# TYPO3 — DXP Scorecard

> Open-source PHP enterprise CMS with a page-tree editor, strong multisite and multilingual support, and long-term support releases.

**Category:** Traditional CMS · **Tier:** 4 · **Suite Capability:** 54/100 (ranked #33 of 45)

Source: https://www.dxpscorecard.com/platform/typo3
Last reviewed: 2026-10-19

## Summary

TYPO3 is a free, open-source PHP CMS built for large multilingual, multi-site estates, with strong localization, fine-grained permissions and staged editorial workflows in core. It is self-hosted only, so hosting, security patching and compliance sit with the buyer and their agency. Personalization, testing, headless delivery and AI all come from third-party extensions. The developer and agency pool is concentrated in Germany, Austria and Switzerland.

## Composite Scores

- Suite Capability: 54/100
- Cost Efficiency: 66/100
- Build Simplicity: 51/100
- Operational Ease: 52/100
- Platform Velocity: 61/100
- Compliance & Trust: 39/100
- AI Enablement: 38/100

## Use-Case Fit

- Marketing: 46/100
- Commerce: 34/100
- Intranet: 35/100
- Multi-Brand: 47/100

## Category Scores

- 1. Core Content Management: 66/100
- 2. Additional Platform Capabilities (DXP Features): 48/100
- 3. Technical Architecture: 62/100
- 4. Platform Velocity & Health: 61/100
- 5. Total Cost of Ownership: 66/100
- 6. Build Simplicity: 51/100
- 7. Operational Ease: 52/100
- 8. Use-Case Fit: 40/100
- 9. Regulatory Readiness & Trust: 39/100
- 10. AI Enablement: 38/100

## Strengths

- **No license fees and no feature gating** (89.5/100) — TYPO3 is GPL software with a single free distribution: workspaces, multi-site, multilingual, forms and SEO basics all ship without an enterprise edition. There is no per-seat, per-site or traffic metering, and no vendor contract is needed to run it. The only vendor charge is optional extended support for versions past their free window, priced per project per year.
- **Deep extensibility and flexible content modeling** (80.3/100) — Developers can define any record type in code with a wide set of field types, including references that point to several tables and relations editable from both ends. Extensions can change every layer through events, middleware, dependency injection, backend modules and CLI commands. The Content Blocks extension makes new content types quicker to build with YAML definitions.
- **Full control over where data lives** (76/100) — TYPO3 runs on any PHP stack, on premises or in any cloud, with MariaDB, MySQL, PostgreSQL or SQLite. Because no vendor processes your data, there are no sub-processors to vet. That suits European public bodies and others with data sovereignty requirements.
- **Fine-grained permissions for large editorial teams** (73.3/100) — Backend groups grant access per table, per field, per page subtree, per language and per file folder, all in core. Frontend user groups gate pages, content and, with an extension, individual files. This suits large intranets and public sector sites where many teams share one installation.
- **Staged publishing, approvals and full history** (73.3/100) — Workspaces keep drafts separate from live content, with custom review stages, responsible reviewers, email notifications and scheduled publishing of a whole change set. Every record keeps a field-level history with user attribution and one-click restore. Editors get approval workflows without buying an add-on.
- **Multilingual, multi-site estates from one installation** (68.3/100) — One installation runs many sites, each with its own domains, languages and fallback chains, and shared configuration bundles called site sets. Version 14 added a step-based translation wizard that prevents mixed translation modes. Adding a site costs only hosting and build effort, never a license.

## Weaknesses

- **No compliance certifications or uptime commitment** (24.3/100) — There is no SOC 2 report, ISO 27001 certificate or other product certification, because no vendor runs a hosted service. Nobody offers an uptime SLA or status page either. Buyers must get certifications and availability guarantees from their hosting provider or agency.
- **Personalization and testing rely on outside tools** (26.8/100) — Core only restricts content by logged-in user group, with no visitor segments, content variants, A/B testing or recommendations. The persona and Mautic extensions had not reached version 14 six months after its long-term release, so most teams add external SaaS. Marketing teams that run targeted campaigns will need a separate stack.
- **Steep learning curve and specialist skills** (38/100) — Developers must learn TYPO3-only tools such as TypoScript, TSconfig and the TCA (Table Configuration Array) on top of PHP. That knowledge does not transfer from other platforms, and experienced talent is concentrated in German-speaking Europe. German freelance day rates of roughly 750 to 810 EUR reflect that scarcity.
- **Self-hosting leaves the operations work with you** (40.5/100) — Teams apply roughly monthly patch releases, track extension security advisories, and manage a full PHP, database and image processing stack. Core offers basic health reports but no monitoring or alerting. There is no vendor ticket support, so day-to-day help depends on an agency contract.
- **Headless delivery is not in core** (43/100) — Core has no REST or GraphQL content API, and the community headless extension was still a release candidate for version 14 in October 2026. There are no official SDKs or content type generation for TypeScript. Teams building React or Next.js frontends will do more custom wiring than on API-first platforms.
- **Editor interface accessibility is unfinished** (34/100) — The project's own accessibility team states that the authoring interface is not accessible yet. No VPAT (Voluntary Product Accessibility Template) or conformance report is published. Public bodies that must buy accessible authoring tools have nothing formal to file.

## Ideal For

- European public sector bodies, universities and hospitals running many multilingual sites (fit 85/100) — One license-free installation handles dozens of sites and languages, with permissions per page tree and language, and a deep agency market in German-speaking Europe.
- Organizations with strict data sovereignty or on-premises hosting requirements (fit 80/100) — Everything runs on infrastructure you choose, with no vendor data flows, standard databases and long support windows backed by optional paid extended support.
- Mid-size enterprises with an established TYPO3 agency partner (fit 72/100) — Free core features cover workflow, versioning, forms and SEO, so budget goes to the build and hosting rather than license fees.
- Member portals and intranets that need tight access control (fit 65/100) — Frontend login, group-gated pages and files, and fine-grained backend rights work in core, with single sign-on available through extensions.

## Look Elsewhere If

- Regulated US buyers that need SOC 2 reports or a HIPAA business associate agreement (fit 20/100) — No vendor offers certifications, a BAA or an uptime SLA, and US hosting partners with TYPO3 expertise are scarce.
- Marketing teams built around personalization and experimentation (fit 25/100) — There are no native segments, variants, A/B tests or recommendations, and the main marketing automation extensions lag the current release.
- JavaScript teams wanting an API-first headless CMS (fit 35/100) — Content delivery as JSON needs a community extension that is not yet stable for the current release, with no official SDKs.
- Teams outside German-speaking Europe without a TYPO3 agency (fit 40/100) — The learning curve is steep and experienced developers and partners are thin on the ground elsewhere.

## Frequently Asked Questions

### What do current customers say is their favorite thing about being on TYPO3?

Reviewers most often praise TYPO3 for its modular design, its security record and its open-source base. They also value running many multilingual sites from one free installation, with fine-grained editor permissions and long support windows for each release.

### What is the 5 year TCO of TYPO3?

TYPO3 carries no license fee, so five-year cost is hosting, the agency build and upkeep. Each LTS release gets about three years of free updates; after that, TYPO3 GmbH sells paid Extended Long Term Support for older versions.

- Verify with the vendor: TYPO3 Extended Long Term Support (ELTS): https://typo3.com/services/extended-support-elts
- Verify with the vendor: Get TYPO3 14 LTS: https://get.typo3.org/version/14

### What are the best alternatives to TYPO3?

The closest alternatives to TYPO3 are Drupal, Umbraco, Joomla and Magnolia. Drupal adds a built-in JSON API and a larger global talent pool, Umbraco is easier for editors, and Magnolia suits enterprises that want a commercial vendor with support contracts.

- Compare TYPO3 head to head: https://www.dxpscorecard.com/head-to-head?a=typo3

### Does TYPO3 have built-in AI features?

No, TYPO3 deliberately keeps AI out of its core and provides interfaces instead. Extensions fill the gap: AI Suite generates content, images, translations and SEO metadata, while nr_llm lets a site use its own model and key, including locally hosted models.

- Verify with the vendor: TYPO3 v14 AI Integrations: https://typo3.org/article/typo3-v14-ai-integrations

### How hard is TYPO3 to implement and maintain?

TYPO3 is moderately hard to implement and maintain. Developers must learn TYPO3-only tools such as TypoScript and the TCA (Table Configuration Array), and self-hosted teams apply roughly monthly patch releases plus a major upgrade every three-year support cycle.

### What are some of the biggest criticisms of TYPO3 from current customers?

Reviewers most often criticize TYPO3 for its steep learning curve and weak ease of use. They also say implementation and maintenance take significant time, which weighs more because experienced developers are concentrated in German-speaking Europe.

---
Scored by The DXP Scorecard — an independent site; scorecards and platform inclusion are unsponsored, while the implementation partner network is sponsored and never read by scoring. Reproduce with attribution (CC BY 4.0). https://www.dxpscorecard.com