--- title: Using the power of your CMS to block Cross-Site-Scripting injections url: "https://b13.com/knowledge/block-cross-site-scripting-injections-with-typo3" description: Let’s dive into the practical part on how to make your TYPO3 site more secure by sending CSP Headers by default. image: "https://b13.com/fileadmin/_processed_/5/f/csm_CrossSiteScriptingInjections_Sharing_06f2d369d6.png" date: 2025-05-06 modified: 2026-08-19 lastUpdated: 2026-08-19 --- # Using the power of your CMS to block Cross-Site-Scripting injections [ Security ](https://b13.com/knowledge/security) [ Open Source ](https://b13.com/knowledge/open-source) Using the power of your CMS to block Cross-Site-Scripting injections ====================================================================== ![](https://b13.com/fileadmin/_processed_/c/6/csm_benni_5e519221c4.jpg)Benni Mack 06 May 2025 [ RSS Feed ](https://b13.com/rss.xml) In our [previous blog post](https://b13.com/knowledge/introduction-to-content-security-policy-csp), we’ve touched on most elements of Content Security Policy (CSP) to mitigate any kind of injection via Cross-Site-Scripting. If you haven’t caught up yet, be sure to read Part 1 first. Now, let’s dive into the practical part on how to make your TYPO3 site more secure by sending CSP Headers by default. - [Part 1: Introduction to Content-Security-Policy (CSP)](https://b13.com/knowledge/introduction-to-content-security-policy-csp) - **Part 2: Using the power of your CMS to block Cross-Site-Scripting injections** Dream Team: TYPO3 and Security -------------------------------- TYPO3’s low track record™ isn’t just there because of the minimum amount of security issues while powering hundreds of thousands of websites. In the past years, each new major TYPO3 version shipped with new security features. TYPO3 v12 provides out-of-the support for sending your website content with a fully customizable Content-Security Policy rule-set based on your templates, your TypoScript and even your plugins and content. CSP and a CMS: Why is it so complicated? ------------------------------------------ A major strength of a good CMS is that regular editors—non-coders—can put content on a website, without dealing with HTML, CSS or JavaScript. No training, no technical know-how needed. But as a result: Editors can put any kind of content on a page, like plugins for an image gallery with a zoom functionality based on a JavaScript library. In common scenarios, the security developers need to allow such code for this plugin in the safest way to be allowed in the CSP rules. For this reason, smart CMSes which also deliver frontend rendering unlike a headless CMS — that’s another story—can deal with this by utilizing the framework behind the CMS. TYPO3 v12, with its power to detect usages of a page while generating a page, utilizes all the common CSP features like nonces or hashes for non-cacheable content, unsafe-inline only when marked in a template, directly. Third-party extensions can provide common patterns of their plugins (such as a Google Maps integration) to hook into the CSP header generation as well. Disabled on updates, enabled for new sites -------------------------------------------- TYPO3 provides a strong CSP framework out-of-the-box in TYPO3 v12 - no need to add any extensions or plugins. As mentioned, enabling CSP on your website might break functionality such as Captcha or a direct integration into a social media post or other dynamic functionality, so it really needs to be battlefield-tested. TYPO3 v12 ships with CSP for the admin interface enabled by default for new sites. However, when upgrading, this feature is disabled, so you don’t have to worry about handling CSP during the upgrade. However, you may enable this in v12 during the upgrade or afterwards, to benefit from increased security. How to enable CSP Headers in TYPO3 Backend -------------------------------------------- In TYPO3 v12, you can activate sending of CSP Headers for the whole TYPO3 Backend via the Feature Flag `security.backend.enforceContentSecurityPolicy`. If you don’t have any custom extensions with custom Backend modules or enhanced JavaScript or inline CSS, you’re safe by setting the option `[SYS][features][security.backend.enforceContentSecurityPolicy] = true` in your config/system/settings.php. If you don’t use any version control or command-line, you can find the toggle in Admin Tools => Settings => Feature Toggles => “Security: backend enforce content security policy”. ![Screenshot aus dem TYPO3-Backend (v12) mit Funktionsschaltern zur Aktivierung der CSP-Standardeinstellungen](https://b13.com/fileadmin/_processed_/c/d/csm_screenshot-backend-csp-feature-toggles_7d62063076.webp "Screenshot aus dem TYPO3-Backend (v12) mit Funktionsschaltern zur Aktivierung der CSP-Standardeinstellungen") How to configure CSP headers for the Frontend and per site ------------------------------------------------------------ Activating CSP headers for the frontend works almost the same. There is a similar toggle `[SYS][features][security.frontend.enforceContentSecurityPolicy] = true`. For each site, you can individually configure the CSP headers to be sent via a site configuration file “csp.yaml”. ​​For full reference and details see: Common Pitfalls & Best Practices -------------------------------------- 1. **Go from strict to loose** Ensure that nothing is allowed at first, then browse through your site, your special functionality and plugins to see if everything is working—and loosen your policies where needed instead of having all options allowed. 2. **Analyze and debug** TYPO3 ships with a new “Content Security Policy” module that reports violations and also shows if the CSP feature for TYPO3 is set up properly. 3. **Use report-only mode** A report-only mode was added to TYPO3 v12.4.20 with a separate feature flag. which allows to try out stricter rules in production mode. 4. **Monitor your browser console** The DevTools of your browser console typically log information about CSP violations as well, allowing you to try out stricter rules. 5. **Beware of false positives** Always look at edge-cases which you cannot fix. As example: Special browsers such as Facebook’s in-app browser inside mobile devices always report CSP violations, because the Facebook App injects JS dynamically, which is—of course—something you want to avoid for your site and users to allow. 6. **Ship good defaults from custom extensions** Think of all the plugins, inline JavaScript, CSS and Font inclusions in your site rendering and test them in a real browser. Extensions can prepare custom CSP rules which you can include. Have a look at tt\_address as an example. [https://docs.typo3.org/p/friendsoftypo3/tt-address/main/en-us/Administration/Changelog/v/8–0-0.html#better-csp-support](https://docs.typo3.org/p/friendsoftypo3/tt-address/main/en-us/Administration/Changelog/v/8-0-0.html#better-csp-support) If you are still curious and want to dig deeper, have a look at TYPO3’s ChangeLog: Oliver Hader, the author of the CSP integration in TYPO3 v12, has also created a local environment based on DDEV to see CSP in action “CSP Simulator” Conclusion ------------ Setting up TYPO3 with basic CSP support doesn’t need a PHP developer skill, especially for new websites this feature is a must. However, when you update, be sure to enable CSP in report-only mode to find out what you need to adjust before enabling CSP headers for your website. ### Written by: ![Bild von Benni Mack](https://b13.com/fileadmin/_processed_/c/6/csm_benni_66cce9a81f.webp) b13 co-founder and TYPO3 CMS Core Development Lead, Benni Mack, heads our technical practices, setup and maintenance of our technical infrastructure, and coordinates our open-source contribution. His essential tool: TYPO3 Benni Mack CTO [ more from Benni Mack ](https://b13.com/team/benni-mack) Related Articles ------------------ - ![A purple graphic featuring a smartphone icon with three horizontal bars, surrounded by illustrations of vintage telephones.](https://b13.com/fileadmin/_processed_/2/5/csm_EXTphonenumber_Headerbild_93d5de1696.webp) ### Clean Phone Numbers in TYPO3: Why We Built EXT:phone\_number 11 August 2026 | David Steeb TYPO3 stores phone numbers as tel: links, but doesn’t format them for output. Meet EXT:phone\_number, a Fluid ViewHelper for clean, consistent numbers. [ Read more: Clean Phone Numbers in TYPO3: Why We Built EXT:phone\_number ](https://b13.com/knowledge/clean-phone-numbers-in-typo3) - ![Cartoon trophy character surrounded by hands giving thumbs up and a heart gesture, set against a gear-patterned background.](https://b13.com/fileadmin/_processed_/f/7/csm_T3ppy_Design_Kit_Headerbild_b51eb9dc31.webp) ### T3ppy Gives TYPO3 a Friendly Face 06 August 2026 | Florian “Flix” Keitgen TYPO3 is powerful—but it doesn’t have to feel impersonal. Meet T3ppy, our friendly companion for the backend. [ Read more: T3ppy Gives TYPO3 a Friendly Face ](https://b13.com/knowledge/t3ppy-design-kit) - ![Gavel labeled "AI" on a circuit-patterned background with yellow stars, symbolizing regulation or legislation related to artificial intelligence in the EU.](https://b13.com/fileadmin/_processed_/1/0/csm_EUAIAct_Headerbild_510724b3de.webp) ### AI Content in TYPO3: Labelling Needs Accountability 02 August 2026 | Benni Mack The EU AI Act brings the origins of AI-generated content into focus. AI Label marks AI-generated and AI-edited content in TYPO3 and records who signed off the published version—for… [ Read more: AI Content in TYPO3: Labelling Needs Accountability ](https://b13.com/knowledge/ai-content-in-typo3-labelling-needs-accountability) - ![Hands holding puzzle pieces are positioned around a partially completed puzzle depicting a computer interface.](https://b13.com/fileadmin/_processed_/d/7/csm_StopBuyingPlatforms_Headerbild_8a41a82f8a.webp) ### Stop Buying Platforms. Start Building Ecosystems. 09 June 2026 | David Steeb The first TYPO3 Summit North America opened with a keynote that reframes how enterprise teams should think about content management—from platforms to ecosystems, from vendor… [ Read more: Stop Buying Platforms. Start Building Ecosystems. ](https://b13.com/knowledge/stop-buying-platforms-start-building-ecosystems) - ![Colorful fish illustrations surround a central logo that reads "TYPO3 Summit.](https://b13.com/fileadmin/_processed_/4/3/csm_NorthAmericaSummit_Headerbild_5fbbbbb529.webp) ### Notes from Atlanta—What the First TYPO3 Summit North America Says About the Next Decade of Enterprise CMS 22 May 2026 | David Steeb Field report from the first TYPO3 Summit North America in Atlanta. On governance that can’t be acquired, predictable seven-year lifecycles, the FAIR distribution layer, and why the… [ Read more: Notes from Atlanta—What the First TYPO3 Summit North America Says About the Next Decade of Enterprise CMS ](https://b13.com/knowledge/atlanta-typo3-summit-north-america-enterprise-cms) - ![A rocket labeled "V14" launches into the sky, surrounded by a group of people celebrating with raised arms.](https://b13.com/fileadmin/_processed_/3/d/csm_v14_Celebration_Headerbild_3d4170fdc5.webp) ### Happy Release Day TYPO3 v14: Why This Release Shows the True Strength of Open Source 21 April 2026 | Florian “Flix” Keitgen TYPO3 v14 improves workflows for editors, marketing teams, and developers—and shows how community-driven open source creates real impact. [ Read more: Happy Release Day TYPO3 v14: Why This Release Shows the True Strength of Open Source ](https://b13.com/knowledge/happy-release-day-typo3-v14-why-this-release-shows-the-true-strength-of-open-source) - ![Four file folders displaying a bar graph with orange bars, set against a light blue background with abstract document outlines.](https://b13.com/fileadmin/_processed_/7/2/csm_PageInfoTabs_Headerbild_1e3eda44e5.webp) ### Taming the Page Module Header—Why We Built EXT:page\_info\_tabs 31 March 2026 | David Steeb When multiple TYPO3 extensions add content to the page module header, things quickly become messy. EXT:page\_info\_tabs structures everything into clean Bootstrap tabs, with zero… [ Read more: Taming the Page Module Header—Why We Built EXT:page\_info\_tabs ](https://b13.com/knowledge/taming-the-page-module-header-why-we-built-extpage-info-tabs) - ![Colorful palm leaves surround a central circular logo featuring a stylized design in orange and white, set against a light background.](https://b13.com/fileadmin/_processed_/3/a/csm_CMSflorida_Headerbild_7f47320b93.webp) ### CMS Kickoff 2026: Perspectives on AI, Open Source, and Digital Sovereignty 19 January 2026 | David Steeb CMS Kickoff 2026 in Florida brought together agencies, CMS experts, and open source communities to discuss AI, digital sovereignty, and the future of content management systems… [ Read more: CMS Kickoff 2026: Perspectives on AI, Open Source, and Digital Sovereignty ](https://b13.com/knowledge/cms-kickoff-2026) - ![User interface design featuring a dark sidebar with navigation options and a central content area with placeholder text.](https://b13.com/fileadmin/_processed_/6/6/csm_V14BackendUX_Headerbild_6dcecb335f.webp) ### Designing TYPO3 14’s Backend: Our Vision for a Modern, Expandable Foundation 12 January 2026 | Laura Heine b13 is redesigning TYPO3’s backend for version 14 to feel modern, work faster, maintain user context, and create an expandable foundation that can evolve for years to come. [ Read more: Designing TYPO3 14’s Backend: Our Vision for a Modern, Expandable Foundation ](https://b13.com/knowledge/designing-typo3-14s-backend-our-vision-for-a-modern-expandable-foundation) - ![A hand holds up a golden trophy with a logo, set against a blurred background of a building.](https://b13.com/fileadmin/_processed_/8/c/csm_ContainerAward_Headerbild_2a5154cdcb.webp) ### TYPO3 Awards: Container Extension wins “Best TYPO3 Extension” 28 November 2025 | Florian “Flix” Keitgen The Container Extension by Achim Fritz (b13) wins the TYPO3 Award 2025. A recognition for open source, clarity, and true TYPO3 DNA. [ Read more: TYPO3 Awards: Container Extension wins “Best TYPO3 Extension” ](https://b13.com/knowledge/typo3-awards-container-extension-wins-best-typo3-extension)