LimeSurvey for TYPO3

LimeSurvey is the GDPR-compliant answer for enterprise surveys that must not end up in Google Forms

Anyone running professional surveys in Europe (employee surveys, market research, evaluation studies, scientific fieldwork) and needing GDPR compliance, full data sovereignty and a clean audit trail almost inevitably ends up at LimeSurvey. The open source software runs on your own server, stores answer data exclusively in your own database and offers all the question types that serious research demands. For TYPO3 operators, the question is not whether to use LimeSurvey but how to integrate it into their existing website.

The audience are typically universities, research institutions, public administrations, hospitals, corporations with works council mandates and NGOs with sensitive target group surveys. An example: a university with 18,000 students runs a teaching evaluation every semester and wants to feed the results back onto its own TYPO3 website, without students having to switch between two systems.

Typical use cases

A first scenario is seamless survey participation on the TYPO3 page. Instead of sending students onto a separate LimeSurvey domain, the questionnaire is displayed directly on the website page. The answers flow into LimeSurvey through the API, and students see the familiar website navigation. This noticeably reduces the dropout rate.

A second scenario is SSO-based participant identification. A hospital group with 8,000 employees runs an employee survey. Participants log in to the TYPO3 intranet, click on the survey link and land in LimeSurvey without having to log in again. The SSO bridge guarantees that every employee only participates once and that personal data from TYPO3 does not flow into the survey answers.

A third scenario is the display of results directly on the website. A municipal administration runs a citizen survey on a construction project and wants to show the running totals as a bar chart on the project page every day. A sync job pulls the anonymised aggregates through the API and renders them in a TYPO3 content element, without raw data ever touching the TYPO3 installation.

A fourth scenario is a longitudinal study in research. A research project on workload in the care sector surveys the same cohort four times per year over two years. The TYPO3 page serves as information and entry point, LimeSurvey holds the waves, and the integration makes sure that every participant reaches their follow-up waves through a personalised link, without researchers having to maintain contact data inside LimeSurvey.

Technical architecture

LimeSurvey provides two API access points: the classic RemoteControl2 interface based on JSON-RPC and the newer REST API in current versions. For TYPO3 integrations, RemoteControl2 remains the stability anchor because it is available in older LimeSurvey installations and covers full authentication, participant management and answer queries.

The TYPO3 integration typically runs as a dedicated extension. A service layer encapsulates the API calls, a plug-in provides content elements for embedding surveys, and a middleware implements the SSO logic. For embedding there are two variants: the survey is called through a signed token and embedded via iframe, or the questions are read through the API and rendered directly as a Fluid template. The second approach offers the best user experience but requires more development effort.

The SSO bridge relies on a signed token that TYPO3 generates and LimeSurvey validates. A plug-in is set up inside LimeSurvey that reads the token from the URL and registers the participant as an anonymous token in the survey participant table. What matters is that the token is time-limited and only valid once per participant.

Common problems and solutions

The first problem is session handling between TYPO3 and LimeSurvey. Both systems have their own sessions, and when the iframe approach is chosen, problems with third-party cookies arise in modern browsers. The solution is to run LimeSurvey under a subdomain of the TYPO3 installation, so that cookies are accepted as first-party, or to use the API variant with server-side rendering.

The second problem is a performance crisis in the result display. Anyone who asks the API for aggregates on every page view puts unnecessary load on the LimeSurvey server. The solution is a sync job that writes aggregates into a TYPO3 table at regular intervals (for example hourly) and renders the content element from this cache table.

The third problem is GDPR-compliant handling of personal data. On employee surveys, the employer usually must not be able to tell who gave which answer. The solution is a clean separation concept: TYPO3 only provides anonymised tokens, LimeSurvey stores answers without any back reference, and aggregation happens exclusively through metrics that do not allow conclusions about individuals.

A fourth problem are mobile display weaknesses in iframe mode. LimeSurvey surveys are responsive, but inside a TYPO3 iframe, double scrollbars and clipped buttons appear on small screens. The solution is to switch to server-side rendering for mobile use or to dynamically resize the iframe to the content, so that the page layout container takes the full height.

Migration and version compatibility

LimeSurvey integrations run on TYPO3 v11, v12 and v13. The bigger challenge is on the LimeSurvey side: between LimeSurvey 3.x, 5.x and 6.x, API details and authentication methods have changed. Anyone lifting an existing integration onto a new LimeSurvey version should verify the API calls against the respective version documentation and ideally run an automated integration test against a LimeSurvey staging instance.

Gosign implements LimeSurvey integrations for universities, hospitals and public institutions. The API client is built with AI support from the RemoteControl2 documentation, the SSO bridge is adapted individually to the existing identity management, and the implementation follows clear GDPR documentation that takes work off the data protection officer.