1. Purpose
The purpose of this policy is to ensure the stability, security, and supportability of hosted Moodle sites by defining clear requirements for the installation and maintenance of third-party (community) Moodle plugins.
2. Scope
This policy applies to:
- All hosted Moodle environments (production, staging, and testing)
- All plugins that do not ship with Moodle LMS or Moodle Workplace
3. Definitions
- Trusted Source: Certain plugin publication sources have a presumption of trust. These sources are:
- Moodle Marketplace
- Moodle Plugin Directory
- Moodle
- Moodle Certified Integration Partners
This list may change at any time, without notice.
- Major Version: The major version is defined by the first two numbers in the release version number. For example, 4.4 is a major release, and 4.5 is the following major release.
- Series: Moodle major versions that have the same number before the first period are part of a Series. For example, 4.0, 4.1, 4.2… are all a part of Series 4.
4. Policy Statement
4.1. Third-Party Plugin Requirements
To be installed on a Moodle hosted site, plugins must meet all of the following requirements:
- The plugin must meet one of the following criteria:
- It comes from a trusted source, or
- It passes code scanning checks performed by Moodle. This is a paid service.
- The plugin must be updated by its maintainer to support a Moodle version within the same Series as your site.
- Themes must be updated to support the same Major Version of Moodle
- All plugin dependencies must meet the above requirements
4.2. Workplace Features
Plugins that interface with Moodle Workplace APIs, including Tenants, Programs, and Certifications, will only be accepted from Moodle, Moodle Certified Integration Partners, and Moodle Partners.
4.3. Providing Plugin Code
For plugins being provided by a client, it is strongly preferred that the plugin code be posted to a git repository that we may connect to. The use of zip/tgz files is strongly discouraged.
5. Exceptions
Moodle will maintain a list of known plugins that fall under exceptions to this policy. This list contains plugins that are either approved for use, despite not meeting the criteria of this policy, or plugins that are rejected for use, despite otherwise meeting the criteria of this policy.
Moodle reserves the right to deny installation, or force removal, of any plugin based on security, stability, or performance considerations, even if they otherwise meet the requirements of this policy.
6. Major Moodle Upgrades
6.1 Pre-Upgrade Assessment
Before a scheduled major Moodle upgrade:
- All installed third-party plugins will be reviewed for declared compatibility with the target Moodle major version series.
- Compatibility is determined based on:
- The plugin’s declared “Supported Moodle versions” in the Moodle Plugins Directory
- Official documentation or release notes from the plugin maintainer
- Security
- Performance stability
- PHP compatibility
6.2 Incompatible Plugins
If a third-party plugin does not have a compatible version within the target major version or series, then one of the following actions will apply:
- The plugin will be removed or disabled prior to or during the upgrade, or
- The client may investigate Moodle provided plugin maintenance services with their Account Manager, or
- The Moodle upgrade may be postponed, subject to Moodle Services policy and support terms
7. Security and Stability Considerations
This policy exists to:
- Reduce the risk of site failures during and after upgrades
- Prevent security vulnerabilities caused by unsupported or outdated code
- Ensure compliance with Moodle’s supported version lifecycle
Moodle core does not guarantee compatibility of third-party plugins, and unsupported plugins may introduce critical errors or data integrity issues.
8. Responsibilities
- Site owners / customers are responsible for:
- Selecting plugins that are actively maintained
- Understanding that third-party plugins may limit upgrade options
- Hosting provider is responsible for:
- Enforcing this policy consistently
- Communicating plugin compatibility issues ahead of scheduled upgrades