Editors do not see their change
A page is changed and published in the backend, the frontend shows the old state — for hours. The Cloudflare cache knows nothing about publishing if nobody tells it.
Cloudflare for TYPO3
Cloudflare for TYPO3: protect the backend, speed up the pages
TYPO3 is a grateful system for Cloudflare: most pages are the same for every visitor and can be cached at the edge, the backend is clearly separated and needs protection, and the forms are the favourite target of spam bots. Set up properly, Cloudflare takes most of the load off the server and keeps attackers away from the backend. Set up wrongly, editors see old content after saving and the login form hangs in a challenge loop. We have operated TYPO3 installations for years and know where the levers are.
What typically goes wrong with TYPO3 behind Cloudflare
The problems are quiet: nothing fails, but the editors are puzzled.
Backend login in a challenge loop
Bot protection or a challenge page in front of the backend path puts editors into a loop of captcha and login — or locks out the colleague working from home whose address happens to look suspicious.
Forms full of spam — or empty
Without protection, bots fill contact and application forms. With protection that is too coarse, real enquiries no longer get through either. You notice both only when you look.
The server stays directly reachable
The server address is still in the DNS or in its history. Attacks on the backend then bypass Cloudflare — and the firewall never sees them.
Why TYPO3 and Cloudflare go well together
A TYPO3 website delivers its pages mostly to anonymous visitors, and for them every page is the same. TYPO3 can tell the browser and every intermediate cache how long a page is valid — exactly this information Cloudflare uses to hold pages at the edge. The server is only asked when something has changed or the visitor is logged in.
The exceptions are clearly delimited: the backend, the install tool, areas with frontend login, and forms. That is exactly where firewall and bot protection come in. Because TYPO3 keeps this separation clean, Cloudflare can be configured precisely — unlike a shop, where almost every page can be personal.
Page cache with clearing on publish
Static files — images, scripts, styles, documents — Cloudflare holds for a long time. Pages are cached as long as the visitor is not logged in; areas with frontend login and everything under the backend path bypass the cache. The decisive part is clearing: when editors publish or clear the TYPO3 cache, the old version has to disappear at the edge as well. We couple the clearing of the Cloudflare zone to TYPO3 so that changes are visible immediately and nobody puzzles after saving.
What we switch off: convenience features that rewrite or lazy-load JavaScript. They silently break the TYPO3 backend and frontend scripts. And we check that TYPO3 sends the right cache information — without it, Cloudflare stores either nothing or the wrong thing.
Protecting backend, install tool and forms
The backend path is the target of every automated attack on TYPO3. We make it reachable only for those who need it: by network, by country or with a challenge in front that real editors see once and bots do not pass — without locking out the colleague working from home. The install tool stays closed from outside, requests for files that do not exist in TYPO3 are dropped immediately. Rate limiting caps login attempts and search queries per sender.
For forms we use Turnstile instead of classic captchas: no picture puzzles, no cookies, verified on the server — exactly as it works on this website. Verified search engines and your monitoring services are on the allow list; for bot protection the plan decides whether such exceptions are possible. After going live we read the security events and adjust the rules.
Encryption, and a server that only Cloudflare can reach
The connection between Cloudflare and your server stays encrypted all the way, with a valid certificate on the server. The server accepts web requests only from Cloudflare’s networks; on request Cloudflare additionally identifies itself to the server with a certificate. Attacks on the backend can no longer bypass the firewall.
And TYPO3 still sees real visitors: logs, its own lockout after failed attempts and statistics receive the original visitor address from the Cloudflare header instead of the address of the Cloudflare network. Without this detail TYPO3 eventually locks out all visitors at once after a few failed logins.
Operation and your account
The Cloudflare account belongs to you; we work as a member with the necessary rights. Every setting is documented and justified. The zone belongs in the regular review cycle of our TYPO3 maintenance — together with the security updates that Cloudflare does not replace.
For context: Cloudflare is a US provider, and your visitors’ traffic passes through its network. Using it belongs in your privacy policy and requires a data processing agreement, which Cloudflare provides. We supply the technical details.
Process
TYPO3 behind Cloudflare — and the editors notice nothing.
Send us the domain and, if available, a note on forms, logins and interfaces. You get an assessment of what makes sense in your situation — before the first click in Cloudflare.
- 01
Inventory
TYPO3 version and extensions, frontend logins, forms, interfaces and monitoring, state of an existing zone.
- 02
Foundation
DNS, end-to-end encryption, server reachable only by Cloudflare, real visitor addresses in TYPO3.
- 03
Cache
Check cache information in TYPO3, rules for files and pages, exceptions for backend and login areas, clearing on publish.
- 04
Protection
Secure backend and install tool, firewall rules, bot protection matching the plan, rate limiting, Turnstile for forms.
- 05
Test run and follow-up
Editorial test: change, publish, check. Form test. Then read the security events and adjust the rules.
Projects on this system
A selection — not the full client list.
Frequently asked questions
Why do editors not see their changes?
Because the Cloudflare cache still holds the old version. On publishing, TYPO3 clears its own cache, not the one at the Cloudflare edge. The solution is a coupling: publishing or clearing the cache in TYPO3 also triggers clearing of the zone. Until then only waiting or clearing by hand in the Cloudflare account helps — neither acceptable for anyone who edits daily.
How do you protect the backend without locking out the editors?
In stages. Whoever comes from known networks — office, VPN — passes directly. Everyone else gets a short challenge in front of the backend that a human passes once and a bot does not; if needed we additionally restrict by country. The colleague working from home is not locked out, but the login attempts from all over the world never reach TYPO3 in the first place.
Is the free Cloudflare plan enough for a TYPO3 website?
For a website without interfaces, often yes: encryption, cache, basic protection and a few custom rules are included. As soon as monitoring, interfaces or a frontend login with many users are involved, the Pro plan is worth it for the finer bot protection and the full rulesets. Cloudflare changes the exact limits per plan from time to time; we check them during setup.
Does Cloudflare replace TYPO3 security updates?
No. Cloudflare filters attack patterns at the edge, but a known vulnerability in an extension stays open until the update is installed — and an attacker who reaches the server past Cloudflare hits it unfiltered. Cloudflare is an additional layer in front of a maintained installation, not a substitute for maintenance.
What happens with frontend logins and protected areas?
They bypass the cache. As soon as TYPO3 recognises a logged-in frontend user, the page is personal for them and must not be cached. We set up the rules so that Cloudflare recognises this — otherwise the next visitor would see the logged-in user’s page.
Do we need Cloudflare if you host our website?
Not necessarily. Our servers in Germany are hardened and monitored. Cloudflare adds a line of defence in front of the server and relieves it during load peaks — for exposed portals, international sites and websites with many forms we recommend it. For a regional company website we discuss it openly.
Who owns the Cloudflare account?
You do. The zone runs in your account, we are invited as a member. Domains, certificates and rules stay with you even if our cooperation changes. An existing zone we take over as it is and clean up.
How long does the setup take?
For an existing TYPO3 website the setup is manageable; we state the effort after looking at installation and zone. We plan the switch so that the editors accompany it: change, publish, check — only when that works is the zone live.
Enquiry
Where do you stand with Cloudflare?
Whether nothing is set up yet or the website already runs behind Cloudflare and the editors are puzzled: we look first, then we say what needs to be done.
- An answer from someone who knows the system — no phone queue
- An assessment before the quote, even when it advises against the project
- Your details are sent to us by email, not into a third-party CRM