Improving User Awareness in Securing their Moodle Accounts through Moodle User Tours

In the digital age, the security of all online platforms is paramount — and Moodle, a widely used LMS with a diverse base of students, educators and administrators, is no exception. Following our previous edition on the Moodle Tripartite Security Model, this article focuses on one effective strategy at the application level: improving user awareness through Moodle User Tours.

Why focus on user awareness?

• Preventing unauthorized access — educating users on strong passwords and the risks of sharing login information.
• Promoting best practices — reinforcing regular password changes, recognising phishing attempts, and securing personal devices.
• Building a security-conscious community — a more resilient ecosystem when everyone understands their part.

What are Moodle User Tours?

Moodle User Tours are interactive, step-by-step guides that appear as users navigate the platform, highlighting important features and best practices. They are an ideal way to educate users on account security, in context, without friction.

Setting up a security-awareness tour

As a Site Administrator, go to Site administration → Appearance → User Tours → Create a new tour, then configure:

• Name & description — e.g. “Security Awareness Notice”.
• Apply to URL match — use /my/% to show it on the Dashboard at every login (or FRONTPAGE for the site home).
• Show tour — choose “each time a filter matches it” so it appears on every login.
• Placement — above or below the target (these adapt best to mobile); optionally show a backdrop to highlight the area.
• Add steps — New Step → “Display in middle of page”, give it a title and your security-awareness content, then Save.

Repeat for as many steps as you need. Once saved, the notice greets users with your security guidance every time they log in.

The takeaway

Moodle User Tours offer a proactive approach to user awareness and account security. As technology advances, the importance of user education in cybersecurity cannot be overstated — and small measures like this go a long way in safeguarding the digital learning experience of our end users.