right here: it reads fileadmin folders as a data source, couples images to their pages and describes them with AI – so figures appear in chat answers too.
Workspaces, versioning and history
For organisations with approval processes, TYPO3 offers real editorial workflows:
- Workspaces – changes are made in a draft area while the live site remains untouched; entire relaunch states can be prepared.
- Stages and approvals – content passes through definable stations (editing, review, approval) with notifications.
- Comparison view – old and new side by side before publishing; publishing can also be scheduled.
- History and undo – every change to every record is logged and can be rolled back individually; deleted records go to the recycler module.
Search in TYPO3
For website search, TYPO3 offers three expansion stages:
- Indexed Search – the bundled full-text search for smaller sites, including indexing of page content and documents.
- Search servers – for large corpora, extensions connect Apache Solr or Elasticsearch: facets, weighting, suggestions, millions of documents.
- AI search – the semantic stage: dAi Pro combines full-text and vector search (hybrid search), understands paraphrases instead of mere keywords and, on request, answers questions directly – with source citations. The free variant dAi brings this technology to any TYPO3 site as a chatbot.
Multilingualism and multisite
Multilingualism is not a plugin in TYPO3 but a core capability: every page and every content element can be translated into any number of languages – connected ("connected mode", translations follow the original) or free. Language fallbacks govern what visitors see when a translation is missing; hreflang links are generated automatically. Equally central: multisite. One TYPO3 installation runs any number of websites with their own domains, designs and editorial teams – corporations bundle dozens of country and brand sites in a single system. dAi Pro uses exactly this capability: the chatbot's knowledge base keeps language versions separate and answers visitors in their language.
Translation workflows in detail
How does the second, fifth or fifteenth language get into the site?
- Connected mode – translations are tied to the original: structure and order follow the source language, and new elements are offered for translation. Ideal for consistent corporate sites.
- Free mode – languages may carry independent content, for example when the US site sets different priorities.
- Fallback chains – if a translation is missing, a definable next language or the original steps in.
- Label translation – interface texts live in XLIFF files, cleanly separated from content.
- Translation export – content can be exported for translation agencies and re-imported.
Or translate right inside the system: dTranslate uses TYPO3's regular localize path and translates pages including their content elements with the language model of your choice – with a glossary for company terminology and HTML preservation.
For developers: extensions and APIs
TYPO3 is built for extensibility. Thousands of free extensions are available in the TYPO3 Extension Repository (TER) and via Composer/Packagist; custom extensions are built with the Extbase framework and Fluid, or directly on the core APIs:
- DataHandler – the central write API that keeps permissions, history and references consistent.
- Scheduler and CLI – recurring jobs, command-line commands, queue processing.
- Events and middlewares – clean extension points instead of core hacks.
- Headless operation – content as JSON for apps, SPAs or other frontends; classic rendering and headless can be mixed.
- Import/export, REST, SOAP – connections to PIM, shop, CRM and government systems are everyday business.
Our own products are the practical proof: dAi, dAi Pro and dTranslate use exactly these APIs – from DataHandler hooks to scheduler tasks.
The most important core APIs
What developers appreciate about TYPO3 are well-designed, stable APIs for the standard tasks of any web application:
- Caching framework – multiple cache levels with interchangeable backends (database, Redis, APCu) and targeted invalidation via tags.
- Event dispatcher – PSR-14 events as clean extension points; plus middlewares for request processing.
- Dependency injection – services following the Symfony pattern, configured in Services.yaml.
- Message bus – asynchronous processing via Symfony Messenger, for example for heavy background jobs.
- Mail API – Fluid-based email templates with HTML and text versions, arbitrary transports.
- Logging and reports – PSR-3 logging with configurable channels; the reports module shows system health and warnings.
- Application context – development/production contexts separate per-environment configuration cleanly.
Here too: dAi Pro is built on exactly these APIs – caching, events, DI, scheduler – which keeps it update-proof.
URLs, routing and redirects
Clean URLs are a core feature in TYPO3, not a plugin:
- Speaking URLs – every page carries a slug derived from its title and freely adjustable; special characters and languages are handled correctly.
- Route enhancers – extension pages (news details, product pages, pagination) also get configurable, pretty URLs instead of parameter chains.
- Redirects module – editors maintain redirects themselves; on slug changes TYPO3 automatically offers the matching redirect so no links break.
- Error pages – 404/403 handling configurable per site, with custom content pages.
- Multiple domains – each site has base URLs per language; domain moves and consolidations are orderly.
SEO tooling in detail
Search engine optimisation is part of TYPO3's standard equipment:
- Per-page metadata – SEO title, description, robots directives and canonical URLs directly on the page record, per language.
- Open Graph and X/Twitter cards – social previews with their own titles, descriptions and images.
- XML sitemaps – automatic per site and language, extensible with custom data sources (such as news or products).
- hreflang – language links are generated automatically from page translations.
- Title provider API – extensions set page titles cleanly (for example the news headline on detail pages).
Integrators add structured data (Schema.org) deliberately – as on this website, where the FAQ blocks generate their schema automatically from the content.
Dashboard, reports and system tools
The engine room is tidy as well:
- Dashboard – configurable widgets greet editors and administrators with key figures and shortcuts.
- Reports and system status – configuration issues, security notes and environment checks at a glance.
- Scheduler – recurring tasks (indexing, imports, clean-ups) with logs; dAi Pro runs its ingest queue and agents on top of it.
- Install tool and upgrade wizards – system maintenance, database comparison and guided version migrations.
- List module – bulk editing of any records including a clipboard, CSV export and advanced search.
- Import/export – export page branches with their content as packages and load them into other installations.
Security, updates and LTS
Security is one of the main reasons organisations choose TYPO3. A dedicated security team reviews reports and publishes coordinated advisories and patches – for the core and for extensions. The LTS policy makes updates plannable: an LTS version receives security updates for years, and ELTS contracts extend that where needed. The permission system cleanly separates editing, administration and system level; the install tool, content-security-policy support and password policies are standard.
To be honest: security only comes with maintenance. Outdated installations are the most common problem we see – which is what our TYPO3 emergency service with its health audit and fixed-price updates is for.
Security features in detail
Beyond processes and LTS, concrete protection mechanisms are built into the system:
- Multi-factor authentication – TOTP apps and recovery codes for backend accounts, per user or mandatory.
- Modern password hashing – Argon2 and configurable password policies.
- Content Security Policy – manage CSP rules centrally and inspect violations.
- Brute-force brakes – rate limiting and lock-out mechanisms at login.
- Context separation – the backend can be protected via IP rules, a separate domain or upstream access control.
- Extension vetting – security advisories also cover third-party extensions; the Composer approach makes versions traceable.
What the system cannot replace is operations. Our health audit checks exactly these points on your installation.
Performance and scaling
TYPO3 scales from a club website to a corporate portal with millions of page views. The multi-level caching framework stores finished pages, individual content elements and database queries; reverse proxies such as Varnish or CDNs integrate cleanly because TYPO3 controls cache headers and invalidation itself. Images are generated and delivered server-side in appropriate sizes. Compute-heavy tasks – such as dAi Pro's AI indexing – run via scheduler and queues so the website itself stays fast.
Accessibility and standards
TYPO3 outputs the markup developers define – without a forced theme corset. Websites can therefore be built consistently to WCAG and public-sector accessibility rules, which makes TYPO3 especially popular with public institutions. The backend itself is continuously improved for accessibility. Editorial discipline is supported too: mandatory alternative texts, structured headings and clean tables are configurable – and the editorial copilot of dAi Pro generates alternative texts with AI on request.
Typical use cases
Where TYPO3 plays to its strengths:
- Corporate websites with many editors, approval workflows and long lifetimes.
- International multisites – many countries, languages and brands in one installation.
- Portals and intranets with access protection, personalised areas and connections to line-of-business systems.
- Product and knowledge databases – structured data with custom types and searches; with dAi Pro also as AI chat and semantic search.
- Public sector and universities – accessibility, data sovereignty, long-term investment security.
TYPO3 compared: WordPress, Drupal & co.
The most frequent question in any selection process – here is the honest answer:
- WordPress is faster to set up and often the better choice for blogs, landing pages and small sites. TYPO3 shows its strengths as soon as permissions, approvals, multilingualism, multisite and longevity matter – where WordPress needs many plugins and discipline, TYPO3 brings the structure out of the box.
- Drupal is conceptually closest to TYPO3 (enterprise, open source). TYPO3 is much more firmly rooted in the German-speaking region – with a correspondingly large local network of agencies and developers.
- Site builders and SaaS CMSs are convenient but tie you to the vendor: data, hosting and feature set are in someone else's hands. TYPO3 belongs to you – including source code and data.
And if TYPO3 is not the right fit, we will say so in the initial consultation.
Hosting and operations
TYPO3 runs on any common PHP hosting and on any infrastructure of your own – from shared hosting through virtual servers to Kubernetes. Requirements are a current PHP version, one of the supported databases (MySQL, MariaDB, PostgreSQL, SQLite) and a web server such as Apache or nginx. There is no forced cloud and there are no licence fees; deployments run versioned via Composer and Git. For AI features, dAi Pro merely adds a PostgreSQL database with pgvector – likewise on your own infrastructure.
Upgrades: plannable instead of painful
TYPO3 major versions appear in a reliable rhythm, and the core ships migration tooling: the upgrade wizard walks through database and configuration changes, extension compatibility is declared clearly via Composer, and deprecation logs announce changes early. A well-maintained project thus moves from LTS to LTS in manageable steps. It becomes laborious when many versions were skipped or legacy extensions stand in the way – which is exactly what our fixed-price offers from health audit to major upgrade are for; we have known every migration path since version 3.8.
The ecosystem: community, association, agencies
Behind TYPO3 stands one of Europe's most active open-source communities: the TYPO3 Association with members from agencies and companies, core and extension teams, certification programmes (integrator, developer, consultant) and conferences and developer days across the continent. This network is an insurance policy for site owners: there are many qualified service providers, the knowledge is widely distributed, and no single vendor can discontinue the project or change the licence terms.
TYPO3 and artificial intelligence
TYPO3 itself ships no AI of its own – but it is the ideal foundation for integrating AI in a controlled way, because content is structured, multilingual and permission-controlled. This is exactly where our products come in:
- dAi – the free AI chatbot over your own TYPO3 pages (RAG and CAG with pgvector).
- dAi Pro – the platform with up to 16 data source types, website search, voice chat, autonomous agents and a REST API; all features at a glance.
- dTranslate – translations via the regular TYPO3 localize path with the language model of your choice.
All GDPR-compliant with European providers such as Mistral AI as the default – details on AI for TYPO3.
TYPO3 at Dreistein
We have worked with the system since TYPO3 3.8 (2005) – through every version and every migration. Around 60 of our reference projects are TYPO3 projects, including Michael Weinig AG, HOLZ-HER and MAN Trucks & Bus. Our services range from development, upgrades and maintenance through the TYPO3 emergency service to AI integration – much of it at fixed prices.
Frequently asked questions about TYPO3
TYPO3 itself is free: free software under the GPL, with no licence or usage fees – for any number of websites and editors. Costs arise for concept, implementation, hosting and maintenance. At Dreistein many services come at fixed prices, such as the health audit for €490.
For organisations that treat their website as long-term infrastructure: companies with several editors, international sites, portals, universities and public institutions. For a small blog or a quick landing page, TYPO3 is usually oversized.
WordPress starts faster and has the edge for small sites. TYPO3 ships permission management, approval workflows, multilingualism and multisite out of the box and stays maintainable for decades – which is why it dominates enterprise projects in the German-speaking region.
LTS (Long Term Support) versions receive security updates for years and are the basis for production projects. After regular support ends, protection can be extended via paid ELTS (Extended LTS) contracts – useful as a bridge when an upgrade is still pending.
Yes, architecturally it is particularly well positioned: TYPO3 runs on your own infrastructure, there is no forced US cloud or telemetry, and data custody lies entirely with the operator. The GDPR compliance of the overall website then depends on hosting, extensions and embedded services.
Yes. Content can be delivered as JSON and consumed by apps, SPAs or other frontends; classic rendering and headless can be combined. TYPO3's structured content model is a good foundation for this.
Security updates should be applied promptly when released; that usually takes minutes. Moving to a new LTS version comes up roughly every one and a half to two years and is well plannable for maintained projects.
A current PHP version, a supported database (MySQL, MariaDB, PostgreSQL or SQLite) and a web server such as Apache or nginx. Installation and updates run via Composer. There is no lock-in to any particular hosting provider.
Yes – via extensions. dAi provides a free AI chatbot over your own content, dAi Pro adds website search, voice chat, autonomous agents and many data sources, and dTranslate translates content with language models – GDPR-compliant with European providers such as Mistral AI.
Analyse first, then decide: depending on its condition, a staged upgrade or a rebuild with data migration is more economical. Dreistein's TYPO3 Health Audit (€490 fixed price) delivers findings and a recommendation within 48 hours.