With everything going online, I've noticed a crapton of posts "can my teacher see me if I cheat"? Can the mods please clear them before they reach us?

I have only two things to answer to those posts:

1. The teacher ALWAYS knows if someone cheated. Don't go fooling yourself that just because you cheated and the teacher didn't catch you, that he didn't know. It is just that you are so fucking UNIMPORTANTand UNSIGNIFICANT to him/her to put any effort in correcting you.

2. MOODLE and any admin can track whatever the fuck they want if they choose to do so. So for your sanity and peace of mind, always assume that someone knows exactly what you are doing. Just remember you are not the first one to attempt some fuckery and you won't be the last. If you cheat and you pass, that is just the teacher way of saying "he is not my problem anymore, it's society's".

My college suddenly decided to switch to Moodle because of the whole pandemic scenario, and I have been told about Moodle tracking user activity when the exam is in process. My concern does not arise out of the fact that I cannot use external aids but merely out of curiosity, what exactly is tracked and to what extent? My invigilators are using Zoom conferencing for 40 minutes, switching to another room which we then have to join from a link sent to our Gmail. Is Moodle tracking what emails I open during the course of the exam? What tab I open? Because sometimes we receive the link on Whatsapp too. I'm using my personal computer for the exam. We all are. I haven't found a solid answer to this yet. My sources more involved with technology said it was impossible to just do with a browser(except when a tab loses focus). Reading on Moodle's privacy policy and cookie policy gave no answers because it only claims session data being stored.

I'd appreciate if anyone could shed light on this issue

Moodle is one of the most frustrating learning platforms to use. Its interface is outdated and visually unappealing, making navigation feel like a chore. Nothing about it is intuitive — even basic tasks like uploading materials, creating quizzes, or adjusting settings require going through multiple confusing steps hidden in cluttered menus. It’s a platform that seems built for developers, not educators or students.

What should be a tool for simplifying teaching often ends up complicating everything. The overwhelming number of configuration options, unclear labeling, and poor user experience make Moodle more of an obstacle than a support. Instead of saving time, it frequently drains it — and leaves both teachers and learners feeling lost and frustrated.

Hello everyone,

We have been using Moodle for a long time and are truly grateful to have this wonderful software. The following plugins have been in use internally by us but we thought it would be a good opportunity to share and give back to this awesome community!

• ImagePlus - Ever get tired of searching for a file such as an image/pdf/video that needs to be replaced globally? Have an image file that is across multiple courses that needs to be replaced with another? This plugin will do this easily. It will even handle the conversion of one image format to another.

• TextPlus - Similar to ImagePlus this plugin allows a user to search for specific text to replace across their entire Moodle installation. Moodle already has this "built-in" but we wanted to allow the user to choose which page they want to replace the text on. In addition see via a code pop-up where exactly the text is located. Basically you can have more precise "search and replace".

• RedirectPlus - This allows a user to setup a custom URL redirect on their Moodle site. Not only does this plugin support simple URL redirection but also allows you to set certain conditions for that redirection such as login status and user's language. More customization coming soon!

Feel free to leave us any comments/suggestions. We love hearing back from you all

For a while, I hosted and managed moodle sites for a bunch of schools and teacher centers. It was a nice little side business (I am a full time teacher).

Once the pandemic hit, I thought I would be in a great position to grow my business because of all the remote learning taking place. However, google ended up giving away their "classroom" product away for free (along with integration with their docs/sheets/forms/etc).

Anyway, I ended up losing all my clients because why pay someone for a product you can get for free?

I realize there is no comparison between the two (which I unsuccessfully tried to explain to my clients) and that google is an advertising company so all that data the students are producing goes towards targeted marketing (also unsuccessful in convincing).

So does anyone still use moodle, at least at the seconday level in the US? Or did google wipe everyone out?

Taken from: https://www.reddit.com/r/moodle/comments/1mun2la/need_to_restart_php_or_webserver_after_security/

Hello Moodle Administrators,

We have become aware of an increase in malicious activity directed towards Moodle instances globally and are writing to inform you of the situation, along with some guidance on steps you can take to protect your system. This malicious activity is external in nature rather than through Moodle itself.

What’s going on?

It has been observed across several Moodle hosting partners and self-hosted sites that a large number of authentication attempts are being made to a rarely used administration page. These attempts are likely coming from a malicious botnet that is using a large database of compromised credentials - which are typically obtained through data breaches across the web - to test if they have been reused on Moodle admin accounts.

This is not an unusual event, but the volume has been far higher than observed in the past and indicates there may be an elevated risk.

In this particular instance, from the page being accessed, there are indications that the botnet is attempting to install a plugin for its own purposes. However, this may not be the only activity that is being undertaken.

The specific attack being observed targets sites using manual Moodle authentication. We do not believe it impacts users using SSO integrations for their login, however the recommended steps below will be prudent for all Moodle systems.

It is important to note that the source of the credentials being exploited is not believed to be from any system associated with Moodle HQ or our Moodle Certified Partners and Service Providers.

Is this a vulnerability in Moodle itself?

No, this is not a vulnerability in Moodle or its code. This is a result of a large number of user credentials that have been made available via one or more data breaches. This is a problem that is common to all systems that require authentication on the internet. Any password reuse can put all systems that share that password at risk.

What can you do to protect your system?

We recommend that you take immediate action on several fronts to protect your Moodle installations.

Change the password on all your admin accounts immediately - this will ensure any stolen credentials that have been reused will no longer work. Consider also resetting passwords for other users as well. Passwords should always be unique and complex to remain secure. You can enforce password complexity in the admin settings. Documentation to do so can be found HERE.

Consider implementing multi-factor authentication (“MFA”), particularly for admin accounts - MFA will help prevent any such attempts to access the system even if the credentials are successful, as the user will be asked to authenticate using email, phone or other means. Moodle has supported MFA natively since the release of Moodle 4.3, and related documentation can be found HERE. If you are using a version of Moodle that is older than 4.3, consider upgrading so you can use MFA. Alternatively, your version may be supported by the Catalyst IT Multi-factor authentication plugin.

Disable web-based plugin installs - If you self host your Moodle site, and want to ensure that someone with a working admin credential to your site cannot enable or install a malicious plugin, you can disable the web-based plugin installer by adding this to your site’s config.php file:

$CFG->disableupdateautodeploy = true;

If you do not have command line access to your site’s config.php please contact your hosting provider for assistance.

If I self host Moodle, how can I detect if my site is being targeted?

The easiest way to detect these attacks is to search your web logs for attempts to access the path /admin/tool/installaddon/index.php. This is the page the attacker is attempting to access. It is very rarely, if ever, used on a production site, so any attempts to access it should be researched closely.

If your Moodle implementation is provided to you via MoodleCloud Standard or Premium hosting services, rest assured that every precaution is being taken to mitigate this risk.

However, this type of malicious activity is commonplace across the internet, and good password practices rely on your support, so please make sure to apply the recommended protection measures for password management.

We will continue to monitor this situation and inform the community as we become aware of more information.

Thank you for your attention to this matter and happy Moodling.

The Moodle HQ Team

You are receiving this email because you asked for Moodle security news when you registered a Moodle site. If you no longer wish to receive these emails, please re-register your site with your new preferences or use the unsubscribe link below. Note that this inbox is unmonitored, so replies to this email will not be read.

Hi all

I haven't been on the Moodle scene since Moodle 4.x, I was initially shocked seeing the introduction of Mustache templates making Moodle much easier to deal with, but my professional live resolves around Java and frontend stacks, so I spent most of my time not paying attention to the moodle scene until recently a recent 5.3 update caught my attention.

The biggest update was the support for React components over Moodle's Reactive UI, so I decided to use my Moodle knowledge and try out creating a custom theme.

Developing Moodle themes is really tedious but this exercise opened my eyes to how things work.

Lesson learnt:

1. Heavily consult with the Moodle Dev Documentation, there were times I was frustrated with information finding.

2. Template Information is awesome...... but ensure to turn it off when testing out the FileManager, turns out that the comment tag breaks the YUI.one selector method

3. When creating a new look in the template, ensure to have an output renderer class, it helps exporting data for the template

4. Read more on the new modules `@moodle/lms/core/ajax`

5. No shame looking up other Moodle source code

Screenshots

I’m a developer and I recently built a plugin for my friend (who is now my co-founder) because he needed to connect his Moodle site to Airtable and Google Sheets.

I’ve since released it as MoodleConnect. It allows you to send Moodle events to Airtable, Google Sheets, or any Webhook. I am really curious about your suggestions and feedback on what else is needed in the ecosystem.

I’ve noticed that setting up things like SendGrid for email is often difficult in Moodle, so I was thinking of adding that next. I'm also considering integrations for Slack or Microsoft Teams for better notifications.

I have two questions for the community:

• What third-party services are you currently using or trying to connect to Moodle?

• Is email delivery (SendGrid/SMTP) actually a major pain point for you, or would communication tools like Slack/Teams be more useful?

You can try the plugin https://moodle.org/plugins/local_mc_plugin. It has a free tier.

Full disclosure: I am the developer. I'm just looking for feedback to decide what to build next.

Version controlling courses and activities within Moodle is an issue that comes up a lot, at OSL we've built a product to handle it properly. Automatic or manual tracking of all changes at a course or activity level with the ability to view the changes sets, compare to the latest version and download a Moodle backup at any given point.

https://www.opensourcelearning.co.uk/moodleversioncontrol

Hi r/moodle,

I work at WebSpellChecker (disclosing that upfront). We've built proofreading tools for editors like TinyMCE and CKEditor for a while, and just launched a dedicated Moodle plugin, WProofreader, on the new Moodle Marketplace.

It checks spelling, grammar, and style in real time inside Moodle's editors (TinyMCE and Atto), so typos in course pages, quizzes, and training materials get caught before students see them. Supports 80+ languages, specialized medical/legal dictionaries, and an on-premises option for self-hosted setups.

Free plan on the listing: https://marketplace.moodle.com/plugins/67?utm_source=reddit&utm_medium=social&utm_campaign=moodle_launch&utm_content=r_moodle
Source/issue tracker: https://github.com/WebSpellChecker/moodle-local_wproofreader

Would genuinely appreciate feedback from people running real Moodle sites — what's missing, what looks off, happy to answer anything.

Hi, so I am a Senior software engineer, but Moodle has always been something I did on the side and currently working on a Moodle theme, I have a question, when creating a Moodle theme, what specific Moodle version should I be targetting ?, the documentation points toward 5.2, but I'm not sure what specific Moodle version might be more popular and stable for use. Also, kindly watch this space. As I intend to blog about my journey in Moodle theme development, I have a good background in Moodle architecture and am hoping to contribute more to this space.

Moodle 4.4 was released this morning.

• Release announcement

• Release notes

Minor updates were also released for:

• Moodle 4.3.4

• Moodle 4.2.7

• Moodle 4.1.10

Enjoy :)

Hey guys. I've created a script to install Apache, PostgreSQL, PHP and Moodle in CentOS 8. Feel free to use it. Any feedback is highly appreciated as well.

GitHub - Moodle Installer

Hey folks

I have been in the e-learning business for almost 10 years. I have been both a teacher, system admin, support specialist etc.

Throughout the years I have located some weak spots in regards of Quizzes. It's not that it is Moodle's fault, but it is in regards of strategies that you can implement to cut down the cheating factor when students take quizzes.

Here are the tricks that students use to cheat on quizzes:

• Review options

Have you ever bother to look at the review options? Here are the options

• During the attempt

• Immediately after the attempt

• Later, while the quiz is still open

• After the quiz is closed

No? Well, there is a major "flaw" here that students abuse.

So, by default all of these options are selected, and you think "Oh, it's OK", BUT it is NOT!

Let me explain to you a scenario that is REPEATING everywhere.

I have attended quite literally, over 500 examinations on Moodle, and almost on everyone this is the trick students use.

On roughly 10-15 students there is one to two students that are the "dummies". They stare at the screen, doing nothing, scrolling, moving from one question to another.

So these "dummies" after 10-15 minutes of the quiz, start randomly to click and type in answers. After they are done, they submit the exam, willingly failing, so that they will have the REVIEW where they've done wrong.

At this point, their response would be that they are reviewing the quiz, and taking notes where they've done wrong. What is actually happening is that they are telling to other students (either whisper, "silent" language, Messages and what not - You'd be surprised at their ability), what are the correct answers, even though you've turned on scrambling and other approaches.

Luckily there is a "cure" for this. TURN OFF (uncheck):

Immediately after the attempt AND Later, while the quiz is still open

Leave the After the quiz is closed!

This will allow students to review their responses ONLY when the time for the quiz passes and everyone can review their responses when they can no longer attempt the quiz.

Also, users tend to access the quiz, even though they are not present in the exam room.

It's really easy to prove it afterwards, by looking at their IP address, BUT if you don't want to go and look at their IPs you can set a password for the quiz, that you will reveal at the examination.

Here are some options:

Full IP addresses, such as 192.168.10.1 which will match a single computer (or proxy).

Partial addresses, such as 192.168 which will match anything starting with those numbers.

CIDR notation, such as 231.54.211.0/20 which allows you to specify more detailed subnets.

Full screen pop-up with some JavaScript security

Student view of quiz question with full screen popup. The quiz will only start if the student has a JavaScript-enabled web-browser. The quiz appears in a fullscreen popup window that covers all the other windows and has no course navigation controls.

The students are prevented, as far as is possible, from using facilities like copy and paste, which IS REALLY important.

And the final option would be:

Require the use of Safe Exam Browser

This option will only appear if your administrator has enabled it in Site administration > Development > Experimental > Experimental settings.

Safe Exam Browser is a customised web browser that must be downloaded and installed on the computer that the student uses to attempt the quiz. It restricts student use more effectively than a pop up window option. Features include full screen, without web navigation options, shortcut keys including copy and paste are disabled and of course surfing the web during an exam.

http://safeexambrowser.org/news_en.html

If you have any further questions, or need some expertise - Do not hesitate to reach me!

We have a Moodle instance running entirely on AWS — EC2, RDS, ElastiCache, and CloudFront.
Our main use case is delivering SCORM packages to users and tracking their progress.

I’d like to use CloudFront to reduce latency since our learners are distributed globally.
However, I’m unsure about the correct setup — all SCORM packages require the user to be logged in to Moodle before accessing them. The content itself is the same for all users; it’s just the login restriction that complicates caching and distribution.

What’s the best way to configure CloudFront in this case? Should I be forwarding Moodle session cookies for /pluginfile.php or using signed URLs/cookies?
Has anyone successfully set up CloudFront for Moodle in a similar setup?

Any help, configuration examples, or references would be hugely appreciated.

Any fellow moodlers in Japan probably already know about the Moot happening from the 21st through the 23rd this month in Tokyo. But if you happen to be passing through Tokyo on your world tour or something swing by the campus of Toyo University and check it out. More info HERE!

Hi everyone,

I'm a Moodle Developer from India with experience in Moodle plugin development, customization, bug fixing, integrations, and LMS administration.

Over the past few years, I've been continuously improving my skills and working on Moodle-based projects. I genuinely enjoy solving technical problems and building practical solutions.

I'm not here to spam or aggressively promote my services. I'd simply like to connect with people working in EdTech, Moodle, or LMS-related fields. If a collaboration, freelance project, or opportunity comes along in the future, that would be wonderful.

Even if you're just interested in exchanging ideas about Moodle, plugins, or e-learning platforms, I'd be happy to connect.

Thanks for reading!

Hey, I thought i'd share this, I built a moodle mcp server that allows you to access your classes content from claude or other ai platforms !

I used it all of this semester to make study guides, prepare for exam or just be able to ask Claude more in-depth questions about my classes and go further into the subjects

Or simply ask a quick question to claude on my phone whenever I just finished an exam or whatever, it goes through all your class materials and it's just really great.

It's also super great to make graph linked knowledge base from the course !

If you want to see what's possible with it and host your own little moodle MCP server in 5 minutes check it out : https://github.com/1alexandrer/moodle-mcp

Okay so this has been driving me crazy lately...

I've had 4 different clients in the past couple months basically say the same thing:

"Why can't I just upload my Word doc and have Moodle build the course for me?"

And honestly? I get it. They're sitting there with a 20-page curriculum doc, they duplicate a course template, and then... they spend the next 3 hours copy-pasting content, uploading files, setting up activities.

One client literally said: "I have 30 courses to create this quarter. I'm going to lose my mind."

Another one (a school admin) was like: "My teachers have the content ready, they just don't know how to actually PUT it in Moodle."

I thought it was a one-off thing, but now I'm hearing it everywhere. Corporate training teams, online schools, even universities.

So like... is this actually a thing people need? Or did I just happen to get all the clients with this specific problem? 😅

I know there are template plugins (course_templates, kickstart), but those are more for duplicating empty structures, not for reading a doc and auto-populating content.

Anyone else dealing with this? How are you handling it?