How to Install Moodle

Step 1: Prepare the Server

Start with a fresh Ubuntu Server installation. Connect to your server via SSH and update all packages to their latest versions. Moodle 5.x requires PHP 8.1 or later, which is available in the default Ubuntu 22.04 and 24.04 repositories.

Configure the UFW firewall to allow SSH (port 22), HTTP (port 80), and HTTPS (port 443). Block all other inbound traffic. If you are using a cloud provider, also configure the provider's security group or network ACL to match these rules.

Set the server hostname to match the domain name you will use for Moodle. Configure the system timezone to match your institution's primary time zone, as this affects default time displays throughout the platform. Verify that the server has adequate disk space, with at least 20 GB free for the Moodle installation itself and additional space proportional to the amount of content your courses will include.

Step 2: Install Nginx and PHP

Install Nginx from the Ubuntu repositories. Then install PHP and the PHP-FPM (FastCGI Process Manager) package, which allows Nginx to process PHP files efficiently.

Moodle requires several PHP extensions. Install these packages: php-fpm, php-mysql (or php-pgsql for PostgreSQL), php-xml, php-mbstring, php-curl, php-zip, php-gd, php-intl, php-soap, php-xmlrpc, and php-opcache. Missing extensions will cause the installation wizard to report errors, so install them all upfront.

Edit the PHP configuration file (php.ini for both CLI and FPM) to set appropriate values. Key settings include: memory_limit should be at least 256M (512M recommended for larger sites), post_max_size and upload_max_filesize should be set to at least 100M to accommodate large file uploads, max_execution_time should be 300 seconds, and max_input_vars should be set to 5000 or higher to handle Moodle's complex forms.

Configure an Nginx server block for your Moodle domain. The configuration should point the document root to the directory where you will place the Moodle files, pass PHP requests to the PHP-FPM socket, deny access to hidden files and sensitive directories, and set appropriate cache headers for static assets. Enable the site and test the Nginx configuration for syntax errors before restarting the service.

Step 3: Install and Configure the Database

Moodle supports MySQL (8.0+), MariaDB (10.6.7+), and PostgreSQL (14+). MySQL is the most common choice, though PostgreSQL offers better performance for large deployments with complex queries.

For MySQL, install the mysql-server package. After installation, run the security script to set a root password, remove anonymous users, disable remote root login, and remove the test database. Then create a dedicated database for Moodle and a database user with full privileges on that database. Use the utf8mb4 character set and utf8mb4_unicode_ci collation when creating the database, as Moodle requires full Unicode support including emoji characters.

For PostgreSQL, install the postgresql package. Create a PostgreSQL user and database for Moodle. PostgreSQL handles Unicode natively, so no special character set configuration is needed.

In either case, use a strong, randomly generated password for the database user. Record this password securely, as you will need it during the Moodle installation wizard.

Step 4: Download and Place Moodle Files

Download the latest stable release of Moodle from the official website (download.moodle.org) as a compressed archive, or clone the stable branch from the official Git repository on GitHub (github.com/moodle/moodle). The Git approach is recommended for production deployments because it simplifies future upgrades to applying a pull and running the upgrade script.

Extract or clone the files to the Nginx document root directory that you configured in Step 2. Verify that the web server user (typically www-data on Ubuntu) has read access to all Moodle files. The web server should not have write access to the Moodle code directory itself, as that represents a security risk. Only the data directory (created in the next step) should be writable.

Step 5: Create the Moodle Data Directory

Moodle stores uploaded files, cached data, session files, and temporary files in a directory called moodledata. This directory must be outside the web server's document root to prevent direct access to uploaded files via URL. A common location is /var/moodledata or a sibling directory next to the web root.

Create the directory and set its ownership to the web server user (www-data). Set permissions to 750, allowing the web server user to read, write, and execute within the directory while blocking access from other users. Moodle will create subdirectories within moodledata automatically during installation and normal operation.

If your server has multiple disk volumes, consider placing moodledata on a volume with more storage capacity than the OS disk, as this directory grows with course content and can become quite large on active installations with many file uploads and multimedia content.

Step 6: Run the Installation Wizard

Open a web browser and navigate to your Moodle domain. The installation wizard will launch automatically because Moodle detects that it has not been configured yet.

The wizard walks through several screens. First, it asks you to confirm the web address, the Moodle directory, and the data directory paths. Next, it asks you to select the database driver (MySQL or PostgreSQL) and enter the database connection details: host (usually localhost), database name, database user, and password.

The environment check screen verifies that all required PHP extensions are installed and that PHP settings meet Moodle's minimum requirements. If any checks fail, fix the issues before proceeding. The wizard will not continue with unmet requirements.

After the environment check passes, Moodle creates its database tables and inserts default data. This process can run for several minutes on slower hardware. Do not interrupt it. When the database setup completes, the wizard prompts you to create the administrator account with a username, password, email address, and display name. Use a strong password and a real email address, as this account has unrestricted access to the entire platform.

Finally, configure the site name (displayed in the browser title bar and throughout the platform) and the front page summary. These can be changed later in the site administration settings.

Step 7: Configure Cron and Essential Settings

Moodle relies on a scheduled task system that runs via the system cron. Without it, email notifications are not sent, cached data is not cleaned, assignment reminders do not fire, and many other background processes fail silently. Set up a cron job that runs every minute, executing the Moodle CLI cron script as the web server user.

Email configuration: Navigate to Site Administration and configure the outgoing mail settings. Enter your SMTP server address, port, authentication credentials, and the "from" address that Moodle will use for notifications. Test the configuration by sending a test email. Without working email, students will not receive enrollment confirmations, assignment notifications, or password reset links.

HTTPS and SSL: Install Certbot and obtain a Let's Encrypt SSL certificate for your domain. Configure Nginx to serve Moodle over HTTPS and redirect all HTTP requests to HTTPS. In Moodle's config.php file, ensure the wwwroot setting uses the https protocol. Enable Secure and HttpOnly flags for session cookies in the Moodle security settings.

Performance settings: Enable OPcache in PHP if it is not already active, as it dramatically reduces PHP execution time by caching compiled bytecode. In Moodle's caching configuration, set up Redis or Memcached as the application and session cache store if available, which provides significant performance improvement over the default file-based caching.

Security review: Navigate to Site Administration, then Reports, then Security Overview. This page checks common security issues including register_globals, writable config files, exposed cron, and other potential vulnerabilities. Address any warnings before making the site available to users.