PHPackages                             netresearch/nr-wellknown - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. netresearch/nr-wellknown

ActiveTypo3-cms-extension

netresearch/nr-wellknown
========================

Serve the well-known resources a TYPO3 site should provide (security.txt, change-password, gpc.json, llms.txt, agent-skills.json) from per-site configuration.

0.1.0(today)01↑2900%GPL-2.0-or-laterPHPPHP ^8.2CI passing

Since Jul 28Pushed todayCompare

[ Source](https://github.com/netresearch/t3x-nr-wellknown)[ Packagist](https://packagist.org/packages/netresearch/nr-wellknown)[ Docs](https://extensions.typo3.org/extension/nr_wellknown)[ RSS](/packages/netresearch-nr-wellknown/feed)WikiDiscussions main Synced today

READMEChangelogDependencies (8)Versions (2)Used By (0)

Netresearch: Well-Known
=======================

[](#netresearch-well-known)

Serve the well-known resources a TYPO3 site should provide, from per-site configuration. Static content is written into the docroot and served by the web server; the one redirect (`change-password`) is answered by a PSR-15 middleware.

What it provides
----------------

[](#what-it-provides)

Only the resources a corporate site genuinely should serve, each emitted **only when configured**:

ResourcePathKindSecurity contact (RFC 9116)`/.well-known/security.txt`staticPassword-change hint`/.well-known/change-password`redirectGlobal Privacy Control`/.well-known/gpc.json`staticAgent guidance`/llms.txt`staticAgent skills discovery`/.well-known/agent-skills.json`staticResources this extension deliberately does **not** create — OAuth, WebAuthn, NodeInfo/fediverse, `apple-app-site-association`, `api-catalog`, IndexNow and the other agent-readiness documents — are genuinely not-applicable to a site that does not offer them. A `404` is the correct answer there; do not fabricate them.

Scope: frontend only, never the backend
---------------------------------------

[](#scope-frontend-only-never-the-backend)

Well-known URIs describe the site to its **visitors** — the frontend. Nothing this extension serves may reference the TYPO3 backend:

- `change-password` targets the page where a **frontend user** (`fe_users` — member area, customer portal) changes their password. It must **never** point at the backend login (`/typo3`): a well-known URI advertising the admin login is an invitation, not a service. The extension has no default target — a site without frontend accounts simply leaves `changePassword` unconfigured and the path answers `404`, which is the correct, honest response.
- The same rule applies to every other resource: content is site/visitor-facing configuration, never backend URLs, backend users or internal infrastructure.

Requirements on the web server
------------------------------

[](#requirements-on-the-web-server)

The static files must be reachable under `/.well-known/` and absent paths must fall through to TYPO3 so the `change-password` middleware is reached. In the Netresearch `t3re` runtime the nginx block must read:

```
location ^~ /.well-known/ {
    try_files $uri $uri/ @t3frontend;
}
```

A block that only `allow all` serves static files but 404s absent paths before PHP — the `change-password` redirect would never be reached.

Configuration
-------------

[](#configuration)

Per site, in `config/sites//config.yaml` under a `wellknown` key. Every value is optional; a resource is emitted only when its required fields are set:

```
wellknown:
  security:
    contacts: ["mailto:security@netresearch.de"]   # >=1 required to emit
    policy: "https://www.netresearch.de/security-policy"
    preferredLanguages: ["de", "en"]
    expiresMonths: 6                               # default 6
  changePassword:
    target: "https://www.netresearch.de/mein-konto/passwort"  # required to emit
  gpc: true                                         # default true
  llms:
    source: "EXT:sitepackage/Resources/Public/llms.txt"  # file ref or inline text
  agentSkills:
    skills: []                                      # emitted only if non-empty
```

Generation and refresh
----------------------

[](#generation-and-refresh)

Run at deploy time:

```
vendor/bin/typo3 nr:wellknown:generate
```

This writes the configured files into `public/.well-known/` (and `public/llms.txt`) and recomputes `security.txt`'s `Expires` as *now + expiresMonths*. Re-running on every deploy keeps `Expires` valid, so the file never silently lapses. A site that deploys rarely should add a Scheduler task or CI cron invoking the same command. The generated files carry a moving date and are **not** committed to git.

Acceptance
----------

[](#acceptance)

Verify with the Website-Specification conformance checker: the in-scope criteria flip to *met*, the out-of-scope ones stay correctly *not applicable*, and `curl -sI https:///.well-known/security.txt` returns `200` with a future `Expires`.

###  Health Score

37

—

LowBetter than 81% of packages

Maintenance100

Actively maintained with recent releases

Popularity2

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity35

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

0d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/151247?v=4)[Netresearch DTT GmbH](/maintainers/netresearch)[@netresearch](https://github.com/netresearch)

---

Top Contributors

[![CybotTM](https://avatars.githubusercontent.com/u/326348?v=4)](https://github.com/CybotTM "CybotTM (22 commits)")

---

Tags

typo3well-knownrfc9116security.txtgpc

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StylePHP CS Fixer

Type Coverage Yes

### Embed Badge

![Health badge](/badges/netresearch-nr-wellknown/health.svg)

```
[![Health](https://phpackages.com/badges/netresearch-nr-wellknown/health.svg)](https://phpackages.com/packages/netresearch-nr-wellknown)
```

###  Alternatives

[friendsoftypo3/content-blocks

TYPO3 CMS Content Blocks - Content Types API | Define reusable components via YAML

103519.9k57](/packages/friendsoftypo3-content-blocks)[typo3/cms-styleguide

TYPO3 extension to showcase TYPO3 Backend capabilities

106760.3k34](/packages/typo3-cms-styleguide)[wazum/sluggi

TYPO3 extension for URL slug management with inline editing, auto-sync, locking, access control, and redirects

40529.5k](/packages/wazum-sluggi)[pagemachine/typo3-formlog

Form log for TYPO3

23238.6k8](/packages/pagemachine-typo3-formlog)[jweiland/events2

Events 2 - Create single and recurring events

2166.7k3](/packages/jweiland-events2)[in2code/lux

Living User eXperience - LUX - the Marketing Automation tool for TYPO3.

2158.6k1](/packages/in2code-lux)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)