How to Setup TYPO3 Frontend Login in 2026 - Core, Extensions & Security

Looking to add secure visitor login to your TYPO3 website? This guide covers everything you need to set up frontend authentication, from the built-in core solution to advanced options like user registration, SSO, social login, password recovery, and security hardening. It’s fully updated for TYPO3 v12, v13, and v14.

Quick answer: In most cases, you can get started by enabling the built-in felogin extension, creating a storage folder for frontend users, and placing the Login Form plugin on a page. That handles the basic setup. 

The rest of the guide shows how to extend it with registration flows, SSO integrations, social login, and production-grade security improvements.

Frontend Login vs Backend Login in TYPO3 (Key Difference Explained)

Before you implement authentication in TYPO3, it’s important to understand that frontend users and backend users are completely separate systems.

Backend Users (be_users)

Backend users are editors, administrators, and developers who log into the TYPO3 administration area.

They are managed inside the Backend User module and have access to system configuration, content management, and site administration.

Frontend Users (fe_users)

Frontend users are your website visitors, members, or customers.

They never access the TYPO3 backend. Instead, their accounts are stored in a dedicated storage folder (sysfolder) and they log in through a frontend login form on your public website.

This guide focuses exclusively on frontend authentication. If you are looking for admin access security, refer to the TYPO3 Backend Login Setup Guide.

When Do You Need Frontend Login in TYPO3?

Frontend login is required when your website needs user-specific access or personalized experiences, such as:

• Member portals and gated content
• Customer accounts with order history or dashboards
• Event registration and booking systems
• B2B platforms with role-based access control
• Any system requiring persistent user profiles or login sessions

When You Don’t Need Frontend Login

Not every website needs authentication. You can skip frontend login if you only require:

• Contact forms
• Newsletter subscriptions
• Public informational websites
• Simple lead generation pages

Setting Up TYPO3 Frontend Login with felogin (Core Extension)

The felogin extension ships with every TYPO3 installation and powers the core frontend authentication system. It handles login, logout, password reset, and redirect behavior out of the box.

Current version: 14.3.2 (May 2026)
Compatibility: TYPO3 v12 LTS, v13 LTS, and v14

If you're using Composer (required for TYPO3 v12+), ensure it is installed:

composer require typo3/cms-felogin

For TYPO3 v13 and v14 projects, felogin is included in the core by default, so no separate installation is required.

Step 1 - Create a Storage Folder

In the TYPO3 page tree, create a new page and set its type to Folder (not Standard). Name it something like “Frontend Users”.

This folder stores all fe_users and fe_groups records.

Make sure to note the page ID, you’ll need it later in the configuration.

Step 2 - Create a Frontend User Group

Inside the storage folder, create a new record:

System → Website Usergroup

Give it a meaningful name, such as “Members”.

User groups define access control and determine which pages or content a user can view.

Step 3 - Create a Frontend User

Still inside the same storage folder, create a new record:

System → Website User

Set a username, password, and assign the user to the group created in Step 2.

Step 4 - Create a Login Page

Add a new standard page in your site structure. This page will host the login form.

Typical names include “Login” or “Member Area”.

Step 5 - Insert the Login Form Plugin

On the login page, add a new content element:

Plugins → Login Form

In the plugin settings, set the User Storage Page to the folder created in Step 1.

This is the most common misconfiguration point, if this is not set correctly, login will fail silently.

Step 6 - Configure Redirect Behavior

Open the plugin’s Redirects tab and define where users land after login.

Recommended setup:

• Redirect Mode: login
• Login Redirect Page: Member Area (or dashboard page)

Step 7 - Test the Login

Clear all caches and open the login page in an incognito window.

Log in using the credentials created in Step 3.

If login fails, verify:

• The storage folder is correctly assigned
• The frontend user is enabled (no start/end restrictions)
• The user is assigned to a valid group

Configuring felogin - Site Sets, TypoScript & FlexForm

felogin can be configured in three ways depending on your TYPO3 version and project setup.

FlexForm (All Versions)

Configure directly in the plugin settings in the backend.
Best for simple sites, editors, or non-developer setups.

TypoScript (TYPO3 v12+)

 

plugin.tx_felogin_login.settings {
   showForgotPasswordLink = 1
   redirectMode = login,getpost
   redirectPageLogin = 42
}

 

Site Sets (TYPO3 v13.1+ Recommended)

Modern, structured approach using YAML:

 

name: vendor/my-site-package
label: My Site Package
dependencies:
 - typo3/felogin
 - typo3/fluid-styled-content-css
settings:
 felogin.pid: 42
 felogin.showForgotPasswordLink: true

 

Site Sets are the recommended approach for TYPO3 v13+ as they replace most TypoScript and can be managed via the backend Settings Editor.

Understanding Redirect Modes

felogin supports multiple redirect modes. Incorrect setup can cause login loops or broken navigation.

• login → Redirect to a fixed page after login
• getpost → Use redirect from URL parameter
• referer → Return to previous page
• refererDomains → Restrict referer to allowed domains
• groupLogin → Redirect based on user group
• userLogin → Redirect per user
• logout → Redirect after logout

Recommended starting setup: login,getpost
You can combine multiple modes depending on your project needs.

More Frontend Login Extensions

EXT:flogin - Magic Link & Brute Force Protection

Download | Compatible: v12, v13

While felogin is the standard TYPO3 login solution, flogin adds modern authentication features, including:

• Magic link login (passwordless email login)
• Brute force protection with IP/user lockout
• Temporary frontend accounts for testing
• Email notifications for login, reset, and lockouts

Ideal for security-focused projects or UX flows that avoid passwords entirely.

EXT:loginviaemail - Email as Username

Download | Compatible: v12, v13

This extension simplifies authentication by allowing users to log in using their email address instead of a separate username.

• Uses email as login identifier
• No complex configuration required
• Works directly with existing frontend user records

Frontend Registration Extensions

felogin only handles authentication. For user signup, you need a dedicated registration extension.

EXT:femanager (Recommended)

Docs | Compatible: v12, v13, v14

 

composer require in2code/femanager

 

The most widely used TYPO3 frontend registration solution:

• Self-registration with configurable fields
• Profile editing for logged-in users
• Admin approval workflow before activation
• Email notifications for all user events
• Built-in password strength validation
• Flexible configuration via FlexForm

Recommended default choice for most TYPO3 projects requiring registration + user management.

EXT:sf_register (Alternative by evoweb)

Docs | Compatible: v12, v13

 

composer require evoweb/sf-register

 

A solid alternative to femanager built with Extbase & Fluid:

• Multi-step registration flows
• Email confirmation per step
• Admin approval support
• Lightweight architecture

Choose this if you prefer a simpler or more minimal footprint.

EXT:sr_feuser_register (Legacy)

Download | Limited TYPO3 v12 support

The original TYPO3 registration extension, used in older projects.

Important:

• Only use for maintaining legacy systems
• Ensure version ≥ 12.5.0 due to security fixes
• Not recommended for new projects

For new builds, prefer femanager or sf_register.

Social Login - Google, Facebook, LinkedIn & More

For consumer-facing TYPO3 websites, social login removes the biggest friction point: creating yet another account.

The T3Planet Social Login Extension enables one-click authentication using providers like Google, Facebook, LinkedIn, Apple, and X (Twitter). Users log in with existing accounts, no separate registration or password required.

Key Features

• OAuth 2.0 support for major providers
• GDPR-compliant data control
• Works alongside felogin (social or email login options)
• Compatible with TYPO3 v12 LTS, v13 LTS, v14
• Full backend configuration, no coding required

Use social login for B2C platforms where conversion matters. Keep felogin (or combine both) for controlled or enterprise-grade user access.

SSO & Third-Party Login Extensions

OpenID Connect (OIDC) - Enterprise Standard (2026)

For enterprise, government, and large-scale systems, SSO via OpenID Connect is now the preferred standard.

TYPO3 supports this via:

• causal/oidc - Connects TYPO3 frontend login to any OIDC provider, supports PKCE security flow
• miniOrange OIDC - Broad enterprise integration (Azure AD, AWS Cognito, Okta, Keycloak, Salesforce, Office 365, Discord) with frontend + backend login support

Other SSO Extensions

Extension	Use Case	Compatibility
hairu	General frontend SSO	v13 supported
sf_yubikey	YubiKey 2FA backend login	v13 supported
ap_docchecklogin	Healthcare DocCheck login	v13 supported
auth0	Auth0 integration	check TER
miniorange_saml	SAML/OIDC SSO	v13 supported
cidaas	Identity cloud login	check TER
mocean_sms_login	SMS-based login	limited

Always verify the latest TYPO3 v13/v14 compatibility in the TER before production use.

Password Reset - “Forgot Password” Setup

felogin includes a built-in password reset flow, but it is disabled by default.

Enable via FlexForm

Edit the Login Form plugin and enable:
“Show Forgot Password Link”

Enable via TypoScript

 

plugin.tx_felogin_login.settings.showForgotPasswordLink = 1

 

Enable via Site Sets (TYPO3 v13+)

 

settings:
 felogin.showForgotPasswordLink: true

 

Once enabled, felogin sends a time-limited password reset link to the user’s email.

You can customize email templates here:

 

EXT:felogin/Resources/Private/Templates/Email/

 

If emails are not sending, verify your mail configuration in the Install Tool:
System → Configuration → Mail

Securing Frontend Login (Production Checklist)

Frontend login is a high-risk entry point and must be hardened in production.

1. Password Hashing (Argon2id)

TYPO3 v12+ uses Argon2id by default. Confirm it is active:

 

'FE' => [
   'passwordHashing' => [
       'className' => \TYPO3\CMS\Core\Crypto\PasswordHashing\Argon2idPasswordHash::class,
   ],
],

 

2. Secure Redirect Handling

Avoid open redirect vulnerabilities by restricting allowed domains:

 

plugin.tx_felogin_login.settings {
   redirectMode = login,referer
   redirectAllowedHosts = yourdomain.de,www.yourdomain.de
}

 

Never rely on referer alone in production setups.

3. Security Patch Awareness

An open redirect issue in GeneralUtility::sanitizeLocalUrl affected TYPO3 v9–v13.4.17 and was fixed in:

• v13.4.18
• v14.0.2

Update immediately if you are on affected versions.

4. Brute Force Protection

felogin does not include rate limiting by default. Add protection via:

• EXT:flogin lockout mechanism
• Server-level rate limiting (nginx limit_req, fail2ban)
• Reverse proxy POST throttling for login routes

5. Secure Session Configuration

Enable HTTPS enforcement and secure sessions:

 

'FE' => [
   'lockSSL' => true,
   'sessionTimeout' => 86400,
],

 

Together, these measures ensure your TYPO3 frontend login is production-ready, secure, and resistant to common attack vectors.

User Groups & Restricting Content to Logged-In Users

Once frontend login is set up, TYPO3 makes it easy to control access using frontend user groups (fe_groups).

Restrict a Full Page

Go to the page properties → Access tab and assign a frontend user group.

• Only users in that group can access the page
• Others are automatically redirected to the login page

In TYPO3 v13+, redirect behavior is handled via the core error handler:

 

TYPO3\CMS\Core\Error\PageErrorHandler\PageContentErrorHandler

 

Restrict Individual Content Elements

Each content element also has an Access tab where you can set:

• Frontend User Group restriction

Only logged-in users in the selected group will see the element.
The rest of the page remains visible.

Common Setup Mistake

A frequent issue is misconfigured access control:

• The fe_group must be correctly assigned
• The user group must exist in the same site root context
• Cross-site group restrictions require additional configuration

Which Extension Should You Use?

Scenario	Recommended
Basic login for standard site	felogin (core)
Login via email	felogin + loginviaemail
Passwordless / magic link	flogin
User self-registration	femanager
Registration + profile management	femanager
Google/Facebook login	T3Planet Social Login
Enterprise SSO (Azure AD, Okta)	causal/oidc or miniOrange OIDC
Healthcare DocCheck login	ap_docchecklogin
Frontend 2FA	sf_yubikey or flogin

Recommended TYPO3 Login Stacks

Small Site / Intranet

• felogin + femanager

Consumer Portal

• felogin + Social Login + femanager

Enterprise / Government

• felogin + OIDC + secure login hardening + Argon2id

This structure helps you choose the right authentication stack based on security, UX, and scalability needs.

Troubleshooting Common Issues

Login form appears but login always fails

• Check: Is the User Storage Page set in the felogin plugin? (Most common issue)
• Check: Is the frontend user active (no start/end date restrictions)?
• Check: Is the user assigned to a valid frontend user group (fe_groups)?

Redirect not working after login

• Likely cause: misconfigured redirect mode
• Start with:
  • redirectMode = login
  • Explicit redirectPageLogin UID
• Clear all caches, including frontend caches

Password reset email not arriving

• Verify mail transport in Install Tool:
  System → Configuration → MAIL
• Check spam/junk folder
• Ensure showForgotPasswordLink = 1 is enabled

User logs in but cannot see protected content

• Confirm fe_group is correctly assigned on page or content element
• Ensure the user belongs to the correct group (not only a subgroup mismatch)
• Flush all caches after changes

Session expires immediately after login

• Check sessionTimeout in FE configuration
• Verify HTTPS + cookie settings (reverse proxy may strip cookies)
• Watch for SameSite cookie issues in load-balanced setups:
  • Ensure consistent SameSite = strict configuration across the system

Most TYPO3 frontend login issues come down to storage folder misconfiguration, missing user group assignment, or caching not being cleared.

Closing

TYPO3 frontend login has a clear path: start with felogin for the basics, add femanager or sf_register when you need registration, layer in Social Login or OIDC for modern authentication, and apply the security steps before going to production.

The most common mistakes are skipping the storage folder assignment, ignoring redirect mode security, and not setting Argon2id password hashing. Fix those three and you have a solid foundation.

If you need help setting up frontend login on a specific project, T3Planet support is available. For agencies managing multiple client sites, the Partner Program gives you access to all T3Planet extensions at discounted rates.