TYPO3 is a PHP CMS core where the work happens in extensions

What problem TYPO3 solves, and who it is aimed at

TYPO3 is an open source content management framework written in PHP. The README describes the difference between a CMS and a framework plainly: the value comes from separating a lean core from optional plugins called extensions, and from an open API that lets you extend the frontend that visitors see and the backend that editors use. The intended reader is the organisation that has more than one kind of page, more than one team touching content, and a site expected to live for years rather than for a campaign.

The project describes itself as an enterprise content management system, and the surrounding institutions match that claim. A TYPO3 Core Development Team works on the code, a TYPO3 Association exists with its own board and takes membership payments, and core development is funded in part through those membership fees and donations. That structure has a practical consequence for an adopter: there is an organisation behind the code whose continuity does not depend on one company's commercial interest.

The framework covers the unglamorous parts of a large site. Editors work in a backend reached through a supported browser. The system stores its content in a database, and pages are assembled from a template layer rather than being static files. The point of the extension model is that a site is assembled by choosing capabilities rather than by writing a custom application, and the README is direct about the breadth of that claim: it says the concept of extensions makes TYPO3 capable of being developed and used in almost any way, either through extensions available for download or ones you write yourself.

How the core is laid out and what the extensions actually are

Based on the repository layout, the code is not one application but a core package plus a directory of system extensions. The root composer.json declares the package as typo3/cms with type typo3-cms-core, and its autoload map points each namespace to a directory under typo3/sysext, for example TYPO3\CMS\Core to typo3/sysext/core/Classes and TYPO3\CMS\Extbase to typo3/sysext/extbase/Classes. Read that as the mechanism: the core is a set of subsystems, each one a self-contained system extension, and a site is assembled by adding to that set.

Two of those subsystems matter most for everyday work. Extbase is the object and persistence layer that extension code builds on, and Fluid is the template language the frontend uses. The README's documentation overview names manuals covering TypoScript, administration, development and core structure, which tells you that TypoScript, the configuration language that wires the site together, is treated as a first class topic with its own manual.

The database access layer is Doctrine DBAL, and the general application plumbing comes from Symfony components, mostly pinned to the 8.1 series. Extension distribution runs through extensions.typo3.org, and the composer setup includes typo3/cms-composer-installers and typo3/class-alias-loader, with the latter enabled in the extra configuration. Extensions are also downloaded and installed in the backend, so a site does not have to be entirely Composer managed, but the repository is clearly built with the Composer workflow in mind, down to a bin directory for project binaries and a platform pin for PHP.

The runtime baseline is stricter than the README's opening suggests

The README opens with the basics: TYPO3 requires a web server with PHP and a database, and the backend is reached through a supported browser. It also lists Apache, nginx or IIS, and operating systems including Linux, Microsoft Windows, FreeBSD and macOS. The deeper requirement is in the composer.json, and it is sharper than the prose suggests. The core requires PHP ^8.5, the Composer platform is pinned to PHP 8.5.0, and a set of PHP extensions is mandatory rather than optional, among them ext-dom, ext-fileinfo, ext-gd, ext-intl, ext-json, ext-mbstring, ext-pcre, ext-session, ext-sodium, ext-tokenizer and ext-xml, plus ext-PDO and a Composer runtime API of ^2.1.

That list is the part teams get wrong. An extension such as ext-intl or ext-sodium is not a nicety, so a host with a hand-rolled PHP build will fail at install time rather than at feature time. The project points at INSTALL.md in the repository and at the official system requirements documentation rather than restating versions in the README, and it does the same for installation and for upgrading, which is deliberate: the requirements move with each release and the documentation is the place that tracks them.

The absence of tagged releases in this repository is not a sign of an unmaintained project. The GitHub repository is described as a synchronized mirror of the primary core repository at git.typo3.org, and the composer branch alias maps dev-main to 15.0.x-dev, so the main branch carries the next major version under development. Releases and their change logs are published on get.typo3.org instead, which is where an adopter should look for what a version actually contains.

Getting a first site running, and where the documentation carries the load

The README does not contain a command sequence, and it says why by pointing you elsewhere: installation instructions live in the official Installation Guide at docs.typo3.org/installation, upgrade instructions at docs.typo3.org/upgrade, and system requirements at docs.typo3.org/system-requirements. The download and release note site is get.typo3.org, and third party extensions are searched and downloaded through extensions.typo3.org. The core source itself is what you are reading, and the repository root holds the pieces a project needs: composer.json and composer.lock for dependencies, INSTALL.md for the system requirement pointer, Build for the build tooling, typo3 for the system extensions, and files such as CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md and AGENTS.md.

For a first run, the sensible order follows that documentation. Install a PHP 8.5 capable environment with the required extensions and a database, take the core from the download or Composer route the Installation Guide describes, point a web server at the entry point, and open the backend to walk through the install tool. Read the change logs on get.typo3.org before each upgrade rather than jumping versions, because the same site is expected to move across many releases over its life.

One caveat about the source of truth: the GitHub copy is a mirror, so it is not where you file issues or push code. The README is explicit that the primary repository is at git.typo3.org, that code review happens on review.typo3.org, and that bug reports go to forge.typo3.org. Reading a mirror for context is fine; treating it as the place to contribute is not.

The costs that do not appear in the feature list

The README is unusually candid about one of them. Its final notes call TYPO3 one of the most sophisticated PHP and internet related applications available, and then say that because of the advanced level of the code and functionality, a degree of study, time and perseverance is required to fully understand it and get the best from it. That is the maintainers telling you the learning curve is part of the product, and it is the strongest argument in the file.

The second cost is extension selection. Nothing in the core produces a site, so every functional requirement beyond basic page delivery is an extension you must find, evaluate and keep updated. The README notes that extensions are available for download, and the project warns explicitly about security issues in both the core and in extensions, with a separate contact path for problems in your own extension. A TYPO3 site is therefore a dependency graph you assemble, and the size of that graph is a factor in your upgrade cost, not a detail.

The third cost is the licence, and here the README is direct. TYPO3 is released under the GNU GPL, and the note states that developments based upon TYPO3 must also be freely available under the GPL. The composer metadata records the licence as GPL-2.0-or-later. For internal business use this normally presents no distribution obligation, but for agencies shipping client work and for anyone publishing modified code, the copyleft term has to be checked by your own counsel against how the deliverable is licensed. The association's membership and donation route exists because core work is funded this way, and it is also the mechanism that keeps that funding in place.

Contribution, review and the security path

The contribution path is documented and formal. The README links a Contributors Walkthrough and the Review System, pointing to the core contribution documentation and review.typo3.org, and it asks people to use the Slack chat for help with their contribution environment, specifically the TYPO3 CMS core dev channel. For outside questions the project routes to StackOverflow rather than to Slack, on the grounds that Slack answers are lost in the noise, and it asks that questions be tagged typo3, with tags such as typo3-9.5.x, Fluid or Extbase where they apply. A community overview lives at typo3.org/community/meet.

The composer file also carries Gerrit hooks. Scripts named gerrit:setup:commitMessageHook:enable and gerrit:setup:preCommitHook:enable call installer scripts in the core to switch those hooks on, with matching disable commands, which tells you that contributions travel through Gerrit review with a commit message convention enforced locally.

Security has its own route. Suspected vulnerabilities in the core or in an extension go to [email protected], and the version number should be included. The team states that a confirmed problem in a third party extension is reported to that extension's author immediately, and a problem in an extension you wrote yourself should also be reported to the team so an advisory can be issued. The install guide adds the operational half of the job: subscribe to the announcement mailing list at lists.typo3.org so new core releases and security bulletins reach you, and consider hardening the instance by adjusting permissions on non-changing files and folders. In short, a TYPO3 site is only as current as its subscription and its extension list.

Editorial conclusion

Adopt TYPO3 when the site has many content types, editorial teams and a long life, and when PHP 8.5 plus a database is an acceptable baseline. Do not adopt it for a small brochure site or a team that wants no framework, because the extension model, TypoScript and the copyleft terms all assume institutional commitment. Before signing off, read INSTALL.md and the official system requirements, and confirm that the extensions you need exist on extensions.typo3.org, since the core alone ships no site features.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-2.0
3. Project website
4. README
5. TYPO3/typo3 on GitHub