Security Settings

Security Settings

Moodle provides a comprehensive set of security settings to protect your site from unauthorized access, attacks, and data breaches. These settings should be reviewed and configured as part of your initial site setup and revisited periodically.

Site Security Settings

Navigate to Site administration > Security > Site security settings to configure the following:

Account Protection

• Protect usernames: When enabled, the password recovery form does not reveal whether an email address or username exists in the system, preventing user enumeration attacks.
• Force users to log in: Requires authentication for all pages. Disables guest access to the front page and course listings.
• Force users to log in for profiles: Prevents unauthenticated users from viewing user profiles.
• Maximum number of failed login attempts: After this many failures, the account is temporarily locked (default: 10 attempts).
• Account lockout duration: How long an account remains locked after exceeding the maximum failed login attempts (default: 30 minutes).

Password Policy

• Password policy: Enable/disable password complexity enforcement
• Minimum password length: Recommended minimum of 8 characters (12+ preferred)
• Minimum digits, lowercase, uppercase, non-alphanumeric characters: Enforce character type requirements
• Maximum consecutive identical characters: Prevents passwords like "aaaa1234"
• Password rotation: Require password changes after a set period
• Reuse prevention: Number of previous passwords that cannot be reused

IP Blocker

At Site administration > Security > IP blocker, restrict site access by IP address:

• Allowed list: Only allow access from specified IPs or ranges (e.g., 192.168.1.0/24). If set, all other IPs are blocked.
• Blocked list: Block specific IPs or ranges. All other IPs are allowed.

IP ranges can be specified as single IPs, CIDR notation (e.g., 10.0.0.0/8), or wildcard patterns (e.g., 192.168.1.*).

Notifications of Login Failures

Configure at Site administration > Security > Notifications:

• Display login failures to: Choose who sees failed login attempt notifications (admins, everyone, or nobody)
• Email login failures: Whether to send email alerts for failed logins
• Threshold for email notifications: Number of failed attempts before an email alert is sent

HTTP Security

At Site administration > Security > HTTP security:

• Use HTTPS for logins: Force HTTPS on the login page (deprecated — use site-wide HTTPS instead)
• Strict-Transport-Security: Send HSTS header to enforce HTTPS in browsers
• Content-Type: nosniff: Prevents MIME-type sniffing attacks
• X-Frame-Options: Prevents clickjacking (SAMEORIGIN by default)
• Content-Security-Policy: Advanced header to restrict resource loading sources

Site Policies

At Site administration > Security > Site policies:

• Site policy URL: URL to your terms of service or acceptable use policy. Users must accept before accessing the site.
• Site policy URL for guests: Separate policy for guest users
• Open to Google: Allow Google to index your site as a guest user
• Maximum uploaded file size: Global limit on file uploads
• User profile picture privacy: Control who can see user profile pictures

Web Services Security

If web services are enabled (for the Moodle mobile app or third-party integrations), review security settings at Site administration > Server > Web services:

• Enable only the protocols needed (REST is most common)
• Use token-based authentication
• Restrict web service users to specific capabilities
• Set IP restrictions for web service tokens where possible
• Review token usage regularly and revoke unused tokens

File Upload Security

• Limit allowed file types per activity where possible
• Enable ClamAV antivirus scanning for uploaded files
• Set appropriate maximum upload sizes at the site, course, and activity level
• Review the list of blocked file extensions

Regular Security Audits

Perform regular security reviews:

1. Run the Security overview report regularly
2. Review admin and manager accounts quarterly
3. Check for Moodle security announcements
4. Update Moodle and plugins promptly when security releases are published
5. Review server logs for suspicious activity
6. Test backup restoration procedures