rx_shariff for TYPO3

Why standard social buttons are a GDPR problem and rx_shariff was the solution

Every Facebook Like button, every Twitter share widget and every LinkedIn embed transfers personal data to the platform - on page load, not just on click. IP address, browser fingerprint and referrer flow to Facebook before the visitor even has the chance to consent. This has been legally problematic since GDPR took effect in 2018 and has already led to warnings against website operators.

rx_shariff implements the Shariff principle that Heise Verlag developed in 2014 as a response to this problem: instead of embedding the platforms’ original widgets, rx_shariff renders its own privacy-compliant buttons. Only when a visitor clicks the button is a connection to the platform established. No tracking, no third-party requests, no cookies without interaction.

Typical use cases

Corporate websites with GDPR compliance requirements. A mid-market company wants to offer social share buttons on its blog articles without violating GDPR. The data protection officer has explicitly prohibited the standard widgets from Facebook and Twitter. rx_shariff delivers buttons that only establish a connection on click. The privacy policy can be correctly worded: “Only when actively using the share buttons is data transferred to third parties.”

Media websites with share counters. A specialist publisher wants to display under each article how often it has been shared on Facebook and LinkedIn. rx_shariff offers this function through an optional backend proxy: the TYPO3 server regularly queries share counts from the platforms and caches the results. The platforms see only the server, never the individual visitor.

Intranet portals with controlled sharing. A company operates a TYPO3 intranet and wants to make specific articles shareable via LinkedIn while excluding Facebook and Twitter. rx_shariff can be configured so that only selected platforms appear as buttons. Configuration is done per page tree or per content element. In the intranet context, this is particularly relevant because accidental sharing of internal information on public platforms must be prevented.

Technical architecture

rx_shariff consists of two components: a frontend widget and an optional backend service.

Frontend widget: the TYPO3 plugin renders an HTML button for each configured platform. This button is a simple anchor link (<a href="...">) with a share URL as target. On click, the platform’s share dialog page opens in a new window. No JavaScript is loaded on page load, no cookies set, no external resources requested.

Backend service (optional): for share counters, rx_shariff operates a server-side proxy. A PHP script queries the platform APIs (Facebook Graph API, LinkedIn Share API) and caches the results in a database table. The frontend displays the cached counter. The proxy updates counters via scheduler task every 15 to 60 minutes. The platform APIs see only the server IP, never the website visitor’s IP.

Configuration is done through TypoScript and extension settings:

• Platform selection (Facebook, Twitter/X, LinkedIn, Xing, Pinterest, WhatsApp, Telegram, email)
• Display variant (icons, buttons with text, compact variant)
• Theme customization via CSS classes
• Share counter enable/disable
• Backend service URL for counters

Dependencies: TYPO3 Core. For the share counter: PHP with cURL support, valid API keys for the platforms (Facebook Graph API requires app registration).

Common problems and solutions

Share counters always show 0. The platform APIs require authentication. Without a valid API key, Facebook and LinkedIn return no counters. Twitter/X shut down its share count API entirely in 2015 - a counter for Twitter is technically no longer possible. Solution: create a Facebook app in the Meta Developer Portal and configure the app token in rx_shariff. Disable the counter for Twitter or switch to X API v2 with OAuth 2.0, which however does not offer a share counter.

Buttons not visible after TYPO3 update. rx_shariff uses a TYPO3 plugin with its own content element. If the plugin is no longer registered after an update (e.g. through changed Composer dependencies), the content element disappears from the frontend. Solution: check the extension in the Extension Manager, update Composer dependencies, run vendor/bin/typo3 cache:flush.

WhatsApp share works only on mobile devices. WhatsApp Web and the desktop app do not consistently support the whatsapp:// URL scheme. On desktop browsers, clicking the WhatsApp button leads nowhere. Solution: use the web URL https://api.whatsapp.com/send?text=... on desktop, the app scheme on mobile. rx_shariff detects the user agent and selects the correct link automatically.

Migration and version compatibility

rx_shariff is available for TYPO3 v10 and v11 as a stable Composer package. For TYPO3 v12, community forks exist as the original extension is no longer actively maintained. The Shariff JavaScript project by Heise itself was placed in maintenance mode in 2022.

For new projects from TYPO3 v12 onward, Gosign recommends a reassessment: simple share links (href="https://www.facebook.com/sharer/sharer.php?u=...") are lighter than rx_shariff, GDPR-compliant and require no extension. The downside: no share counter. Those needing counters must implement the API queries themselves or use a service like ShareThis with consent management.

Migrating from rx_shariff to simple share links typically takes half a day: remove old plugin, create new Fluid partials for share links, adjust CSS. Gosign has performed this switch for multiple clients and improved page loading time by 150 to 300ms because the Shariff JavaScript and counter queries are eliminated.

The simple share link approach covers the common platforms: Facebook (https://www.facebook.com/sharer/sharer.php?u={url}), LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url={url}), X/Twitter (https://twitter.com/intent/tweet?url={url}&text={title}), email (mailto:?subject={title}&body={url}) and WhatsApp (https://api.whatsapp.com/send?text={url}). All links are privacy-compliant because no JavaScript is loaded and no third-party cookie is set. The links can be included as a Fluid partial in any template and styled via CSS classes.