Spotlight: TYPO3

This is based on many projects I did at the agency A&B One Digital for various customers, but in particular it is informed by the relaunch and maintenance of the website and intranet systems for Klinikum Region Hannover. The public-facing sites can be found at

Back in 2019 the agency created a new concept and design for the public website. The old one had already been based on TYPO3, so it was only logical to continue with TYPO3. I was one of the developers tasked with implementing the system. In 2022, I was contracted to upgrade the system from version 9 to version 11.


TYPO3 markets itself as an “Enterprise” CMS. That word is synonymous with slow, huge, or complicated to some people, and featureful, secure, flexible, or low risk to others. TYPO3 is all of those things.

It has been around for enough time (since 1998) to accrue a ton of features and has been worked on by hundreds of developers. Compared to other, similarly old PHP projects, it has a remarkable track-record regarding reliability and security, with issues being fixed in a timely manner.

Being enterprisey comes with certain costs though. The core modules contain about 2300 classes, which is quite the API surface. As you can imagine, becoming an expert in TYPO3 takes a lot of time. The system is so large in fact, that the TYPO3 association, founded to be the steward of its open source community, offers several different certifications (developer, integrator, editor, consultant).

Exactly what the doctor ordered

Klinikum Region Hannover is a modern health care provider with almost 8000 employees, definitely a size at which “enterprise-grade” software is required on all levels. It should be no surprise that the information accumulated after three years adds up to more than 6000 pages, spread over 15 domains.

From our perspective, the most valuable features for such a large site are TYPO3’s excellent multi-domain handling and its fine-grained access controls. This allows representing the company’s organizational hierarchy in the CMS by partitioning the editorial rights into groups and page structures.

There are more core features that cater to larger sites, such as the workarea concept (release process) and content versioning with rollback. These are not actively used by the customer’s team, but were still useful from time to time, for example to restore content after an accidental editorial change.

With age come warts

As anyone who has worked with older code bases can attest, some things stick around no matter how much you wish they didn’t. One such example is the TypoScript language. Meant to be a declarative way to describe the structure of the page to prepare the rendering, in the end it is just a weird syntax to create PHP arrays. The saving grace is that this rendering configuration can be stacked in the content hierarchy (page tree) and overriden or extended by custom modules.

In recent years, the TYPO3 project has shifted towards building on top of other packages from the PHP ecosystem, such as Symfony’s components. This makes it possible to apply experience gained in other projects and should put the system on an even more robust and secure foundation for the future.

Programmatic access to the content structure is still too complicated, which made it necessary to create a custom import/export extension to synchronize certain pages between the public and intranet sites.

Upgrades take time

This is one of the trade-offs when choosing TYPO3. The longish release cycle of major versions considered stable (LTS) means that about every 18 months, a large ball of changes has to be handled by developers. Community extensions sometimes never get updated to work with the new version. Deprecated things vanish after two major releases. More often than not, code written for a specific version keeps working for one or two more cycles, but after three years, some things are bound to be broken.

That said, TYPO3 is committed to providing a stable and long-lasting platform. Upgrades between successive versions are semi-automatic, and it is only really the custom extensions that need careful examination by a developer.

If you are not prepared to pay for a full upgrade, there is always the option to purchase the Extended Long-Term Support for TYPO3. Or just keep running your system as is. I know of at least one company that still runs on 6.2 LTS. Running an older version does not automatically make your site insecure and open to hackers.

Flexibility wins

TYPO3 can be customized to fulfil a broad range of requirements. Almost everything about the way content is modeled and displayed is configurable, making it possible to have it tailored to your own way of doing things.

As a consequence, learning to work with the system takes time. But once you are fully on board, it can be a powerful tool to manage your content, through all changes and re-organizations in your company.


If you would like to know more about my experience with TYPO3, I am one email away.