Security and privacy

How to keep your Moodle site secure and methods for increasing privacy.

Documentation: Security, Security FAQ and Increasing privacy in Moodle

Before starting a new discussion topic, please check the Security FAQ and try a forum search.

DO NOT REPORT NEW VULNERABILITIES HERE!

New security issues should be reported in the Moodle Tracker with an appropriate security level.

1 (current)
2
3
4
5
6
7
8
9
10
…
16
Next

List of discussions. Showing 100 of 1534 discussions
Discussion	Started by	Last post	Replies
Plugin Shibboleth disabled action log not found	Marcos Borba 27 Feb 2021	Marcos Borba 27 Feb 2021	0
User profile page urls are loading even after the profile owner logs out	vijay majeti 26 Feb 2021	Fernando Navarro Páez 26 Feb 2021	2
Moodle & Content Site Policy (CSP) - XSS	Garth Brady 18 Feb 2021	Garth Brady 18 Feb 2021	0
Whitelist allowed file types in all server	omri yona 16 Feb 2021	omri yona 16 Feb 2021	0
Cookie Consent and Privacy Notice Popup	Alan Christie 13 Jul 2018	Agnes Beleznai 13 Feb 2021	17
About JQuery	Mahmood Naderan 11 Jun 2020	Ilya Tregubov 12 Feb 2021	10
website inaccessible	Luis Vicente Martínez 10 Feb 2021	Luis Vicente Martínez 11 Feb 2021	1
SSL Proxy Help	MARCO BONFIENI 5 Feb 2021	MARCO BONFIENI 5 Feb 2021	0
change tool_policy plugin's template texts	John Karistinakis 3 Feb 2021	John Karistinakis 4 Feb 2021	2
hide sender's IP address on contact form	John Karistinakis 2 Feb 2021	John Karistinakis 2 Feb 2021	0
Getting ClamAV Daemon working in Ubuntu 18.04	Mark Sharp 19 Oct 2018	koen roggemans 29 Jan 2021	8
HTTPS Conversion Tool Problematic Domains	Francis Lorenzo Guingao Doydora 25 Jan 2021	Francis Lorenzo Guingao Doydora 25 Jan 2021	0
Moodle db server hacked	manoj joseph 24 Oct 2020	Krys Learn 25 Jan 2021	3
Delete users without Data Deletion enabled	Silvia Pinheiro 18 Jan 2021	Silvia Pinheiro 18 Jan 2021	0
password, invalid characters	Velson Horie 11 Jan 2021	Randy Thornton 14 Jan 2021	1
Active Directory - Using subdomains	J. Dalton Humpf 12 Jan 2021	J. Dalton Humpf 12 Jan 2021	0
cannot login with any user	John Karistinakis 5 Jan 2021	John Karistinakis 7 Jan 2021	5
My host account suspended for being send bulk sms	HamidReza Sheerkoshan 1 Jan 2021	Visvanath Ratnaweera 3 Jan 2021	3
unique ip for all users!	usy use 31 Dec 2020	Visvanath Ratnaweera 3 Jan 2021	3
Block permission vs Authenticated User	Peter Eliyahu Kornfeld 30 Dec 2020	Peter Eliyahu Kornfeld 31 Dec 2020	2
Helping Users Recover Passwords	Jessica Rocheleau 13 Dec 2020	Mawan A. Nugroho 31 Dec 2020	5
Block access to /webservice/rest/server.php	Mawan A. Nugroho 30 Dec 2020	Mawan A. Nugroho 30 Dec 2020	0
Moodle cron jobs detect as suspicious activity	JASIM PERINGATTUTHODI 23 Dec 2020	Ken Task 24 Dec 2020	3
Sending secure mail using phpmailer	Frans Zwijnenberg 21 Dec 2020	Frans Zwijnenberg 23 Dec 2020	5
Prevent user from deleting evidence he didn't provided	Yvan Leduc 19 Dec 2020	Yvan Leduc 19 Dec 2020	0
Does Moodle call home?	Soen Trueman 21 Nov 2020	Randy Thornton 18 Dec 2020	9
Moodle hosted off Kuberate-What do I have to know?	Aarthi Ramesh 10 Dec 2020	Ken Task 10 Dec 2020	1
Connect DB over SSL...	Peter Eliyahu Kornfeld 9 Dec 2020	Peter Eliyahu Kornfeld 9 Dec 2020	0
Parent role access to profiles	Abdulhadi Zakkour 8 Dec 2020	Mary Cooch 8 Dec 2020	1
Security Differences Between Moodle LMS and MoodleCloud	Jessica Rocheleau 5 Dec 2020	Jessica Rocheleau 5 Dec 2020	0
Moodledata dir being written with 666 file permissions - want 600	Paul Martin 2 Dec 2020	Paul Martin 2 Dec 2020	0
Your Authentication token is invalid or has expired logout android app	Muhammad Naeem 28 Nov 2020	Muhammad Naeem 28 Nov 2020	0
Deleted users anonymization	eldoom 7 16 Nov 2020	Randy Thornton 26 Nov 2020	3
Block moodle for unenrolled users	Theo Radiere 23 Nov 2020	Theo Radiere 24 Nov 2020	2
SSL Mixed Content Errors	Carl Byerley 21 Nov 2020	Carl Byerley 22 Nov 2020	2
Restricting who can log in via mobile	Omar Al Matar 20 Nov 2020	Omar Al Matar 20 Nov 2020	0
Set flag to force user to change password	Edward Wahnström 13 Nov 2020	Randy Thornton 14 Nov 2020	2
Old Student Accounts	Colin Tennyson 12 Nov 2020	Colin Tennyson 13 Nov 2020	6
Access where there should none be	Ulrich Eckardt 9 Nov 2020	Ulrich Eckardt 9 Nov 2020	0
Database: Operating system used to Access Moodle	Blaž Podobnik 20 Oct 2020	Ken Task 20 Oct 2020	1
Guest login Suddenly stopped Working	Deepika Sahu 15 Oct 2020	Deepika Sahu 15 Oct 2020	0
Getting ClamAV Daemon working in Ubuntu 20.04	Davide Longo 11 Oct 2020	Tim Hunt 13 Oct 2020	1
VAPT Issues reported on Moodle 3.9.2+	Vinod Kumar Aleti 8 Oct 2020	Michael Hawkins 9 Oct 2020	4
student is not allowed to enter from a device different from the device he entered for the first ...	Jo Jo 29 Sep 2020	Visvanath Ratnaweera 30 Sep 2020	2
report by fraudulent mail	Iris Fernández 24 Sep 2020	Kaye Cheung 29 Sep 2020	3
How to hide bbb secret key on moodle?	Kenan Babacic 25 Sep 2020	Tim Hunt 26 Sep 2020	1
BURP scan: Session token in URL and Short Anti-CSRF token value detected	Rod Spears 24 Sep 2020	Rod Spears 25 Sep 2020	5
DDOS Protection	Eric Katchan 18 Sep 2020	Eric Katchan 18 Sep 2020	0
`Forbidden. "sesskey" field is missing or contains an incorrect value.`	cyber sec 15 Sep 2020	cyber sec 17 Sep 2020	2
Permissions for guests and connected users	Irith Herman 16 Sep 2020	Irith Herman 16 Sep 2020	0
Developer Admin Access Security	Keith VW 15 Aug 2020	Keith VW 11 Sep 2020	2
Google document converter and privacy/GDPR	Jari Vilkman 11 Sep 2020	Jari Vilkman 11 Sep 2020	0
Cannot find 'loginhttps' in mdl_config	Esli Verheggen 10 Sep 2020	Esli Verheggen 10 Sep 2020	1
Invalid Login Token	Mahmood Naderan 10 Jul 2020	Mahmood Naderan 10 Sep 2020	4
Block CLI login by Main Admin	Abayomi Dipeolu 9 Sep 2020	Emma Richardson 9 Sep 2020	1
Invalid sesskey Problem	James Quinones 9 Sep 2020	James Quinones 9 Sep 2020	0
Burp Suite Security report shows Issues for Moodle 3.5	vikas k 3 Sep 2020	Dan Marsden 7 Sep 2020	7
Inserting Javascript code in user profile (description field)	Peter Allen 21 Aug 2020	Michael Hawkins 24 Aug 2020	1
reset admin password?	Rachel Horst 6 Jun 2017	Frank Santos 16 Aug 2020	15
How can we delete entries in datarequests overview?	Ralf Hilgenstock 15 Aug 2020	Ralf Hilgenstock 15 Aug 2020	0
Should /admin/cli contents be hidden?	Christopher King 17 May 2020	Stefano Krister 28 Jul 2020	1
Multi-Factor authentication plugin for only specific users	Mario Gharib 13 Jul 2020	Tim Hunt 24 Jul 2020	1
User Audit in Prison Environement	Duncan Blake 19 Jul 2020	Visvanath Ratnaweera 22 Jul 2020	5
Prevent piracy - add watermark with user username to videos	Joana Pauperio 21 Jul 2020	Matt Bury 22 Jul 2020	1
Privacy Policy on Every Signon	Ryan Campbell 21 Jul 2020	Ryan Campbell 21 Jul 2020	0
Guest user	E HP 19 Jul 2020	E HP 21 Jul 2020	3
GDPR compliance & Moodle	Bente Olsen 17 Jul 2020	Michael Hawkins 20 Jul 2020	3
install CERTbot on moodle	Luis Alford 18 Jul 2020	Luis Alford 18 Jul 2020	2
'Successful Login Notification' to catch potential impersonation	Mario Gharib 13 Jul 2020	Mario Gharib 16 Jul 2020	4
Multi-Factor authentication plugin for only specific users	Mario Gharib 13 Jul 2020	Dan Marsden 16 Jul 2020	2
Email-based self-registration security without reCaptcha	Abhas Abhinav 16 Jul 2020	Abhas Abhinav 16 Jul 2020	0
Sending anonymous email	Kate Rhodes 10 Jul 2020	Kate Rhodes 16 Jul 2020	4
How can we disable attemp button when browser is closed	John Dafielmoto 3 Jul 2020	Visvanath Ratnaweera 11 Jul 2020	1
Files and uploads	Sultan Mehmood 30 Jun 2020	Michael Hawkins 1 Jul 2020	1
Messages in the sent folder of the email client	Mahmood Naderan 28 Jun 2020	Mahmood Naderan 30 Jun 2020	3
Trusted contents from users	Mahmood Naderan 17 Jun 2020	Michael Hawkins 22 Jun 2020	6
Modifying jQuery	Mahmood Naderan 19 Jun 2020	Mahmood Naderan 19 Jun 2020	0
Issue with javascript.php	Mahmood Naderan 17 Jun 2020	Mahmood Naderan 17 Jun 2020	2
data request tasks failing	Mark Kinoshita 12 Oct 2019	Mark Kinoshita 16 Jun 2020	10
Guest Access to Calendar Attachments.	Brian Pool 12 Mar 2020	Brian Pool 15 Jun 2020	2
Invalid Login Attempt	Visionaries ICT 12 Jun 2020	Visionaries ICT 14 Jun 2020	2
Security checks and Default role for all users	Séverin Terrier 15 May 2020	Nicolas Martignoni 12 Jun 2020	3
Privacy policies based on cohorts	andrea lms 8 Jun 2020	andrea lms 9 Jun 2020	2
Privacy consent on courses	andrea lms 4 Jun 2020	andrea lms 8 Jun 2020	2
User log in only from Mobile app	Misganu Muruts 7 Jun 2020	Misganu Muruts 7 Jun 2020	0
Assistance with running Cron	Heidie Chaplin 5 Jun 2020	Heidie Chaplin 5 Jun 2020	0
Manually update the MathJax URL in site administration to reference the patched version but failed	Bei Chapman 3 Jun 2020	Ken Task 4 Jun 2020	7
Cannot read WP salted passwords via External database authentication	Stavros Filippidis 28 Apr 2020	Leon Stringer 2 Jun 2020	1
Moodle data folder permissons	Eduardo Aspe 29 May 2020	Visvanath Ratnaweera 1 Jun 2020	10
Removing Teacher Permissions	Colin Tennyson 29 May 2020	Tim Hunt 30 May 2020	1
Best way to embed videos in courses and preventing download	umberto de domenico 21 May 2020	Rick Jerz 26 May 2020	7
Making embedded content visible for roles other than Admin	DaVinci Menno 22 May 2020	DaVinci Menno 22 May 2020	0
login page	Stefan Lippke 24 Apr 2020	Stefan Lippke 18 May 2020	2
Quick Question: Moodle backups and privacy	Bill Johnson 15 May 2020	Marcus Green 17 May 2020	1
Reset role button missing?	Richard van Iwaarden 25 Feb 2020	Séverin Terrier 15 May 2020	3
can a user steal another user's session by stealing it's session cookie?	Di Juwel 12 May 2020	Michael Hawkins 14 May 2020	3
any risks to report all PHP errors on production ?	Julien Boulen 13 May 2020	Julien Boulen 13 May 2020	2
Restrict access to courses during a period of hours on a day	Adolfo Franco 22 Apr 2020	Visvanath Ratnaweera 12 May 2020	3
Database connection failed	Safeen Shun 5 May 2020	koen roggemans 7 May 2020	9
Hidden course is visible to user with "Student" role in the course	Ricardo Caiado 2 May 2020	Mary Cooch 3 May 2020	4

1 (current)
2
3
4
5
6
7
8
9
10
…
16
Next