Indonesian police say the suicide bombers who attacked three churches in Surabaya were all members of one family.

At least 13 people were killed and more than 40 injured when the group targeted Sunday mass congregations in the country's second-largest city.

Key points: Police are believed to be among those wounded in the attack

Police are believed to be among those wounded in the attack There has been no immediate claim of responsibility

There has been no immediate claim of responsibility Authorities are investigating whether there was an explosion at a fourth church

Indonesia's police chief Tito Karnavian said the family had been in Syria where the Islamic State group until recently controlled a large swath of the country.

He said the family's father carried out one of the attacks by exploding a car bomb, while the man's two sons, aged 18 and 16, used a motorbike in their attack. Their mother carried out another attack with her two children, aged 12 and nine.

Indonesian President Joko Widodo visited the sites and described the attacks as "cowardly actions" that were "very barbaric and beyond the limit of humanity".

The first attack, at the Santa Maria Roman Catholic Church, killed four people, including one or more bombers, police spokesman Frans Barung Mangera told reporters at the scene.

A street merchant outside the church said she was blown several metres away by the powerful blast.

"I saw two men riding a motorbike forced their way into the churchyard. One was wearing black pants and one with a backpack," said Samsia, who uses a single name.

"Soon after that the explosion happened."

Shattered glass and chunks of concrete littered the entrance of the church, which was sealed off by heavily armed police.

Rescue personnel were treating victims on a nearby field while officers were inspecting wrecked motorcycles in the parking lot that were burned in the explosion.

Paramedics tend to a man injured in one of the church explosions. ( AP: Trisnadi )

Minutes after the first, there was a second explosion at the Christian Church of Diponegoro that killed two people.

A witness described the woman with children, saying she was carrying two bags at the Diponegoro church.

"At first officers blocked them in front of the churchyard but the woman ignored them and forced her way inside. Suddenly [the bomb] exploded," said a civilian guard named Antonius.

Another two people died in a third attack at the city's Pantekosta Church, Mr Mangera said.

Carnage left in the wake of the bomb attacks. ( Supplied )

One other died in a hospital, he said.

Church engulfed in fire

"There is one location where we can't enter yet," Mr Mangera said.

Television footage showed one church engulfed in fire, with thick, black smoke billowing up.

A large blast was heard hours after the attacks, which Mr Mangera said was a bomb disposal squad "securing" a remaining device.

Inspector general Machfud Arifin told CNN Indonesia that one of the suicide attacks was carried out using a motorbike, another using a car.

Members of the police bomb squad inspect wreckage of motorcycles at the site of an explosion. ( AP: Trisnadi )

Two police officers were among the injured.

The toll could rise further, police warned.

El Shinta radio station says the almost-simultaneous attacks occurred during Sunday morning Masses.

Authorities were also investigating whether there was an explosion at a fourth church.

There was no immediate claim of responsibility for the attacks, but Indonesia's intelligence agency spokesman said it suspects the attacks were carried out by Islamic State-inspired group Jemaah Ansharut Daulah (JAD).

JAD is an umbrella organisation on a US State Department terrorist list that is estimated to have drawn hundreds of Islamic State sympathisers in Indonesia.

Wawan Purwanto, communication director for Indonesia's intelligence agency, also told Metro TV that the attacks were likely to be linked to a deadly prison hostage incident at a jail near Jakarta involving Islamist militants last week.

In that incident, five police officers were captured and executed by inmates during a riot involving convicted terrorists.

Asked who he thought was behind the church attacks, Mr Purwano said: "Still the old group, JAD, who has planned this for sometime."

National police spokesman Setyo Wasisto announced police fatally shot four suspected militants and arrested two others early on Sunday in West Java towns.

It was not clear if the shootings were connected with the church attacks.

"They have trained in order to attack police," Mr Wasisto said, also identifying the militants as members of JAD.

Police officers stand guard near the site where an explosion went off at Santa Maria church. ( AP: Trisnadi )

Indonesia is the world's largest Muslim-majority country and has seen a recent resurgence in homegrown militancy.

Police ordered the temporary closure of all churches in Surabaya, and a large food festival in the city was cancelled.

Indonesia has carried out a sustained crackdown on militants since bombings by Al Qaeda-affiliated radicals in Bali in 2002 killed 202 people.

Loading

Christians, many from the ethnic Chinese minority, make up about 9 per cent of Indonesia's 260 million people.

In Jakarta, the Indonesian Church Association strongly condemned the attacks and called on people to wait on authorities to investigate.

"We are angry with these attacks, but we leave it to the authorities to resolve them," said Gormar Gultom, an official with the association.

ABC/Wires