Security Overview

Security Overview

Security is a critical aspect of managing any Moodle installation. This guide covers the key security recommendations, settings, and best practices for keeping your Moodle site secure.

Security Overview Report

Moodle includes a built-in security overview report accessible at Site administration > Reports > Security overview. This report checks your site against common security best practices and provides a status for each check:

• Critical: Issues that need immediate attention
• Warning: Issues that should be addressed soon
• OK: Checks that passed successfully
• Info: Informational items

HTTPS Configuration

All Moodle sites should run exclusively over HTTPS. To enforce HTTPS:

1. Obtain an SSL/TLS certificate (Let's Encrypt provides free certificates)
2. Configure your web server (Apache or Nginx) to serve Moodle over HTTPS
3. Redirect all HTTP traffic to HTTPS at the web server level
4. Ensure $CFG->wwwroot in config.php uses https://
5. Enable Secure cookies only at Site administration > Server > Session handling

# Apache - force HTTPS redirect
<VirtualHost *:80>
    ServerName yourmoodle.example.com
    Redirect permanent / https://yourmoodle.example.com/
</VirtualHost>

Password Policy

Configure a strong password policy at Site administration > Security > Site security settings:

• Password policy: Enable to enforce complexity rules
• Minimum password length: At least 8 characters (12+ recommended)
• Minimum digits: Require at least 1 numeric character
• Minimum lowercase letters: At least 1
• Minimum uppercase letters: At least 1
• Minimum non-alphanumeric characters: At least 1 special character
• Maximum consecutive identical characters: Prevent patterns like "aaa"
• Password rotation: Force users to change passwords periodically

Anti-Virus Integration

Moodle can scan uploaded files for viruses using ClamAV. To configure:

1. Install ClamAV on your server: sudo apt install clamav clamav-daemon
2. Go to Site administration > Plugins > Antivirus plugins > Manage antivirus plugins
3. Enable ClamAV antivirus
4. Configure the ClamAV settings:
   • Running method: Choose between command line or Unix socket
   • Path to clamscan: Typically /usr/bin/clamscan
   • What to do with infected files: Quarantine or delete

Site Security Settings

Key security settings at Site administration > Security > Site security settings:

• Protect usernames: Do not reveal whether a username exists during password recovery
• Force users to log in: Require authentication to access any page (forcelogin)
• Force users to log in for profiles: Prevent anonymous access to user profiles
• Open to Google: Allow Google search bots to index your site as a guest
• Maximum uploaded file size: Limit the size of uploaded files
• Cron execution via CLI only: Prevent web-based cron execution to avoid abuse
• Cron password for remote access: If web cron is used, set a strong password

HTTP Security Headers

Configure your web server to send security headers. At Site administration > Security > HTTP security, Moodle provides options for:

• Strict-Transport-Security: Enforces HTTPS connections
• Content-Security-Policy: Limits resource loading sources
• X-Frame-Options: Prevents clickjacking (set to SAMEORIGIN by default)

Notifications of Login Failures

Configure email alerts for failed login attempts at Site administration > Security > Notifications:

• Display login failures to: Admins can see the number of failed login attempts
• Email login failures: Send email notifications for failed logins
• Threshold for email notifications: Number of failures before an alert is sent

IP Blocker

Restrict access to your Moodle site by IP address at Site administration > Security > IP blocker. You can maintain an allowed list (whitelist) or blocked list (blacklist) of IP addresses and ranges.

Two-Factor Authentication

Moodle 4.x supports multi-factor authentication (MFA) via the tool_mfa plugin. Configure at Site administration > Plugins > Admin tools > Multi-factor authentication. Supported factors include:

• TOTP (Time-based One-Time Password) apps like Google Authenticator
• Email verification codes
• IP range verification
• Trusted device recognition

Additional Security Best Practices

• Keep Moodle and all plugins updated to the latest stable version
• Use separate database credentials for Moodle (do not use the root database account)
• Restrict access to config.php with file permissions (chmod 640)
• Place moodledata outside the web root
• Regularly review user accounts and remove inactive accounts
• Enable audit logging and review logs periodically
• Disable unnecessary authentication plugins