# Cubite > We build, migrate, and customize LMS platforms. Open edX, Moodle, or our AI-powered headless LMS. 13+ years. Trusted by Starbucks & top universities. # Upgrade to Moodle 5.3 LTS from 4.5, 5.0, 5.1 or 5.2 https://cubite.io/blogs/upgrade-moodle-5-3-lts **By:** Amir Tadrisi **Updated:** 2026-10-07 Moodle 5.3 LTS shipped on October 5, 2026. What changes when you upgrade from 4.5, 5.0, 5.1 or 5.2: PHP 8.3, the /public web root, database minimums and plugins. Moodle 5.3 LTS was released on October 5, 2026, and Moodle 5.0 is now listed as no longer supported: it will not receive fixes for security risks. Cubite runs managed Moodle from $690 a month for up to 500 concurrent learners, with version upgrades and same-day CVE patching included. Cubite sells managed Moodle and publishes this guide; every Moodle fact below is from moodledev.io, checked on October 6, 2026. Short answer (updated October 6, 2026): you can upgrade to Moodle 5.3 LTS directly from 4.4, 4.5, 5.0, 5.1 or 5.2. Before you do, make sure the server runs 64-bit PHP 8.3.0 or later with the sodium extension, that your database meets the new minimums (PostgreSQL 17, MySQL 8.4, MariaDB 11.4.0), and, if you are coming from 4.5 or 5.0, that your web server serves Moodle's new /public directory and your plugins have been moved into it. ## Moodle 5.3 LTS at a glance | Item | Moodle 5.3 LTS | | --- | --- | | Release date | October 5, 2026 | | Upgrade from | Moodle 4.4 or later | | PHP | 8.3.0 minimum, 8.4.x supported, 64-bit only | | PHP settings | sodium extension required; max_input_vars of 5000 or more | | PostgreSQL | 17 minimum (raised in 5.3) | | MySQL | 8.4 minimum (last raised in 5.0) | | MariaDB | 11.4.0 minimum (raised in 5.3) | | Microsoft SQL Server | 2019 minimum (last raised in 5.2) | | Oracle Database | no longer supported | | General support ends | October 4, 2027 | | Security support ends | October 1, 2029 | ## Which Moodle versions are still supported | Version | Status on October 6, 2026 | Security fixes until | | --- | --- | --- | | 4.5 LTS | Security fixes only | October 4, 2027 | | 5.0 | No longer supported | Ended | | 5.1 | Security fixes only | April 19, 2027 | | 5.2 | Current stable | October 4, 2027 | | 5.3 LTS | Current stable | October 1, 2029 | If you run 5.0, upgrade first: it no longer gets security fixes. If you run 4.5 LTS, you have until October 4, 2027, which is time to test plugins on a staging copy rather than upgrade in a hurry. For the security releases that land between majors, see [Moodle Security in 2026: The CVEs to Patch](https://cubite.io/blogs/moodle-security-2026-cves). ## Upgrade it yourself, or have it managed | Your situation | Upgrade it yourself | Have it managed | | --- | --- | --- | | A sysadmin who has run a Moodle major upgrade before, and a staging server | Good fit | Optional | | Coming from 4.5 or 5.0 (the /public move applies) with many third-party plugins | Possible: budget time to move and test every plugin | Good fit | | Still on 5.0, with no one in-house to run the upgrade | Risky: the site gets no security fixes until it moves | Good fit | | Older than 4.4 | Two upgrades in a row | Good fit | Cubite is one of the managed options and publishes this table. Managed Moodle at Cubite starts at $690 a month for up to 500 concurrent learners and includes version upgrades; see [managed Moodle hosting and support](https://cubite.io/services/moodle-hosting-and-support). ## The upgrade path from each version ### From Moodle 4.5 LTS Moodle 5.3 accepts upgrades from 4.4 or later, so a 4.5 site can go straight to 5.3. Three changes land at once: the /public web root (introduced in 5.1, see the next section), the PHP 8.3.0 minimum, and the higher database minimums. Check all three on a staging copy first. ### From Moodle 5.0 Upgrade soon: 5.0 no longer receives security fixes. The path is the same as from 4.5: the /public web root, PHP 8.3.0 and the database minimums all apply. ### From Moodle 5.1 or 5.2 Your web server already serves /public, so this is the lightest path. Check PHP (8.3.0 or later), the database minimums that 5.3 raised (PostgreSQL 17, MariaDB 11.4.0), and that each third-party plugin has a release that supports 5.3. ### From Moodle 4.3 or older Moodle 5.3 does not upgrade a site older than 4.4 directly. Upgrade to an intermediate release first (check that release's own notes for the versions it accepts), then to 5.3. ## The /public web root (coming from 4.5 or 5.0) Moodle 5.1 introduced a new /public directory. Moodle's 5.1 release notes say: "Your web server now needs to be configured so that its document root points to this /public directory, rather than the main Moodle folder." Sites that skip this step can show directory listings or error messages after the upgrade. - Point the web server's document root at the /public directory inside your Moodle code, not at the Moodle folder itself. - Move your plugins. The 5.1 notes say plugins installed before the upgrade "will still be in their original locations above the /public folder" and "will need to be manually moved into the appropriate location within the /public directory". - Keep config.php and the command-line scripts where they are: in the 5.3 code, config-dist.php and admin/cli/upgrade.php sit at the top of the Moodle folder, outside /public. - Moodle 5.1 also added a routing engine. Moodle recommends it but says it is not compulsory, and a compatibility layer keeps older URLs working. ## Pre-upgrade checklist - Back up the database and the moodledata folder, and test a restore - Build a staging copy and run the whole upgrade there first - Confirm 64-bit PHP 8.3.0 or later, the sodium extension and max_input_vars of 5000 or more - Confirm the database version meets the 5.3 minimum - Check every third-party plugin and the theme for a 5.3-compatible release - Plan the /public web root and the plugin moves if you are coming from 4.5 or 5.0 - Announce a maintenance window to your learners ## Step by step 1. Turn on maintenance mode (admin/cli/maintenance.php --enable) and stop cron. 2. Take the backups from the checklist. 3. Replace the Moodle code with 5.3, for example by checking out the MOODLE_503_STABLE branch, and keep your existing config.php. 4. If you are coming from 4.5 or 5.0, point the document root at /public and move the plugins into it. 5. Run the upgrade from the command line: php admin/cli/upgrade.php. 6. Turn maintenance mode off, start cron again, and test logins, enrollments, grading and your plugins. ## Rollback A major upgrade changes the database, so the way back is the backup you took in step 2: restore the database and moodledata, put back the previous code and web server configuration, then turn maintenance mode off. Test that restore before the upgrade, not during it. ## Moodle 5.3 and AI providers Moodle 5.3 adds an Anthropic Claude AI provider plugin (MDL-88674) and AI user reporting (MDL-80893). Moodle's AI subsystem, part of core since 4.5, stays off until a site administrator enables a provider and enters that provider's API key. ## Upgrade done for you: managed Moodle from $690 a month Cubite plans the 5.3 upgrade on a staging copy, moves your plugins to /public, and keeps you patched afterwards. [Book a 30-minute call](https://cubite.io/go/book?src=moodle-5-3) ## FAQ ### Can I upgrade from Moodle 4.5 to 5.3 directly? Yes. Moodle 5.3 accepts upgrades from Moodle 4.4 or later. Coming from 4.5 you also have to serve the new /public web root and move your plugins into it, because that change arrived in 5.1. ### What PHP version does Moodle 5.3 need? PHP 8.3.0 or later, 64-bit only. PHP 8.4.x is supported too, the sodium extension is required, and max_input_vars must be 5000 or more. ### Is Moodle 5.0 still supported? No. moodledev.io lists Moodle 5.0 as no longer supported: it will not receive fixes for security risks. Moodle 5.3 LTS gets security fixes until October 1, 2029. ### How long is Moodle 5.3 LTS supported? General support ends on October 4, 2027 and security support on October 1, 2029. ### Do I have to move my plugins? Only if you are coming from a version before 5.1 (4.5 or 5.0). Plugins installed before the upgrade stay above the /public folder and have to be moved into the right place inside it. ### What does a managed Moodle upgrade cost at Cubite? Cubite runs managed Moodle from $690 a month for up to 500 concurrent learners, with version upgrades and same-day CVE patching included, so the 5.3 upgrade is part of the plan rather than a separate project. See [managed Moodle hosting and support](https://cubite.io/services/moodle-hosting-and-support) or [compare Moodle hosting costs](https://cubite.io/blogs/moodle-hosting). --- # LMS Market Share in 2026: Who's Winning, Who's Dying, and Why https://cubite.io/blogs/lms-market-share-2026 **By:** Amir Tadrisi **Updated:** 2026-10-01 LMS market share in 2026: Canvas owns 50% of higher-ed enrollment and Blackboard went bankrupt. The full vendor breakdown. # LMS Market Share in 2026: Who's Winning, Who's Dying, and Why About this research: This analysis is published by Cubite, which sells [Cubite LMS](https://cubite.io/pricing) ($290 a month or $2,900 a year, unlimited learners) and runs managed Moodle from $690 and managed Open edX from $1,260 a month. Key numbers (updated October 1, 2026): - Higher-ed share by enrollment (US and Canada): Canvas 50%, D2L Brightspace 20%, Blackboard 12% and Moodle 9% ([OnEdTech, year-end 2024 edition](https://onedtech.philhillaa.com/p/state-of-higher-ed-lms-market-for-us-and-canada-year-end-2024-edition), February 2025). - The Canvas breach: Instructure detected unauthorized activity in Canvas on April 29, 2026, the same attacker got in again on May 7, and on May 11 Instructure said it had reached an agreement with the attacker, that the data was returned, and that it had received digital confirmation (shred logs) of its destruction ([Instructure incident update](https://www.instructure.com/incident_update)). - Blackboard: Anthology emerged from Chapter 11 rebranded as Blackboard, a standalone, debt-free company with about $70 million in new financing ([Blackboard announcement](https://www.blackboard.com/news/blackboard-formerly-anthology-emerges-debt-free-and-focused), March 2, 2026). - Open edX: 2,283+ live sites and more than 207 million course enrollments ([2024 Open edX Impact Report](https://openedx.org/blog/the-2024-open-edx-impact-report-is-here/)); the current release is Verawood, out July 30, 2026, and only the latest release is supported ([docs.openedx.org](https://docs.openedx.org/en/latest/community/release_notes/named_release_branches_and_tags.html)). - What users say: In Cubite's analyses of verified user reviews, reviewers rate Open edX 84.14/100 on average (42 reviews), Moodle 76.9/100 (105 reviews) and Canvas 58.94/100 (53 reviews); see the [Open edX](https://cubite.io/blogs/open-edx-review), [Moodle](https://cubite.io/blogs/moodle-lms-review) and [Canvas](https://cubite.io/blogs/canvas-lms-review) reviews. Choosing an LMS? The free LMS Buyer's Toolkit further down this page asks ten questions and tells you which of seven platforms fits and what it costs in year one, with no email gate to see your result. Or [book a 30-minute call](https://cubite.io/go/book?src=lms-market-share). ## LMS Market Share 2026 _bar chart_ | Category | Share of US and Canadian higher-ed enrollment (%) | | --- | --- | | Canvas | 50 | | D2L Brightspace | 20 | | Blackboard | 12 | | Moodle | 9 | Canvas now controls more of the higher-education LMS market than its next three competitors combined. Blackboard's parent company filed for bankruptcy. The corporate training segment is growing at nearly 23% year over year. The LMS market share landscape in 2026 looks nothing like it did five years ago — and most of the analysis you'll find online is either locked behind a paywalls or reduced to context-free statistics. This is the analysis we wished existed: a data-backed look at the best LMS platforms in 2026 — vendor-level market share across higher education, corporate, and K-12, broken down by region, backed by sources, and explained with the why behind every number. Whether you're evaluating platforms, building a business case, or deciding between off-the-shelf and custom, this is your starting point. ## The Canvas Breach of May 2026 and What It Means for Every LMS Buyer This section was written in May 2026, during the incident. Checked on October 1, 2026: the timeline below now includes Instructure's May 11 statement; later developments are not covered here. On May 7, 2026, at roughly 1:20 PM PDT, screenshots of Canvas's defaced login page began circulating on Reddit. By 8 PM Eastern, the entire platform was offline. The hacking group ShinyHunters had breached Instructure for the second time in a week, claiming **3.65 terabytes of data covering ~275 million records** across [8,809 institutions worldwide](https://en.wikipedia.org/wiki/2026_Canvas_security_incident). It happened during finals week. It is, as of this writing, the **largest educational security breach on record**. And it has done something no market-share chart could: it has made LMS concentration risk a procurement variable, not just an IT one. | Date | Event | | --- | --- | | Apr 25–30, 2026 | Initial breach via Canvas's Free-For-Teacher (FFT) account program | | May 1 | Instructure announces cybersecurity incident on status page | | May 2 | Data theft confirmed; "issue contained" | | May 3 | ShinyHunters posts ransom note | | May 6 | Instructure announces Canvas "back to normal operation" | | May 7, 1:20 PM PDT | Second attack — ransomware message replaces login page | | May 7, 8 PM ET | Full Canvas outage | | May 8 | Operations resume | | May 11 | Instructure says it reached an agreement with the attacker: the data was returned, with digital confirmation of its destruction | | May 12 | Ransom deadline: pay or full dataset leaks | ### What was exposed and what wasn't Instructure [confirmed unauthorized access](https://www.cybersecuritydive.com/news/instructure-confirms-cybersecurity-incident/819637/) to names, email addresses, student ID numbers, and messages between Canvas users. The company explicitly stated that **passwords, dates of birth, government identifiers, and financial information were not compromised**. ### Who got hit Among confirmed affected institutions ([Wikipedia](https://en.wikipedia.org/wiki/2026_Canvas_security_incident)): - United States: University of California system, Arizona State, Sacramento State, University of Pennsylvania, Duke University, Wake County Public Schools - Australia: University of Melbourne, UTS, RMIT, Griffith, Adelaide, University of Canberra - Canada: University of British Columbia, University of Toronto, OCAD - New Zealand: University of Auckland, AUT, Victoria University of Wellington - Europe: Swedish University of Agricultural Sciences, 44 Dutch institutions - Asia: National University of Singapore, 5 Hong Kong institutions ### The migration has already started Within days of the second-wave attack, the **University of British Columbia began moving staff and courses to Moodle** as a teaching tool, with SharePoint for Canvas materials. Multiple Australian universities and Dutch institutions temporarily disconnected Canvas as a preventative measure. None of these are small moves, they are signals. ### Why this matters beyond Canvas This isn't a Canvas-only problem. It's a single-vendor supply-chain problem. > "Instead of targeting individual campuses, attackers are moving up the data supply chain to the platforms that sit underneath thousands of institutions at once." — Doug Thompson, Tanium (Inside Higher Ed) > "With access to real names, email addresses and even teacher-student messages, the next wave of phishing will not be generic." — Doug Thompson, Tanium > "Educational platforms are particularly rich targets given the concentration of personal, financial and international student data." — Anton Dahbura, Director, Johns Hopkins Information Security Institute (Inside Higher Ed) The ShinyHunters ransom message included a chilling self-description: "SHINYHUNTERS rooting your systems since '19." If accurate, the exposure window stretches back seven years, predating most of the market-share figures in this article. The strategic implication for any institution evaluating its LMS today: vendor risk is now an evaluation axis. A 5-year contract with a platform that touches 41% of US higher ed is structurally different from a deployment you control — whether that's on-premise Moodle, a managed Open edX instance, or a custom-built LMS with your own infrastructure perimeter. ## The LMS Market in 2026: $34 Billion and Accelerating The global learning management system market is valued between $31.6B and $37.1B in 2026, depending on which research firm you ask. [Fortune Business Insights](https://www.fortunebusinessinsights.com/industry-reports/learning-management-system-market-101376) and [Grand View Research](https://www.grandviewresearch.com/industry-analysis/learning-management-systems-market) agree on the trajectory: 16%–20% compound annual growth, reaching over $100B by 2032. The numbers that matter most: | Metric | Value | Source (Year) | | --- | --- | --- | | Global LMS market (2026) | $31.6B–$37.1B | Fortune BI, Business Research Company (2026) | | Projected market (2032) | $100.7B+ | GlobeNewsWire | | Corporate LMS CAGR | 22.9% | Precedence Research | | North America share | 36%–43% | Fortune BI, Grand View Research (2025) | | Cloud deployment | 88%+ | Multiple firms (2025–2026) | | Organizations using an LMS | 83% | Sci-Tech-Today | | Major enterprises using an LMS | 98% | Sci-Tech-Today | Three forces are driving this growth. First, corporate upskilling mandates — the corporate LMS segment alone is projected to reach [$50.1B by 2030](https://www.precedenceresearch.com/corporate-learning-management-system-market). Second, cloud migration — 88% of LMS deployments are now cloud-based, up from roughly 60% five years ago. Third, AI integration is becoming a baseline expectation, not a differentiator. North America still accounts for the largest slice (36%–43%), but Asia-Pacific is the fastest-growing region at $5.8B and climbing, fueled by digital transformation initiatives across India, China, and Southeast Asia. ## Who Owns the LMS Market? Platform-by-Platform Breakdown Ask "which LMS has the most market share?" and you'll get a different answer depending on who's counting and what they're measuring. That's the first thing to understand about LMS market share data: methodology changes everything. [6sense](https://6sense.com/tech/learning-management-systems) counts organizations across all sectors and puts Google Classroom and Moodle at the top. [Edutechnica](https://edutechnica.com/2025/05/26/lms-data-spring-2025-updates/) tracks North American higher-education institutions and has Canvas far ahead. Revenue-based rankings put Cornerstone OnDemand at #1. Each is correct — and each tells a completely different story. Search for Canvas vs Moodle market share and you'll find Canvas dominating North American higher ed while Moodle leads globally — because the data source defines the answer. Here's the full picture: | Platform | Higher Ed (NA) | Corporate | K-12 | Global Users | Revenue | Trend | | --- | --- | --- | --- | --- | --- | --- | | Canvas | 50% by enrollment | Expanding | ~19% | — | ~$590M | Growing | | Moodle | 9% by enrollment | Limited | — | 500M+ registered | — | Declining (NA) | | Blackboard | 12% by enrollment | Legacy | ~8% | — | ~$450M | Declining | | D2L Brightspace | 20% by enrollment | Growing | ~5% | — | ~$217M | Growing | | Google Classroom* | Supplemental | — | Dominant | 150M+ | — | Growing | | Cornerstone | — | Leader | — | 140M+ | ~$830M | Stable | | Docebo | Niche | Growing fast | — | — | ~$243M | Growing | | TalentLMS | — | SMB leader | — | — | — | Growing | | Open edX | Niche (not tracked) | Enterprise (IBM, McKinsey) | — | 100M+ registered | — | Growing (18% YoY sites) | Now let's break each sector down. ### Higher Education: Canvas's Dominance and Blackboard's Collapse By **institution count**, Canvas holds ~39% of US higher-ed ([Edutechnica, Fall 2024](https://edutechnica.com/)). By **enrollment weight** — the methodology Phil Hill and OnEdTech use, which counts how many *students* sit inside each platform — Canvas's share climbs closer to 50%. Both are correct. The first measures market footprint; the second measures lived experience. Either way, Canvas's lead is real. But the picture underneath the share number is more complicated than the chart suggests — and after May 2026, the trajectory may be inverting. | Platform | By Institution | By Enrollment | Direction | | --- | --- | --- | --- | | Canvas (Instructure) | 39% | 50% | Gaining | | Blackboard (Anthology) | 19% | 12% | Losing | | D2L Brightspace | 16% | 20% | Gaining | | Moodle | 16% | 9% | Losing | | Sakai | <2% | <1% | Effectively dead | Source: [Edutechnica Spring 2025](https://edutechnica.com/2025/05/26/lms-data-spring-2025-updates/), [OnEdTech Year-End 2024](https://onedtech.philhillaa.com/p/state-of-higher-ed-lms-market-for-us-and-canada-year-end-2024-edition) Notice the gap between Blackboard's 19% institution count and its 12% enrollment share. That gap is the story: Blackboard is clinging to smaller institutions while larger universities have already migrated away. Canvas's 50% enrollment share means it now serves more students than its next three competitors combined. How did this happen? On September 29, 2025, [Anthology — Blackboard's parent company — filed for Chapter 11 bankruptcy](https://edcircuit.com/anthology-files-for-chapter-11-bankruptcy-plans-debt-free-future-for-blackboard-brand/). The company had accumulated $1B–$10B in liabilities. EBITDA collapsed from $33M in FY2023 to just $4M in FY2025. Revenue had dropped an estimated $80M over two years. The root cause wasn't just technology debt. It was a failed M&A strategy. The 2021 Anthology-Blackboard merger was supposed to create synergy between the LMS and student information systems. As [Inside Higher Ed reported](https://www.insidehighered.com/news/tech-innovation/administrative-tech/2025/10/08/why-ed-tech-behemoth-unraveled), the assumption was fatally flawed: "Academics pick the LMS and they're not going to pick an LMS because the registrar picked a different SIS." Meanwhile, institutions are actively migrating. The [University of Miami](https://themiamihurricane.com/2025/09/09/um-switching-from-blackboard-to-canvas-by-fall-2026/), Ohio University, North Greenville University, and several CUNY schools all announced transitions away from Blackboard in 2025–2026. The [UNC Board of Governors standardized all UNC institutions on Canvas](https://edscoop.com/how-canvas-came-to-unseat-blackboard-as-the-leading-lms/) — a system-wide mandate covering 17 campuses. But Blackboard isn't dead yet. The company [emerged from Chapter 11 on February 27, 2026](https://www.blackboard.com/news/blackboard-formerly-anthology-emerges-debt-free-and-focused), rebranded as standalone "Blackboard," secured $70M in new capital, and shed its non-LMS businesses. The University of Mississippi chose to upgrade to Blackboard Ultra rather than switch. Whether this is a genuine comeback or a managed decline remains the biggest open question in the LMS market. D2L Brightspace is the quiet winner. At 20% by enrollment and growing, Brightspace consistently picks up institutions leaving Blackboard and Moodle. It was [named to G2's 2026 Best Software Awards](https://www.morningstar.com/news/pr-newswire/20260219to91083/g2-recognizes-d2l-brightspace-as-one-of-the-best-education-software-products-for-2026) for Best Education Software, and Queens College (CUNY) is among the institutions transitioning to it. ### Quick Note about Canvas What real Canvas users say. Our review of 53 verified Canvas users ([Cubite Canvas LMS Review](https://cubite.io/blogs/canvas-lms-review)) found an average score of 58.94/100 and a bimodal distribution that explains the headline number. 32% scored Canvas 0–39 (very dissatisfied) while another 32% scored 80–100. The average user is happy enough; a third are actively struggling. A sampling of verbatim user complaints captures the texture: > "The terrible user interface and strange lack of usability. Days ago, after much effort, I fully published my course, only to be told today it's not published." > "It's extremely buggy. I wasn't even able to upload files or feedback to students." > "I was waiting on the phone at NIGHT for well over 2 hours and never got assistance!!!" These are not edge cases. Support, reliability, and grading-system rigidity show up in every Canvas review cluster we analyzed — and they predate the May 2026 breach. > **WARNING:** The post-breach signal. Several institutions began re-evaluating Canvas within days of the second-wave attack. The University of British Columbia's move to Moodle is the most visible example; quieter procurement reviews are underway at multiple state university systems. The next 12 months will likely produce the first measurable share dip Canvas has seen since 2018. ### Corporate Training: The $50 Billion Opportunity **If higher education is where the drama is, corporate training is where the money is going.** The corporate LMS segment is growing at [22.9% CAGR](https://natlawreview.com/press-releases/corporate-learning-management-system-lms-market-set-grow-229-cagr-through) — nearly double the overall LMS market rate — and is projected to hit $50.1B by 2030. This isn't surprising: 98% of major enterprises already use an LMS, and 45% of companies plan to increase their learning technology investment in 2026, according to [Programs.com](https://programs.com/resources/lms-statistics/). The vendor landscape here is completely different from higher ed: | Platform | Revenue/ARR | Focus | Key Strength | | --- | --- | --- | --- | | Cornerstone OnDemand | ~$830M TTM | Enterprise | Full talent management suite; Microsoft + Salesforce partnerships | | Docebo | $243M (FY2025) | Mid-market to enterprise | AI-first: AI Creator, Virtual Coaching, "Harmony" agentic marketplace | | D2L Brightspace | $217M guidance | Higher ed + corporate | Expanding into corporate; accessibility leader | | TalentLMS | — | SMB | 17,000+ customers; simple setup, affordable pricing | | SAP Litmos | — | Mid-market | Compliance training; 30M+ users across 150 countries | | Absorb LMS | — | Mid-market to enterprise | Content library + LMS in one | Sources: [CompaniesMarketCap](https://companiesmarketcap.com/cornerstone-ondemand/revenue/) (Mar 2026), [Docebo FY2025 earnings](https://www.docebo.inc/news/news-details/2026/Docebo-Reports-Fourth-Quarter-and-Fiscal-Year-2025-Results/default.aspx) (Feb 2026), [D2L FY2026 guidance](https://www.newswire.ca/news-releases/d2l-inc-announces-fourth-quarter-and-fiscal-2026-financial-results-834480911.html) [Docebo](https://www.docebo.inc/news/news-details/2026/Docebo-Reports-Fourth-Quarter-and-Fiscal-Year-2025-Results/default.aspx) deserves particular attention. Revenue grew 11.87% to $243M in FY2025, and Q4 2025 was its strongest bookings quarter since 2021. The company is going all-in on AI with tools like AI Creator (content generation), AI Video Presenter, AI Virtual Coaching, and a "Harmony" agentic marketplace. It reported 21.2% EBITDA margins — this is a profitable, growing business. The three drivers accelerating corporate LMS spend: skills mapping (connecting training to business outcomes), compliance automation (reducing regulatory risk), and AI content generation (creating training materials at scale). ### K-12: Google Classroom's Free Model vs. Premium Platforms Google Classroom has 150M+ registered users and dominates K-12 through a strategy that's hard to compete against: it's free and bundled with the tools schools already use. According to [Google's 2025 Education Year in Review](https://blog.google/outreach-initiatives/education/google-for-education-year-in-review-2025/), 170M+ students and educators use Google Workspace for Education, with 14.5M students now accessing Gemini AI through the platform. In the US alone, [over 60,000 schools](https://research.com/education/how-google-conquered-the-classroom) use Google Classroom. Among premium LMS platforms in K-12 ([ListEdTech, 2024](https://listedtech.com/blog/the-state-of-the-lms-market-in-2024-trends-in-k-12/)): | Platform | K-12 Market Share | | --- | --- | | Canvas | ~19% | | Schoology (PowerSchool) | ~11% | | Blackboard | ~8% | | D2L Brightspace | ~5% | Schoology's parent company PowerSchool was [acquired by Bain Capital for $5.6B](https://pitchbook.com/profiles/company/55132-21) in June 2024 — another sign that private equity sees the learning technology market as a high-growth bet. Google Classroom's limitation is that it's not a full-featured LMS. It lacks advanced grading rubrics, compliance tracking, detailed analytics, and the kind of structured course management that higher ed and corporate training require. For K-12, that often doesn't matter. For anything beyond, it does. ### Quiz: LMS Market Literacy Check Placement: After Platform Breakdown | Tests: platform-sector mapping, methodology awareness, market data ## The Winners: Why These Platforms Are Growing Market share data shows what is happening. Here's why. Canvas isn't winning on any single feature. It's winning because it was cloud-native from day one while competitors were retrofitting legacy on-premise architectures. Add 200+ product updates across 37 releases in 2025, the [launch of IgniteAI](https://www.prnewswire.com/news-releases/instructure-delivers-on-safe-simple-ai-promise-with-igniteai-and-major-ecosystem-updates-302638807.html) in November 2025, and the financial backing of KKR (which [took Instructure private in January 2025](https://stockanalysis.com/stocks/inst/revenue/)), and you have a platform with both the technology and capital to keep accelerating. But the biggest factor may be the simplest: **88% of organizations cite poor UX as the main reason for switching learning tools**, according to a [2026 Research.com survey](https://research.com/education/lms-statistics). Canvas consistently wins on usability. D2L Brightspace is in the right place at the right time. Every institution leaving Blackboard or Moodle is a potential Brightspace customer. D2L's subscription revenue is growing at [10%–11% year-over-year](https://www.newswire.ca/news-releases/d2l-inc-announces-fourth-quarter-and-fiscal-2026-financial-results-834480911.html), and its focus on accessibility and inclusive design gives it an edge in procurement decisions where compliance matters. Docebo is the AI-first bet in corporate training. While other vendors bolt AI onto existing products, Docebo built AI Creator, AI Video Presenter, and an agentic marketplace called "Harmony" as [core product features](https://www.docebo.inc/news/news-details/2026/Docebo-Reports-Fourth-Quarter-and-Fiscal-Year-2025-Results/default.aspx). The result: $243M in revenue, 11.87% growth, and the strongest bookings quarter since 2021 in Q4 2025. Google Classroom leverages the most powerful distribution channel in education technology: an ecosystem of 170M+ Workspace users and millions of Chromebooks. The addition of [Gemini AI](https://blog.google/outreach-initiatives/education/google-for-education-year-in-review-2025/) — already used by 14.5M students — keeps it ahead in K-12. [Open edX](https://blog.cubite.io/open-edx-installation-guide) is seeing renewed interest for a different reason: fear of vendor lock-in. After Anthology's bankruptcy left institutions scrambling, the value proposition of an open-source platform — no licensing fees, full data ownership, no risk of your vendor disappearing — [resonates more strongly than ever](https://openedx.org/blog/unlocking-the-value-and-roi-of-open-source-at-open-edx-2026/). Open edX is also carving out a niche in microcredentials and professional certificates, where its modular architecture is a natural fit. ## The Losers: Why These Platforms Are Declining "Declining" doesn't always mean "dying." Context matters. ### Blackboard: From Market Leader to Chapter 11 Blackboard's story is the most dramatic cautionary tale in EdTech. A decade ago, it was the undisputed market leader. Today it's emerging from bankruptcy with 12% enrollment share and shrinking. The timeline: - 2021: Anthology and Blackboard merge to create an "all-in-one" EdTech suite - 2023: Canvas overtakes Blackboard in enrollment share - FY2023: EBITDA at $33M — already thin - FY2025: EBITDA collapses to $4M; revenue drops ~$80M over two years - September 29, 2025: [Anthology files Chapter 11](https://edcircuit.com/anthology-files-for-chapter-11-bankruptcy-plans-debt-free-future-for-blackboard-brand/) with $1B–$10B in liabilities - February 27, 2026: [Emerges as standalone "Blackboard"](https://www.blackboard.com/news/blackboard-formerly-anthology-emerges-debt-free-and-focused), debt-free, $70M new capital The root cause wasn't a single failure. It was the compounding effect of legacy architecture (built pre-cloud, retrofitted to SaaS through "Ultra"), a failed M&A thesis (synergy between LMS and student information systems that [never materialized](https://www.insidehighered.com/news/tech-innovation/administrative-tech/2025/10/08/why-ed-tech-behemoth-unraveled)), and an active customer exodus to Canvas and Brightspace. The nuance: Blackboard still serves 19% of institutions. It emerged debt-free. Some institutions — like the University of Mississippi — are upgrading to Ultra rather than leaving. The question isn't whether Blackboard survives; it's whether its new leadership can reverse a decade-long trajectory while competing against Canvas's growing monopoly. ### Moodle: The Open-Source Paradox Moodle presents a puzzle: the company is growing, but its market share is shrinking. According to [Phil Hill's analysis at OnEdTech](https://onedtech.philhillaa.com/p/observations-on-higher-ed-lms-market), Moodle has lost 3% share in Europe/UK, 5% in Latin America, 7% in Oceania, and 4% in Asia over the past eight years. In North America, it holds just 9% of enrollment — less than half of D2L Brightspace's 20%. The pattern is consistent: institutions are moving FROM Moodle (and Blackboard) TO Canvas and Brightspace. The self-hosted model that once gave IT departments full control now creates operational burden. Universities increasingly prefer managed SaaS. For Moodle specifically, that tradeoff comes down to a choice between [self-hosting, managed Moodle hosting and MoodleCloud](https://cubite.io/blogs/moodle-hosting). But here's the counter-argument. Moodle was [named to the 2026 GSV 150](https://moodle.com/news/moodle-joins-2026-gsv-150/) — a list of the top 150 transformational digital learning companies. MoodleCloud and Moodle Workplace are revenue-generating products growing within the Moodle ecosystem. With 500M+ registered users globally and 73% market share in Latin American higher education ([Programs.com, 2026](https://programs.com/resources/lms-statistics/)), Moodle isn't dying. It's losing ground in wealthy markets that prefer premium SaaS while remaining dominant where cost and customization are priorities. ### Sakai Effectively abandoned. Fewer than 2% of institutions, less than 1% of enrollment. Not worth evaluating for any new deployment. ## 7 Trends Reshaping the LMS Market in 2026 ### 1. AI Is Table Stakes, Not a Differentiator Every LMS vendor now markets AI features. Canvas has IgniteAI. Docebo has AI Creator and Virtual Coaching. Google Classroom has Gemini. D2L has integrated AI assistants. But here's what the [Talented Learning analyst report for 2026](https://talentedlearning.com/16-enterprise-lms-trends-shaping-2026-an-analysts-view/) found: buyers are **AI-curious but AI-cautious.** Nobody is choosing an LMS primarily because of its AI capabilities. AI is becoming a checkbox, not a decision-driver. The actual switching triggers remain UX, price, and integration capabilities. ### 2. LMS + LXP = Hybrid Platforms An LMS (Learning Management System) manages structured courses, compliance tracking, and certifications — it's admin-driven. An LXP (Learning Experience Platform) uses AI to recommend personalized content, social learning, and microlearning — it's learner-driven. In 2026, the distinction is blurring. The LXP market grew from $508.5M in 2020 to [$3.74B in 2025](https://www.valamis.com/blog/lxp-vs-lms), at 25.3% CAGR. Modern platforms like Docebo, Absorb, and CYPHER Learning now combine both approaches: structured compliance paths with personalized discovery feeds. If you're evaluating platforms, don't ask "LMS or LXP?" Ask "does this platform handle both structured and self-directed learning?" ### 3. UX Is the #1 Switching Driver This is the single most important trend in the LMS market and it's not close. 88% of organizations cite poor user experience as the main reason for switching learning tools. 71% of employees prefer mobile access. Mobile-enabled programs show 43% higher completion rates. ([Research.com, 2026](https://research.com/education/lms-statistics)) This explains Canvas's dominance, Blackboard's decline, and Moodle's erosion in one data point. ### 4. M&A Consolidation and Its Fallout The Anthology bankruptcy is the cautionary tale. But it's not the only M&A shaking the market: - KKR acquired Instructure (Canvas) in January 2025, taking it private with deep capital reserves - Bain Capital acquired PowerSchool (Schoology) for $5.6B in June 2024 - Ellucian acquired Anthology's Enterprise Operations; Encoura got Lifecycle Engagement The lesson, per [Inside Higher Ed's post-mortem](https://www.insidehighered.com/news/tech-innovation/administrative-tech/2025/10/08/why-ed-tech-behemoth-unraveled): the market rewards focus over sprawl. Canvas succeeded by being an excellent LMS. Anthology failed by trying to be everything. The same consolidation pattern reached the WordPress LMS world in April 2026, when Liquid Web consolidated its WordPress software into four core products, LearnDash among them, and wound down the StellarWP brand (see [the five migration paths off LearnDash](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide)). ### 5. The Enrollment Cliff Is Real US higher education faces a [demographic enrollment cliff](https://goedmo.com/blog/enrollment-cliff-impact-on-higher-education/) starting in 2025–2026 as smaller birth cohorts from the post-2008 recession reach college age. Fewer students means tighter institutional budgets, which drives three LMS-relevant behaviors: consolidation onto single platforms (the UNC system standardizing on Canvas), cost pressure favoring open-source or cheaper SaaS, and less tolerance for expensive legacy contracts. ### 6. Corporate LMS Is Exploding At 22.9% CAGR, the corporate LMS segment is growing faster than any other. By 2030, it's projected to reach [$50.1B](https://www.precedenceresearch.com/corporate-learning-management-system-market). The drivers: mandatory compliance training across regulated industries, AI-powered content generation reducing course creation costs, and skills-based credentialing tying training directly to career advancement. According to [TalentLMS's 2026 L&D Report](https://www.talentlms.com/research/learning-development-report-2026), tech companies account for 30% of LMS users, followed by education (21%), manufacturing (9%), and healthcare (7%). ### 7. Open Source Resurgence The open source LMS market share is getting a second look. Post-Anthology-bankruptcy, institutions are reassessing the risk of vendor dependency. If your LMS vendor goes bankrupt, what happens to your courses, your student data, your integrations? Open-source platforms like Moodle and Open edX offer a hedge: no licensing fees, full data ownership, customization freedom, and zero vendor-bankruptcy risk. The tradeoff is IT overhead and (typically) less polished UX. But with managed hosting options like MoodleCloud and Open edX providers, that gap is narrowing. ## LMS Market Share by Region Almost all LMS coverage focuses on North America. Here's what the rest of the world looks like. | Region | Market Size / Share | Dominant Platform | Key Dynamic | | --- | --- | --- | --- | | North America | 36%–43% of global ($22.7B by 2030) | Canvas (50% enrollment) | Premium SaaS, enterprise budgets, system-wide mandates | | Latin America | Growing rapidly | Moodle (73% of higher ed) | Cost sensitivity favors open source; institutional adoption growing | | Europe | Second largest market | Moodle (~25%) | GDPR drives demand for self-hosted/EU-based solutions; Canvas gaining | | Asia-Pacific | $5.8B (2025), fastest growing | Fragmented (Moodle + local) | Government-led digital transformation; India and China driving growth | | Middle East & Africa | Emerging | Mixed | National learning platform initiatives; mobile-first requirements | Sources: [Fortune Business Insights](https://www.fortunebusinessinsights.com/industry-reports/learning-management-system-market-101376) (2025), [Programs.com](https://programs.com/resources/lms-statistics/) (2026) North America is Canvas territory. The combination of institutional budgets that can support premium SaaS pricing, a cultural preference for polished UX, and system-wide standardization mandates makes this Canvas's strongest market. Latin America is the opposite: Moodle at 73% dominance. Open-source economics win when budgets are tight. But this share has been eroding — down 5% over eight years — as cloud-hosted alternatives become more accessible. Europe presents a split. Western European universities increasingly adopt Canvas and Brightspace, but GDPR compliance requirements create demand for self-hosted solutions and EU-based hosting — a structural advantage for Moodle and Open edX. Asia-Pacific is the growth story. At $5.8B and the fastest-growing region by CAGR, it's projected to surpass North America in market size by the late 2020s. The market is fragmented, with Moodle competing against local platforms and government-backed initiatives. ## Open edX: The $735 Million Open-Source Platform Nobody's Tracking If you only read market-share rankings, you'll miss the platform that **procurement professionals rate higher than any other LMS in 2026**. Open edX scores **84.14/100** across our verified user review [Cubite Open edX Review](https://cubite.io/blogs/open-edx-review) — versus Canvas's 58.94 and Moodle's 76.9. Among **procurement professionals specifically**, that score jumps to **92.6/100**. Experienced users (>1 year on the platform) rate it 87.3. The footprint backs the satisfaction data: **Microsoft, IBM, NYU, and the US Air Force** run production Open edX deployments. The platform powers 100M+ learners cumulatively. And because it's fully open-source, none of those institutions carry the vendor concentration risk that defined the May 2026 Canvas headlines. **If that 84.14/100 puts Open edX on your shortlist:** the platform is free, but running it in production is not - you need hosting, upgrades, SSO, and support. Cubite offers managed, self-hosted Open edX from $1,260/mo, all-in and load-tested to 1,000 concurrent learners. See the [Open edX hosting guide](https://cubite.io/blogs/open-edx-hosting) or the [managed Open edX plans](https://cubite.io/services/managed-open-edx). ### What Open edX Actually Is Open edX is a free, open-source LMS built in Python/Django with React-based micro-frontends. It was originally created by Harvard and MIT in 2012 as the technology behind edX.org. In 2021, Harvard and MIT [sold the edX.org commercial marketplace to 2U for ~$800 million](https://www.thecrimson.com/article/2024/7/27/2u-bankruptcy-harvard-mit-edx/). The proceeds funded a new nonprofit — Axim Collaborative — which now stewards the open-source Open edX codebase with a [$735 million endowment](https://www.edsurge.com/news/2024-09-13-how-is-axim-collaborative-spending-800-million-from-the-sale-of-edx). That makes Open edX one of the best-funded open-source projects in existence. When 2U [filed for Chapter 11 bankruptcy in July 2024](https://www.classcentral.com/report/2u-edx-bankruptcy/), it didn't affect Open edX at all — the 2021 sale had cleanly separated the commercial marketplace from the open-source project. This is the opposite of the Anthology/Blackboard story: vendor bankruptcy destroyed Blackboard's ecosystem, but Open edX survived 2U's collapse untouched. ### The Numbers Nobody Reports According to the [2024 Open edX Impact Report](https://openedx.org/blog/the-2024-open-edx-impact-report-is-here/): | Metric | Value | Context | | --- | --- | --- | | Total learner registrations | 100.5 million | Across all Open edX-powered platforms worldwide | | Course enrollments | 207 million+ | Learners take multiple courses | | Live sites globally | 2,283+ | 18% year-over-year growth | | Countries | 196 | More than Moodle's 237-country registered count | | Active code contributors (2024) | 1,334 | Including 335 active code authors | | Contributing organizations | 15 | Actively participating in development | Important nuance: [Phil Hill noted at the 2025 Open edX Conference](https://onedtech.philhillaa.com/p/open-edx-conference-notes-2025) that the 100M learner figure is somewhat misleading — the vast majority came through edX.org (the commercial marketplace), not independent deployments. The 2,283 live sites is the more meaningful adoption metric. Still, 18% YoY site growth is strong. What enterprise Open edX users say. On learner experience: > "Whereas other open-source LMSs, Open edX is focused on learners instead of instructors." > "The user experience, as a learner and a teacher is great. The interface is intuitive." On extensibility: > "The extensibility of the platform via XBlocks and the ease of setting it up." On economics: > "No licensing, setup or royalty costs at all: the software is open source." The honest tradeoff: 50% of Open edX users mention technical complexity as a real drawback. "As an administrator it is very difficult to master. The software is highly scalable, but that comes at the cost of complexity." This is the gap most enterprises fill with a specialist partner — which is, transparently, our wheelhouse at [Cubite](https://cubite.io/services/custom-lms). We've shipped Open edX at 100M+ learner scale and turn the complexity tradeoff into a managed cost line. ### Why It's Invisible in Market Share Data Open edX occupies a different market than Canvas, Blackboard, or Moodle. It's rarely used as a primary campus LMS for traditional teaching (15-30 student classrooms). Instead, it powers: - Massive-scale online delivery — MOOCs, professional certificates, workforce training - Government national platforms — entire countries running education on it - Corporate upskilling — Fortune 500 companies training millions of employees - Microcredentials and continuing education — the fastest-growing segment of higher ed Traditional LMS market share trackers like Edutechnica count primary campus LMS installations. Open edX doesn't show up because it's not competing for the same deployment slot — it's competing for a different use case entirely. ### The Strategic Sweet Spot Phil Hill — the most respected analyst in the LMS space — [identified Open edX's greatest near-term potential](https://onedtech.philhillaa.com/p/open-edx-conference-notes-2025) as the noncredit and microcredential market. This segment: - Values flexibility over academic term structures - Thrives on self-service registration, course discovery, and e-commerce - Is fragmented in technology without easy solutions - Is clearly growing in demand as skills-based hiring accelerates With biannual platform releases (the latest, [Verawood](https://docs.openedx.org/en/latest/community/release_notes/verawood.html), shipped on July 30, 2026 with a rebuilt Instructor Dashboard; the one before, Ulmo, brought reusable course sections, full LTI Advantage certification, and dramatically faster builds in January 2026), AI extensions via the [openedx-ai-extensions plugin](https://openedx.org/blog/unlocking-the-value-and-roi-of-open-source-at-open-edx-2026/), and a service provider ecosystem, Open edX is technically mature and actively developing. ### What This Means for Your LMS Decision If you're evaluating LMS platforms for traditional campus teaching or small-team corporate training, Open edX is probably not the right fit — it's overengineered for that use case. But if you're building a professional education program, launching microcredentials at scale, running government-level workforce training, or need an enterprise learning platform that you fully control — Open edX deserves serious evaluation. The combination of zero licensing fees, a $735M-backed nonprofit steward, proven scale (IBM's 9 million learners, India's 10 million), and full customization freedom is hard to match. The catch: deployment complexity. You'll need either dedicated DevOps capacity or a [managed hosting provider](https://cubite.io/blogs/open-edx-hosting) to run it effectively. ## Enterprise LMS in 2026: A Procurement Framework Market share is a lagging indicator. By the time a vendor dominates a category, the procurement decision that mattered was made five years earlier. If you're evaluating an enterprise LMS in 2026 — for 1,000, 10,000, or 100,000 learners — you need a forward-looking framework, not a leaderboard. After the May 2026 Canvas breach, we believe enterprise LMS procurement should weigh six axes equally. Most RFPs we see weigh two (features, price) and treat the rest as IT problems. ### The six axes | Axis | What it measures | Why it matters in 2026 | | --- | --- | --- | | Total Cost of Ownership (TCO) | 5-year all-in: license, hosting, implementation, support, customization, migration | Per-user pricing hides the real cost; "free" open source hides it too | | Vendor concentration risk | What % of your peer institutions share your vendor; vendor's security history | Canvas just demonstrated why this matters | | Customization ceiling | How deeply you can modify pedagogy, branding, integrations without forking | Differentiated learning experiences require this | | Data ownership & portability | Who owns the data, in what format, with what export guarantees | Vendor lock-in is the inverse of this | | Integration depth | SIS, SSO, HRIS, payment, content, analytics, AI | The LMS is a hub, not a destination | | Scale-out path | What it costs to go from 1K → 10K → 100K users | Pricing breaks at the scale boundary, not in the contract | ### Vendor comparison on these axes | Axis | Canvas | D2L Brightspace | Moodle | Open edX | Cornerstone OnDemand | | --- | --- | --- | --- | --- | --- | | **Hosting model** | SaaS only | SaaS only | Self-host or hosted | Self-host or hosted | SaaS only | | **License cost (1K users/year)** | ~$10K | ~$10–15K | $0 (license) | $0 (license) | ~$35–60K | | **All-in 1K-user 5yr TCO** | $80–150K | $90–160K | $40–80K | $50–90K | $250–400K | | **Verified user score** | 58.94/100 | n/a | 76.9/100 | **84.14/100** | n/a | | **Procurement-pro rating** | n/a | n/a | n/a | **92.6/100** | n/a | | **Data export format** | Common Cartridge (IMSCC) | Common Cartridge | Full DB export | Full DB export | Proprietary | | **Customization ceiling** | LTI plugins | LTI plugins | Plugin + fork | XBlocks + fork | Configuration only | | **Concentration risk** | High (41% US HE) | Moderate | Distributed | Distributed | High (corporate) | | **2026 incident history** | Major breach (May) | Clean | Clean | Clean | Clean | ### When to build instead of buy If your scale-out path crosses ~25,000 learners, your customization ceiling needs to clear LTI's limits, or your data-ownership tolerance for a 5-year SaaS contract has dropped to zero after May 7 — custom or open-source-with-partner becomes the cheaper option, not the more expensive one. That's counterintuitive. It's also why every Open edX shop we know is busier in 2026 than in 2025. --- ## How to Choose an LMS in 2026 — Beyond Market Share Market share tells you what's popular. It doesn't tell you what's right for your organization. Canvas dominates higher ed — but it's not the right choice for a 50-person startup that needs compliance training with custom integrations. Moodle's market share is declining in North America — but it might be perfect for a Latin American university that needs full control at zero licensing cost. Choosing an LMS right now? [Book a 30-minute call](https://cubite.io/go/book?src=lms-market-share) with someone who has built and run learning platforms since 2013, or email [hello@cubite.io](mailto:hello@cubite.io). No pitch: we tell you which platform fits, including when it is not ours. Here's a framework that actually helps: Step 1: Define your sector. Higher education, corporate training, and K-12 are fundamentally different markets with different leaders, pricing models, and requirements. Step 2: Assess your scale. 100 users vs. 100,000 users changes everything — from pricing tiers to infrastructure requirements to the importance of admin automation. Step 3: Evaluate customization needs. If standard course delivery and grading work, off-the-shelf platforms save time and money. But if you need interactive learning environments — embedded code editors, live demo terminals, simulations, branded experiences — off-the-shelf hits a ceiling. Step 4: Consider the build-vs-buy decision. In 2026, custom LMS development is more accessible than ever — the gap between custom and off-the-shelf is smaller than it's been. AI-powered development tools have cut custom LMS build times significantly. The question isn't "can we afford custom?" It's "can our off-the-shelf platform do what we actually need?" Step 5: Test with a pilot. No amount of market research replaces putting the platform in front of actual users. | Scenario | Best Fit | Why | | --- | --- | --- | | Large university, standard needs | Canvas, Brightspace or Open edX | Proven at scale, strong support, broad integrations | | Budget-conscious institution, IT-capable | Moodle or Open edX | Zero licensing, full control, large community | | Enterprise compliance training | Cornerstone or Docebo | Talent management suite, compliance automation, AI | | SMB quick-start training | TalentLMS | Affordable, simple, fast setup | | K-12 school on Google Workspace | Google Classroom | Free, integrated, familiar to students | | Custom interactive learning | Open edX or Cubite LMS | Code editors, demo terminals, branded UX, deep integrations | ## Migration in 2026: Costs, Timelines, and the Risk Checklist Vendor incidents drive migration cycles. Anthology's bankruptcy started one in 2024; the May 2026 Canvas breach has started another. If you're inside that cycle right now, here's what to budget for. In the WordPress world, the StellarWP wind-down started a third wave ([the 5 migration paths off LearnDash in 2026](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide)). ### Typical migration economics | Institution size | Timeline | Cost range | Major cost drivers | | --- | --- | --- | --- | | Mid-size (500–2,000 users) | 4–6 months | $25K–$80K | SIS integration, training | | Large (2,000–25,000 users) | 9–15 months | $80K–$300K | SIS integration, content remediation, parallel run | | Enterprise (25,000+ users) | 12–24 months | $300K+ | Multi-system integration, governance, change management | ### The cost most institutions underestimate SIS integration is the #1 hidden cost. Course catalogs, enrollment flows, grade pass-back, identity sync — these aren't features you toggle on. They're projects you scope. A typical SIS integration for Banner, PeopleSoft, or Workday Student adds $30K–$120K depending on data complexity and whether the target LMS has a pre-built connector. The #2 hidden cost is content remediation. Canvas exports cleanly to Common Cartridge (IMSCC) format, which most platforms can import — but interactive content, custom rubrics, and proprietary integrations frequently break in translation. Budget 10–20% of your faculty time over the migration window for remediation. ### What migration off Canvas looks like in practice If you're evaluating a Canvas migration after May 2026, the path generally runs: 1. Data freeze + audit (weeks 1–2): Inventory courses, users, custom integrations, retention obligations 2. Target platform decision (weeks 2–6): RFP, demos, TCO modeling, security review of finalists 3. Pilot deployment (weeks 6–14): Single department or college on target platform with full toolchain 4. Content migration (weeks 10–24): IMSCC export → import → faculty-led remediation 5. Parallel run (weeks 24–36): Both LMSes active; new courses on target, legacy on Canvas 6. Cutover + decommission (weeks 36–52): Final read-only freeze, license termination Institutions that try to skip pilot and parallel run save 4–6 months and pay for it during finals. --- ## Free LMS Decision Tool: Find the Best Fit for Your Needs ## The 2026 LMS Buyer's Toolkit We packaged the LMS discovery calls we have run since 2013 into a ten-question consultation. Answer them and the toolkit will tell you which of seven platforms actually fits, what it'll cost in year one, and why the runners-up don't make the cut. The recommendation is rules-based, not an AI guess. Free, no email gate to see your result. What's inside: 1. Ten-question consultation covering audience size, learner type, content state, monetization, SSO needs, hosting preference, budget, and timeline. If you're migrating off an existing LMS, three follow-ups appear: source platform, current version, and what must come with you. 2. An honest counter-recommendation. The "why other options aren't the strongest pick" section names the gaps for the runners-up. We tell you when a platform almost works, not just what wins. 3. Year-one cost bands sized to your org. Realistic ballpark numbers covering platform, setup, and integration. Not vendor list prices. 4. Full ranking with match percentage. Expand the result to see how all seven LMSs scored against your situation, with a visual gap so you can tell whether it was decisive or close. ## Find your LMS fit in under two minutes Ten honest questions about your audience, content, and constraints. The recommendation is rules-based, built from real LMS deployments since 2013. No email required to see your result. ### Discovery questions 1. **How many learners will use this?** - Under 100 - 100–1,000 - 1,000–10,000 - 10,000+ 2. **Why are you looking right now?** _Be honest. It shapes the recommendation._ - Migrating off a current LMS that isn't working - Brand new initiative, first LMS - Forced by a compliance or audit event - Outgrew a free or basic tool (Google Classroom, Teachable…) - M&A: combining systems - Just researching for now 3. **Who are the learners?** - Internal employees - External customers or partners - Paying public - Students - Mixed audiences 4. **What's the main outcome you need?** - Compliance / certification tracking - Employee onboarding & ramp-up - Customer training - Selling courses publicly - Academic delivery - Mixed / multiple programs 5. **Are you migrating from an existing LMS?** - No, greenfield - Yes, a custom in-house build - Yes, an open-source LMS - Yes, a commercial LMS - Not sure yet / still deciding 6. **Which one specifically?** _We've built bridges from most of these._ - Moodle - Open edX - Canvas - Blackboard - Cornerstone OnDemand - Docebo - TalentLMS - D2L Brightspace - Schoology - Absorb - Custom in-house build - Other open-source LMS - Other commercial LMS 7. **How current is your existing LMS?** _Be candid. Older versions usually mean a more involved migration._ - Up to date (within the latest major release) - 1 version behind - 2+ versions behind / years without an upgrade - I'm not sure 8. **What must come with you to the new platform?** (multi-select) _Pick everything that's non-negotiable._ - User accounts & rosters - Course content / curriculum - Completion records & grades - Issued certificates - SCORM / xAPI packages - Custom integrations (SSO, HRIS, payment…) - Branding / theme / look-and-feel - Just users, we'll rebuild the rest 9. **Will learners pay to access content?** - No, internal use only or free for our audience - Yes, one-time purchases per course - Yes, subscription or membership - Mix of free and paid 10. **Do you need SSO?** _Single Sign-On lets learners sign in with their existing work / school identity._ - No, local accounts are fine - Yes, Google Workspace - Yes, Microsoft Entra / Azure AD - Yes, Okta - Yes, another SAML or OIDC provider - Not sure yet 11. **How do you want to host it?** - Fully managed (host and run it for us) - Self-host on our cloud (AWS / GCP / Azure) - Self-host on-premises / private data center - Open to either, we'll decide later 12. **Year-1 budget?** _All-in: platform + setup + integration. Be realistic._ - Under $10k - $10k–$50k - $50k–$200k - $200k+ - Don't know yet / depends on the option 13. **When do you need to be live?** - Within a month - 1–3 months - 3–6 months - 6+ months - No firm timeline ### Candidate platforms #### Cubite LMS _Multi-tenant, AI-native LMS. Fast to launch, customisable when you grow._ **Estimated year-1 cost:** - Under 100 learners: $6k to $12k / yr - 100 to 1,000 learners: $12k to $36k / yr - 1,000 to 10,000 learners: $36k to $90k / yr - 10,000+ learners: $90k to $250k / yr **Where it fits best:** - Cubite was built for organizations that publish learning to a customer or public audience. That's exactly the use case where most other LMSs feel institutional or corporate. - Customer education, paid marketplaces, and mixed-use programs are the home turf. Public catalogs, certifications, Stripe payments, and AI-assisted authoring are all first-class. - Stripe-native commerce is built in. One-time purchases, subscriptions, coupons, and tax handling all ship without bolting on plugins. - Fully managed by default. No DevOps weekends, no plugin upgrade surprises, no Moodle-version-mismatch incidents. - Cubite is priced for the under-10k-learner segment where Cornerstone and Docebo become overkill and Moodle starts feeling threadbare. - Standard provisioning is under a week. If you said you need to launch in a month, Cubite is one of the only credible answers. - We've migrated tenants off Schoology, Absorb, and home-grown stacks. We know how to keep your roster and content intact. **Where it falls short:** - At true 10k+ enterprise scale with strict procurement, Cornerstone's market position is hard to beat, but you'll pay for that. - For pure compliance with FDA / SOX-grade audit needs, Cornerstone has the deeper paper trail. - If you need to self-host on-premises, Cubite isn't the right shape; Moodle or Open edX are. **Disqualifying constraints:** - hosting: self-onprem #### Open edX _Open-source platform behind MIT/Harvard MOOCs. Built for academic scale._ **Estimated year-1 cost:** - Under 100 learners: $8k to $20k / yr - 100 to 1,000 learners: $20k to $60k / yr - 1,000 to 10,000 learners: $60k to $200k / yr - 10,000+ learners: $200k to $600k / yr **Where it fits best:** - Open edX runs MIT, Harvard, Stanford, and the IBM and Microsoft training academies. If your audience is students or public learners at scale, you'll never outgrow it. - Multi-week graded academic courses are the original design intent. Problem types, randomized assessments, peer review, and proctoring are first-class. - Self-host gives you full architectural control. With a strong IT team and our deployment expertise, TCO comes out well below SaaS at scale. - Open edX scales horizontally to hundreds of thousands of concurrent learners. Nothing else on this list does that. - We've helped institutions move from Blackboard, legacy Moodle, and out-of-support Open edX instances onto current Open edX with full course content preserved. - Two-plus versions behind is the most common starting point we see, and Open edX migrations from that state are a known, repeatable engagement. **Where it falls short:** - Open edX without a managed partner is a real ops commitment. You'd need to budget for Tutor or k8s expertise. - Under 100 learners the platform is overbuilt. You'd be paying for capacity you'll never use. - Open edX is a 3–6 month rollout when done properly. Anything faster usually means cutting corners. - For pure corporate L&D audiences, the academic flavor of Open edX feels overshot. **Disqualifying constraints:** - size: tiny - budget: bootstrap #### Moodle _The world's most-deployed open-source LMS. Flexible and global._ **Estimated year-1 cost:** - Under 100 learners: $2k to $8k / yr - 100 to 1,000 learners: $8k to $30k / yr - 1,000 to 10,000 learners: $30k to $90k / yr - 10,000+ learners: $90k to $250k / yr **Where it fits best:** - Moodle's open-source license is the lowest-friction entry point in the LMS market. With a modest hosting partner you can run a credible LMS for under $10k a year. - Moodle dominates higher ed and K-12 globally with 500M+ registered users, and most academic conventions (gradebooks, rubrics, cohorts) ship as standard plugins. - Self-host or managed-host: you choose, and you can switch later without losing your data. - If you're already on Moodle, the in-place upgrade path is well-trodden. Most of our Moodle work is rescue-and-upgrade engagements. - Two-plus versions behind on Moodle is where we live. The upgrade path is non-trivial but proven. - For traditional academic delivery (gradebooks, cohorts, due dates, course-by-course mastery) Moodle is the default for good reasons. **Where it falls short:** - For customer-facing course marketplaces, Moodle works but feels institutional. The UX is built for students, not buyers. - Moodle's commerce story is plugin-based. It works, but you'll be maintaining the integration yourself. - A polished Moodle setup with theming and integrations takes a few months, and the plugin ecosystem can introduce upgrade surprises later. #### Canvas (Instructure) _The UX leader in higher ed. Clean, cloud-native, expensive._ **Estimated year-1 cost:** - Under 100 learners: $15k to $40k / yr - 100 to 1,000 learners: $40k to $90k / yr - 1,000 to 10,000 learners: $90k to $250k / yr - 10,000+ learners: $250k to $800k / yr **Where it fits best:** - Canvas dominates North American higher ed at about 50% enrollment share. Faculty and students already know the UX. - Built around academic terms, gradebooks, and the realities of teaching multi-section courses. Hard to beat for traditional higher ed. - Migrating from Blackboard is the most common Canvas conversation; Instructure has tools and case studies for exactly that. - Mature LTI consumer and best-in-class mobile apps. You can plug your existing tool ecosystem in without engineering work. **Where it falls short:** - Canvas has no real commerce story. If you're charging learners for courses, you'll be doing it outside the platform. - Canvas pricing scales steeply at smaller orgs. Under 500 learners the per-seat math gets tough to justify. - Canvas struggles outside academic use cases. For corporate L&D or customer education, it's a square peg. **Disqualifying constraints:** - budget: bootstrap - audience: customers - hosting: self-onprem - monetization: subscription #### Docebo _AI-forward corporate LMS. Strong mid-market sweet spot._ **Estimated year-1 cost:** - Under 100 learners: $25k to $50k / yr - 100 to 1,000 learners: $50k to $100k / yr - 1,000 to 10,000 learners: $100k to $300k / yr - 10,000+ learners: $300k to $800k / yr **Where it fits best:** - Docebo is purpose-built for corporate L&D and customer training. Their AI roadmap is among the most credible in the LMS space. - Onboarding flows, customer training, and partner enablement are all first-class. The analytics are genuinely useful for L&D leadership. - Enterprise SSO and SCIM provisioning are mature. Okta, Entra, Google: all just work. **Where it falls short:** - Docebo's entry price puts it out of reach for SMB and bootstrapped programs. - Outside corporate L&D and customer ed, the product feels enterprise-flavored. Academic and K-12 institutions tend to bounce off. - Docebo is SaaS-only. If you need to self-host, this isn't the platform. **Disqualifying constraints:** - budget: bootstrap - size: tiny - hosting: self-onprem, self-cloud #### TalentLMS _SMB-friendly corporate LMS. Fast to launch, affordable._ **Estimated year-1 cost:** - Under 100 learners: $3k to $8k / yr - 100 to 1,000 learners: $8k to $25k / yr - 1,000 to 10,000 learners: $25k to $70k / yr - 10,000+ learners: $70k to $180k / yr **Where it fits best:** - TalentLMS has the most reasonable entry-level pricing of the proper SaaS corporate LMSes. Real product, real onboarding, real support. - You can stand up a usable training program in days. The setup friction is lower than anything else in this bracket. - Sweet spot is small-to-mid corporate training, compliance and onboarding programs especially. - If you outgrew Google Classroom or a free tool, TalentLMS is the natural next step without the enterprise price tag. **Where it falls short:** - Past a few thousand learners the per-user pricing starts to feel punishing. You'll be evaluating alternatives soon. - Built-in commerce is limited. A real paid-marketplace program will outgrow TalentLMS quickly. - Not designed for student / academic delivery. Gradebooks and cohort tooling are missing. **Disqualifying constraints:** - audience: students - hosting: self-onprem, self-cloud #### Cornerstone OnDemand _Enterprise-grade corporate talent + learning suite_ **Estimated year-1 cost:** - Under 100 learners: Not a fit at this scale - 100 to 1,000 learners: $75k to $150k / yr - 1,000 to 10,000 learners: $150k to $400k / yr - 10,000+ learners: $400k to $1500k / yr **Where it fits best:** - Compliance training with full audit trails, certification tracking, and regulatory reporting is Cornerstone's home turf. - At 10k+ learners with enterprise procurement, Cornerstone is the safe choice. It's been doing this for two decades. - When a compliance event or audit forces the conversation, Cornerstone is the procurement-friendly answer. - Deep enterprise SSO + Workday and Salesforce integrations come standard. **Where it falls short:** - Cornerstone's floor is well into six figures. For anything under enterprise scale, you'll overspend dramatically. - Procurement and implementation routinely take 6–12 months. If you need to launch this quarter, look elsewhere. - Built for internal employees. Customer / public audiences are a poor fit. **Disqualifying constraints:** - budget: bootstrap, smb - size: tiny, small - audience: students, public - hosting: self-onprem, self-cloud - monetization: one-time, subscription, mixed ## What's Next: LMS Market Forecast Through 2030 The LMS market is projected to reach $70.8B by 2030 at approximately 19.9% CAGR, according to [Programs.com](https://programs.com/resources/lms-statistics/) and corroborated by [Grand View Research](https://www.grandviewresearch.com/industry-analysis/learning-management-systems-market). Five predictions based on current trajectory: 1. Corporate LMS will be the largest segment — at $50.1B by 2030, it will represent over 70% of the total market. Skills-based credentialing and AI-driven content generation are the catalysts. 1. Asia-Pacific will surpass North America — the region's combination of population scale, government investment in digital education, and rising enterprise training budgets creates a larger addressable market. 1. Canvas will face monopoly scrutiny — at 50% enrollment share and growing, Canvas is approaching the point where institutions start worrying about pricing power and vendor dependency. This benefits open-source alternatives. 1. More M&A, more failures — private equity money is flooding into EdTech. Some bets will work (KKR/Canvas). Others will follow the Anthology playbook and collapse under debt. Buyers should evaluate vendor financial health, not just features. 1. Custom platforms will gain share — as AI development tools lower the cost of building bespoke learning experiences, the economics of custom LMS platforms improve. Organizations with unique learning needs (interactive coding, simulations, branded environments) will increasingly build rather than buy. ## Frequently Asked Questions ### What is the most used LMS in 2026? Canvas dominates North American higher education with 50% enrollment share, while Moodle leads globally with 500M+ registered users and 73% of Latin American higher ed. Google Classroom reaches 150M+ users in K-12. The "most used" depends on sector and region — there is no single global leader. In higher education specifically, Canvas (Instructure) has pulled ahead decisively. OnEdTech's year-end 2024 data puts Canvas at 50% of US and Canadian higher-ed enrollment. In Edutechnica's Spring 2025 data, Canvas for the first time had a greater share of US higher-ed institutions than its next three competitors combined, and Edutechnica's fall 2026 update (September 27, 2026) says almost all gains still go to Canvas and D2L Brightspace. Globally, Moodle still has the largest install base by sheer number of registered users, though its per-region market share is declining in most developed markets. This answer is part of Cubite's LMS market share analysis; Cubite sells Cubite LMS ($290 a month or $2,900 a year) and runs managed Moodle and Open edX. ### How big is the LMS market in 2026? The global LMS market is valued at $31.6B–$37.1B in 2026, growing at a CAGR of 16%–20%. North America accounts for 36%–43% of the market. The corporate LMS segment is the fastest-growing at 22.9% CAGR, projected to reach $50.1B by 2030. Estimates vary between research firms because they define "LMS" differently. Fortune Business Insights and Grand View Research both project the market exceeding $100B by 2032–2033. ### Is Canvas replacing Blackboard? Yes. Canvas holds 50% of North American higher-ed enrollment vs. Blackboard's 12%. Anthology filed Chapter 11 bankruptcy in September 2025. Universities including Miami, Ohio, and CUNY schools are actively migrating to Canvas. However, Blackboard emerged debt-free in February 2026 and still serves 19% of institutions. The trajectory has been consistent for over a decade. Between 2014 and 2025, Blackboard was being decommissioned at institutions faster than it was being adopted, according to Edutechnica. Canvas is the primary beneficiary, though D2L Brightspace is also gaining significant share from Blackboard departures. ### What is the fastest growing LMS? Canvas is the fastest-growing LMS in higher education, now holding more market share than its next three competitors combined. In corporate training, Docebo ($243M revenue, +12% YoY) and TalentLMS (17,000+ customers) are growing fastest. Google Classroom leads K-12 growth with 150M+ users. The growth drivers differ by sector: Canvas wins on UX and cloud-native architecture; Docebo wins on AI-first product strategy; Google Classroom wins on ecosystem bundling and free pricing. ### Is Moodle still the most popular LMS? By registered users (500M+), Moodle is the world's most widely adopted LMS. But it's losing ground in North America and Europe, where institutions are migrating to cloud-native platforms like Canvas and Brightspace. Moodle dominates Latin America (73%) and remains strong where cost and customization are priorities. The Moodle company itself is growing — it was named to the 2026 GSV 150 list of top digital learning companies. Products like MoodleCloud (managed hosting) and Moodle Workplace (corporate training) are generating revenue even as the self-hosted institutional market share declines. ### Which LMS has the highest market share in corporate training? Cornerstone OnDemand leads enterprise corporate training with ~$830M in revenue and 7,000+ customers. Docebo ($243M revenue), SAP Litmos, and TalentLMS are strong mid-market players. The corporate LMS market is growing at 22.9% CAGR, driven by AI-powered upskilling and compliance automation. Unlike higher education, there's no single dominant platform in corporate training. The market is more fragmented, with vendor choice driven by company size, industry vertical, and integration requirements. Cornerstone wins enterprise; TalentLMS wins SMB; Docebo targets the AI-forward mid-market. ### What will the LMS market be worth in 2030? The global LMS market is projected to reach $70.8B by 2030, growing at approximately 19.9% CAGR from its 2026 base of ~$34B. The corporate segment alone is expected to hit $50.1B. Asia-Pacific is the fastest-growing region, driven by digital transformation in India, China, and Southeast Asia. These projections come from multiple research firms and are directionally consistent, though the exact figures vary by $10B–$15B depending on methodology and market definition. ### What is the difference between LMS and LXP? An LMS manages structured courses, compliance tracking, and certifications — it's admin-driven. An LXP uses AI to recommend personalized content, social learning, and microlearning — it's learner-driven. In 2026, the distinction is blurring: modern platforms like Docebo and Absorb combine both approaches. The LXP market alone is $3.74B. If you're evaluating platforms, look for hybrid capabilities. The question isn't "do we need an LMS or an LXP?" — it's "does this platform handle both compliance requirements and self-directed learning?" ### How much do companies spend on LMS? The corporate LMS market reached approximately $7.8B in 2025 and is growing at 22.9% CAGR. 98% of major enterprises use an LMS. Average per-user costs range from $5–$15/month for cloud-based platforms. 45% of companies plan to increase their LMS investment in 2026. Costs vary dramatically by scale and complexity. TalentLMS starts at a few hundred dollars per month for small teams. Enterprise deployments of Cornerstone or Docebo can run into six or seven figures annually. Custom-built platforms have higher upfront costs but can be more economical at scale. ### Is Canvas LMS safe to use after the May 2026 breach? The May 2026 Canvas breach exposed names, emails, student IDs, and messages for ~275M users across 8,809 institutions — but Instructure confirmed passwords, dates of birth, government IDs, and financial data were not compromised. Institutions like UBC have begun migrating to alternatives; CISOs recommend MFA, FFT-account audits, and contingency planning. Practically: Canvas is still operational and most institutions are continuing on the platform short-term. The longer-term question is whether your institution's risk tolerance has changed. If 5-year vendor risk now weighs more heavily than it did pre-May 7, that's a procurement variable that didn't exist for most RFPs written before 2026. ### Which institutions migrated off Canvas after the breach? The University of British Columbia publicly confirmed it began moving staff and courses to Moodle (and SharePoint for stored materials) within days of the May 7 second-wave attack. Multiple Australian, Dutch, and Canadian universities temporarily disabled Canvas access as a preventative measure. Quieter migration evaluations are underway at multiple US state university systems as of mid-May 2026, though no system has publicly committed yet. Expect a wave of formal RFPs in Q3 2026 once finals end and contracts come up for renewal. ### What is the best alternative to Canvas LMS in 2026? The most common Canvas alternatives in 2026 are D2L Brightspace (commercial, AI-integrated), Moodle (open-source, 500M+ users globally), and Open edX (open-source, enterprise-scale). Open edX scores 84.14/100 in verified user reviews versus Canvas's 58.94/100 — and 92.6/100 specifically among procurement professionals. The right choice depends on three variables: your scale (Open edX is built for >10K learners), your customization ceiling (Moodle and Open edX clear it; Canvas and Brightspace constrain it), and your hosting tolerance (open-source means you're either self-hosting or paying a specialist partner). For institutions over 25,000 users, Open edX with a managed partner is increasingly the TCO winner. ### How much does it cost to migrate from Canvas to another LMS? Canvas migration costs typically run $25K–$80K for mid-size institutions, $80K–$300K for large institutions (2K–25K users), and $300K–$1M+ for enterprise scale. Timelines run 4–6 months at the low end and 12–24 months at the high end. Canvas exports to Common Cartridge (IMSCC) format, which most platforms import natively. The hidden costs are SIS integration ($30K–$120K depending on Banner / PeopleSoft / Workday complexity) and content remediation (10–20% of faculty time during the migration window). Skip the pilot phase and the parallel-run, and you save 4–6 months — and pay for it during the next finals week. ### Which LMS has the best ROI for enterprises in 2026? Open edX consistently outscores commercial alternatives among enterprise procurement teams (92.6/100 versus Canvas 58.94/100). With zero licensing fees, full source-code control, and proven scale at Microsoft, IBM, NYU, and the US Air Force, total 5-year TCO for 5,000+ users typically beats Canvas/Cornerstone by 40–60% when self-managed or run through a specialist partner. The tradeoff: 50% of Open edX users cite technical complexity as a real drawback. That complexity is the reason specialist implementation partners exist — and the reason most enterprise Open edX deployments run through one rather than going it alone. ### What is LMS vendor lock-in, and why does it matter more in 2026? LMS vendor lock-in means switching platforms becomes expensive or technically painful due to proprietary data formats, custom integrations, contractual penalties, or all three. The May 2026 Canvas breach exposed how this compounds: 41% of US higher-ed depended on a single vendor, and exit options were neither cheap nor fast. Open-source platforms like Moodle and Open edX structurally eliminate lock-in — you own your data and your platform. Commercial SaaS LMSes vary: Canvas offers Common Cartridge export (workable); Cornerstone and many corporate LMSes hold data in proprietary formats that require custom export work. Ask for the export format in writing before signing any 5-year contract. --- # Sell Moodle Courses with Next.js: Build a Modern Storefront https://cubite.io/blogs/sell-moodle-courses-nextjs-storefront **By:** Amir Tadrisi **Updated:** 2026-10-01 Build a Next.js course storefront for Moodle with Stripe payments. The modern alternative to WordPress + WooCommerce for selling Moodle courses. # Sell Moodle Courses with Next.js: Build a Modern Storefront The Moodle ecommerce stack you actually want: a Next.js storefront with indexable course pages, native Moodle Stripe integration, and a SSO plugin that lands students inside their course in under two seconds. One-time $240. No WordPress required. ## Check a Live Demo Visit our live demo and see how the Cubite integration with Moodle works [Live Demo](https://moodle.cubite.io) --- ## Moodle is a great classroom. It's a terrible storefront. Moodle's course pages need a login to view, so Google can't index them. There's no native Moodle Stripe integration. There's no marketing page builder, no blog, no SEO controls and no multi-tenant storefronts. The standard fix is to bolt on a WordPress site, then a WooCommerce store, then Edwiser Bridge to sync the two. You end up maintaining two CMSes, paying for plugin extensions every year, and debugging sync failures every week. [Reviews of the leading bridge plugin](https://wordpress.org/support/plugin/edwiser-bridge/reviews/) call out exactly this — sync drift, SSO login loops, "1 in 50 enrollments fails." Cubite replaces the entire stack with one Next.js storefront. You install one Moodle plugin, paste one shared secret, and you're selling. --- ## How it works ### 1. Connect your Moodle in ~5 minutes In your Moodle admin: enable Web Services, enable the REST protocol, create an external service with the eight required functions, generate an API token, then install the open-source auth_cubite plugin (drag-and-drop ZIP) and paste the shared secret. Cubite tests the connection end-to-end, validates every required function, and pulls your course catalog over the standard Moodle REST API. ### 2. Edit your storefront like a real website Your courses, your pricing, your marketing copy, your blog, your SEO metadata — all editable in Cubite's admin, indexed by Google, rendered as static pages on a global CDN. ### 3. Sell. Students land inside the course. Stripe checkout completes. Cubite creates the Moodle user and enrolls them. --- ## Moodle without WordPress, finally If you've ever evaluated Moodle ecommerce, you've seen the same prescription: install WordPress, install WooCommerce, install Edwiser Bridge or MooWoodle, configure two databases, sync the user tables, debug the SSO loop, and renew three plugin licenses every year. Two CMSes, five moving parts, recurring bills. Cubite skips the WordPress layer entirely. The storefront is a Next.js app on your domain. Stripe checkout is built in. Marketing pages are first-class, not retro-fitted. Two pieces of software (Cubite + Moodle), not five. If you searched "moodle without wordpress," "wordpress moodle integration alternative," or "moowoodle alternative" — this is the answer. --- ## Real marketing pages, real SEO. Not a plugin in Moodle's admin UI. Your storefront runs on your domain, built with Next.js. Course pages have title tags, meta descriptions, OG images, schema markup, breadcrumbs, and clean canonical URLs — the things Google needs and Moodle's /course/view.php?id=42 URLs don't give you. Edit course descriptions, hero images, FAQ blocks, and pricing copy from a clean admin. Run a blog on the same domain. Stack landing pages for paid campaigns. Push sitemaps to Google Search Console. This is a real website, not a Moodle skin. --- ## The Moodle SSO plugin auth_cubite is the Moodle SSO plugin we ship with Cubite (and publish open source). When a student clicks "Go to Course," Cubite issues a signed JWT (HMAC-SHA256, 60-second expiry), redirects to your Moodle's auth_cubite endpoint, the plugin validates the signature, and complete_user_login() sets the Moodle session. Total time: 1-2 seconds. This is not a sync — there's no fragile two-way user table replication and no shared password. Cubite is the identity source of truth; Moodle profile fields are read-only and refresh from Cubite on every login. No drift, no login loops, no token expiration errors. --- ## Multi-tenant from day one Run a single Cubite installation that powers many storefronts on different domains, each connected to its own Moodle instance. Your reseller business, your white-label partners, your enterprise customers — all from one codebase, one admin, one billing pipeline. Every tenant gets its own admin bypass token, so an admin of one Moodle can't accidentally cross-authenticate into another customer's instance. No competitor on this page offers this. --- ## Catalog lockdown — students can't bypass your payment flow auth_cubite ships with three layers of enforcement built in: - Self-enrollment and guest enrollment disabled at install time, so students can't add themselves to courses for free - Catalog pages blocked — /course/index.php, /course/search.php, /course/index_category.php redirect non-admins to your storefront - Login and signup pages redirect to your storefront's /auth/signin and /auth/signup, with an admin bypass token for tenant operators Moodle becomes a pure delivery engine. Every dollar your courses earn flows through Cubite + Stripe. --- ## Flexible course linking — sync some, hand-build others Edwiser Bridge users have one recurring complaint: a re-sync overwrites your marketing copy. Cubite doesn't. The first sync pulls your Moodle catalog. After that, your Cubite course content — names, descriptions, hero images, SEO fields — is yours to edit. Re-syncs add new courses without touching what you've already polished. And any Cubite course can be linked or unlinked to a Moodle course at any time, so you can also build pure-storefront items: course bundles, pre-launch waitlists, downloads, or consulting calls that don't need a Moodle course behind them. --- ## Cubite vs Edwiser Bridge vs Edwiser Store vs Enrollait vs Course Commerce Pro vs Enrolmart | Feature | **Cubite** | Edwiser Bridge | Edwiser Store | Enrollait | Course Commerce Pro | Enrolmart | | --- | --- | --- | --- | --- | --- | --- | | **Total cost** | **$240 once** | ~$400-600+/yr stacked extensions | Annual + lifetime tiers | $420-840/yr | $199/yr | $2,388-5,988/yr | | **No WordPress required** | ✓ | ✗ | ✓ | ✓ | ✓ | partial | | **Native marketing site + blog** | ✓ | partial (via WP) | ✗ | ✗ | ✗ | partial | | **Real SEO on course pages** | ✓ | partial | ✗ | ✗ | ✗ | partial | | **Multi-tenant storefronts** | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | | **JWT SSO (60s expiry)** | ✓ | partial (session sync) | partial | partial | partial | partial | | **Stripe checkout** | ✓ | ✓ (via Woo) | ✓ | ✓ | ✓ | ✓ | | **Catalog lockdown enforcement** | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | | **Profile source-of-truth pinning** | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | | **Sync-safe marketing copy** | ✓ | ✗ (overwrites) | n/a | n/a | partial | partial | | **Recurring subscriptions** | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | | **B2B seat licensing** | ✗ | partial | ✓ | ✗ | ✓ | ✗ | Last verified: 2026-04-27. Pricing and features change — verify on each vendor's site before citing. Subscription billing and B2B seat licensing are on the Cubite roadmap; if you need them today, talk to us first. --- ## Switching from Edwiser Bridge Edwiser Bridge is the most popular WordPress-Moodle integration — and the most-complained-about. The recurring pain in public reviews and [Moodle forums](https://moodle.org/mod/forum/discuss.php?d=367665): - Sync drift — courses get out of step; one re-sync overwrites your marketing copy - SSO login loops — sessions expire mid-flow, students bounce back to the login page - Token expiration errors — public reports of "1 in 50 enrollments fails" in high-traffic windows - Extension renewal stack — base plugin is free, but the features you actually need (WooCommerce, SSO, Bulk Purchase, Selective Sync) bundle to roughly $400-600/year - Hidden fragility — uppercase usernames break it, changing the Moodle admin password breaks it, plugin updates have broken enrollment Head-to-head: | | **Cubite** | Edwiser Bridge | | --- | --- | --- | | Total cost | **$240 once** | ~$400-600+/yr stacked extensions | | Stack | Cubite + Moodle | WordPress + WooCommerce + Edwiser + extensions | | SSO model | Signed JWT, 60s expiry, no shared session | Session sync (drifts) | | Re-sync overwrites marketing copy | No | Yes (top complaint) | | WordPress required | No | Yes | | Yearly renewal | None | Per-extension | If you're paying for the Edwiser stack today, the migration path is straightforward: install auth_cubite, point Cubite at your existing Moodle, sync your courses, freeze your WordPress shop, redirect customers. --- ## Considering Enrollait? Enrollait is the closest direct rival in positioning — also a storefront layer for Moodle, also Stripe-direct, also no-WordPress. The differences are billing model and breadth. | | Cubite | Enrollait | | --- | --- | --- | | Pricing | $240 once | $34.99-$69.99/month ($420-$840/year) | | Year-3 cost | $240 | $1,260-$2,520 | | Multi-tenant storefronts | ✓ | ✗ | | Native blog + marketing pages | ✓ | ✗ | | Custom domain | ✓ (included) | Enterprise tier only ($840/yr) | | Open-source SSO plugin | ✓ | ✗ | | Subscriptions / recurring billing | ✓ | ✗ | --- ## Who it's for ### Independent course creators leaving Teachable / Thinkific You want to own your platform, not pay 20% per transaction or get throttled when you grow. Moodle is the most-used LMS on earth and it's free. Cubite is the storefront that makes selling on it as nice as Teachable. ### Training companies stuck on the Edwiser stack You're paying for WordPress hosting, WooCommerce, Edwiser Bridge, three Edwiser extensions, and an admin who fixes sync drift every week. Cubite is one Next.js app, one plugin, $240 once. ### Agencies running multi-tenant Moodle deployments You host Moodle for many customers and need a real branded storefront for each one. Cubite is the only product on this list with native multi-tenant support. ### Universities and corporate L&D launching paid programs You already run Moodle internally. You need a public-facing buying experience that your marketing team can actually edit. Cubite gives you that without a six-month integration project. --- ## Frequently asked questions ### What is a Moodle storefront? A Moodle storefront is a separate, public-facing website that markets and sells your Moodle courses, then enrolls buyers into Moodle automatically. Moodle's built-in course pages require a login and can't be indexed by Google, so a dedicated storefront is the only way to run real marketing, SEO, and ecommerce alongside Moodle. Cubite is a complete Moodle storefront — Next.js front-end, Stripe checkout, signed-JWT SSO, and a Moodle plugin — for a one-time $240. ### How is Cubite different from Edwiser Bridge? Edwiser Bridge connects Moodle to a WordPress site running WooCommerce, so you maintain two CMSes and pay for extensions yearly. Cubite replaces the whole stack with one Next.js storefront and one Moodle plugin. No WordPress, no recurring extension fees, and no two-way sync drift — Cubite is the source of truth, Moodle is the classroom. If you're hitting sync errors, login loops, or extension renewal bills with Edwiser, Cubite is built specifically to fix those problems. ### Do I need WordPress? No. Cubite is a self-contained Next.js application. Most "Moodle ecommerce" solutions require WordPress + WooCommerce + a bridge plugin, which means three pieces of software to maintain. Cubite is one. You keep your existing Moodle. Cubite handles everything in front of it. ### What does setup actually involve? Setup is a one-time, ~15-minute process inside your Moodle admin. You'll enable Web Services, enable the REST protocol, create an external service with eight Moodle functions, generate an API token, install the auth_cubite plugin, and paste the shared secret. Cubite's connection test verifies every function before you go live. The eight required functions are: core_webservice_get_site_info, core_course_get_courses, core_course_get_courses_by_field, core_course_get_categories, core_user_create_users, core_user_get_users_by_field, enrol_manual_enrol_users, core_enrol_get_enrolled_users. If any are missing, the setup wizard tells you which one and where to enable it. ### Which Moodle versions are supported? Cubite supports Moodle 4.4 and later, and is tested on Moodle 5.2. The auth_cubite plugin uses Moodle's standard authentication API and the modern hook-class system introduced in Moodle 4.4, so it tracks Moodle's official compatibility schedule. ### How does the SSO work? Is it secure? Cubite issues a signed JWT (HMAC-SHA256) with a 60-second expiry. The student's browser redirects to your Moodle's auth_cubite endpoint, which validates the signature, finds or creates the user by email, and calls Moodle's standard complete_user_login() to set the session cookie. The student lands inside the course in 1-2 seconds. There are no shared passwords, no plaintext credentials, and tokens can't be replayed past 60 seconds. Cubite is the only identity authority. ### Can I use my own domain? Yes. Run your storefront on courses.your-brand.com or any custom domain. Cubite handles SSL, sitemaps, and canonical URLs. The Moodle plugin auto-detects your storefront URL from the SSO token, so multi-tenant deployments work out of the box. ### Does Cubite support recurring subscriptions? Not yet. Today, Cubite handles one-time course purchases and bundles via Stripe. Recurring subscriptions and B2B seat licensing are on the roadmap. If you need either today, [talk to us first](mailto:hello@cubite.io) — we'll give you a straight answer about timeline. For one-time course sales, payment plans, or course bundles, you're set. ### Will syncing courses overwrite my marketing copy? No. After the initial pull, Cubite's course content is yours to edit. Re-syncs add new Moodle courses without touching the descriptions, hero images, or SEO fields you've already polished. This is a deliberate fix for the most common Edwiser Bridge complaint. You can also unlink any Cubite course from Moodle, so you can sell bundles, pre-launches, or non-LMS products through the same storefront. ### What happens if I want to leave Cubite? Your Moodle is untouched — all student data, course content, and progress stays where it lives. You uninstall the auth_cubite plugin and you're back to a standalone Moodle. Cubite's storefront content (course copy, blog posts, marketing pages) is exportable. We don't lock you in. The price is $240 once because we want you to use the product, not because we want you trapped in a contract. --- # Introducing bunny-xblock: Open edX Modern Video Pipeline https://cubite.io/blogs/open-edx-bunny-xblock-modern-video-pipeline **By:** Amir Tadrisi **Updated:** 2026-10-01 The Open edX Bunny XBlock closes the 5-year video-pipeline gap with Studio-native upload, token auth, and Bunny.net Stream underneath. # Introducing bunny-xblock: Open edX Finally Has a Modern Video Pipeline Again Open edX has been without a first-party video pipeline since September 2020, when VEDA - the original edx-video-pipeline - was [deprecated via DEPR-107](https://discuss.openedx.org/t/deprecation-removal-veda-depr-107/3025). For five years, self-hosted operators have lived in a workaround zone: unlisted YouTube embeds, Vimeo iframes, custom S3 pipelines, or generic embed XBlocks that don't actually upload anything. Today we're releasing the [Open edX Bunny XBlock](https://github.com/amirtds/bunny-xblock) - an open-source XBlock that turns Open edX Studio into a Studio-native video pipeline again. Drop a file into a unit. Watch the upload stream directly to Bunny.net Stream, transcode, and come back with a signed, hotlink-protected player. No YouTube. No copy-paste iframes. No bespoke S3 plumbing. This article walks through what's in v0.1.0, what's not, how it installs in two Tutor commands, and the honest production-readiness story. By the end you'll know whether to install it tomorrow, contribute to it, or watch from the sidelines. --- ## Open edX Has Been Without a Real Video Pipeline for 5 Years Here's the part most operators have forgotten or never knew. Open edX once had a real video encoding pipeline - VEDA (edx-video-pipeline). It transcoded uploads, pushed to multiple delivery targets, and integrated with Studio. Then in 2020, the edX team [filed DEPR-107](https://discuss.openedx.org/t/deprecation-removal-veda-depr-107/3025) and planned its removal after September 25, 2020. The repository now lives under edx-unsupported/edx-video-pipeline - archived, untouched. No first-party community replacement ever shipped. Studio still has a "Video Uploads" tab, but if you read the [official documentation](https://edx.readthedocs.io/projects/edx-partner-course-staff/en/latest/video/upload_video.html) carefully, the workflow ends with files being "transferred to multiple hosting services (YouTube CMS and Amazon AWS)" — that's edX.org's hosted infrastructure. Self-hosted operators don't get that pipeline. They get an upload tab pointing at services they don't have. The practical result, for half a decade: every self-hosted Open edX team has been improvising. That's the gap bunny-xblock closes: a community-maintained VEDA replacement for Open edX with a Studio-native upload workflow. --- ## What Operators Have Been Doing Instead (And Why It Hurts) If you've run a self-hosted Open edX instance for any length of time, you've probably tried one of these. Each one is a workaround, not a solution. | Approach | Setup cost | Security | Studio-native upload | Analytics | Vendor risk | | --- | --- | --- | --- | --- | --- | | YouTube unlisted embed | Zero | None (no DRM, public-ish URLs) | No — paste a URL | None | Brand bleed, ads, recommendation hijack | | Vimeo iframe | Low | Limited | No — paste a URL | Vimeo's, not edX | Bending Spoons acquisition + Jan 2026 layoffs | | Custom S3 + bespoke XBlock | High | Whatever you build | Yes (if you build it) | Whatever you build | None — but you maintain it | | bunny-xblock | Two Tutor commands | Token auth + Bunny's DRM stack | Yes — drag-and-drop in Studio | Custom (events don't fire in v0.1.0) | Single vendor (Bunny) | A few honest reads: YouTube unlisted is what most courses ship with, and it's the worst option for paid or professional content. No DRM, ad/brand risk, and unlisted URLs leak the second a learner shares them. Custom S3 setups work, but every team reinvents the wheel. We've watched five different Cubite customers build five subtly different S3 + ffmpeg + custom-XBlock pipelines. That's exactly the duplication an open-source XBlock is supposed to end. --- ## What bunny-xblock Actually Ships (v0.1.0) — And What Bunny Adds Underneath This is the most important section. The positioning of this project depends on being precise: the XBlock ships the bridge. Bunny Stream ships the platform features underneath. Conflating them oversells what we built and undersells what you get. In the XBlock: - Direct TUS upload to Bunny — Studio uploads stream through the browser straight to Bunny via the [TUS resumable upload protocol](https://tus.io/). The LMS server never sees the bytes. A 2GB lecture file over slow WiFi survives a flaky connection. - Real-time upload progress — visual progress indicators in the Studio editor while a file is climbing toward Bunny. - Encoding-status webhooks — Bunny calls back to your LMS when transcoding finishes. Studio shows "Processing on Bunny…" → "Ready" without manual refresh. - Token authentication — every embed URL is SHA256-signed with a 6-hour TTL. Every upload signature is short-lived (1-hour TTL). External requests to the iframe URL get a 401. - Fernet-encrypted credential storage — Bunny library ID, API key, security key, and CDN hostname are stored encrypted in the database, with the key derived from Django's SECRET_KEY via HKDF. - Auto-generated thumbnails — Bunny generates a poster image during transcode; the XBlock uses it as a click-to-load preview, lazy-loading the video iframe on user intent. - Signed iframe playback with HLS fallback — vanilla iframe rendering (which supports AirPlay) with HLS fallback for iOS Safari. - Studio replace / delete workflow — swap an existing video or remove it cleanly, with the Bunny-side asset cleaned up. From Bunny Stream (configured in the Bunny dashboard, applies automatically): - Adaptive bitrate HLS encoding — multiple resolutions, free, automatic. - MediaCage — Bunny's free baseline anti-download DRM that blocks naive scraping and most screen-recorder tooling. See [Bunny's MediaCage docs](https://bunny.net/stream/media-cage-video-content-protection/). - Enterprise multi-DRM — Widevine, FairPlay, PlayReady for premium or regulated content. - Domain allowlist / referrer restrictions — via Bunny's pull-zone hotlink-protection settings ([Bunny security options](https://support.bunny.net/hc/en-us/articles/4414548058258)). - AI-generated captions / transcription — Bunny Stream produces VTT/SRT files attached to videos. - Video chapters — configured in the Bunny dashboard, surfaced in the Bunny player. - Dynamic watermarking — overlays the learner's identifier as a forensic deterrent (premium plans). - Global delivery — 119 PoPs, 250 Tbps backbone, $0.005/GB delivery, $0.01/GB storage, free encoding ([bunny.net/stream](https://bunny.net/stream/)). --- ## How It Looks in Studio and for Learners The point of "Studio-native" is that the workflow disappears. Course authors don't think about upload pipelines; they think about lessons. Course author flow (Studio): - Create a library in Bunny and activate authentication - Setup the bunny credentials in the Open edX Django Admin - Add a Bunny Video component to a unit (after enabling bunny_video in Advanced Module List — one-time). - Drag a file onto the component. Progress bar fills in real time as bytes stream directly to Bunny. - Status shows "Processing on Bunny…" — encoding runs while you continue editing other components. - Status flips to "Ready". The signed player appears in the preview pane. Learner flow: 1. Lesson page loads with a click-to-load poster image (auto-generated thumbnail). No iframe loads yet — no third-party requests until the learner taps play. 2. Click → signed iframe loads → HLS adaptive playback begins. The signed URL expires after 6 hours; any attempt to embed the iframe outside the LMS returns 401. --- ## How to Install bunny-xblock on Your Open edX Instance If your deployment runs on Tutor, installation is two commands. No fork edits, no INSTALLED_APPS changes, no environment-file surgery. Step 1 — Add the XBlock to Tutor's pip requirements: tutor config save --append OPENEDX_EXTRA_PIP_REQUIREMENTS=xblock-bunny Step 2 — Launch: tutor local launch Step 3 — Configure Bunny credentials at https://your-lms-domain/admin/xblock_bunny/bunnyconfiguration/. You'll need: - Library ID — from your Bunny Stream library - API Key — from Bunny account settings - Security Key — for Token Authentication (enable it in Bunny first) - CDN Hostname — your Bunny Pull Zone URL Step 4 — Enable the block in Studio: Settings → Advanced Settings → add bunny_video to the Advanced Module List. Save. Step 5 — Register the webhook in your Bunny dashboard, pointing at your LMS webhook URL (the format is documented in the [repository README](https://github.com/amirtds/bunny-xblock)). This is what flips Studio status from "Processing" to "Ready" automatically. Step 6 — Smoke test. Create a course unit, add a Bunny Video component, upload a 30-second test clip, verify: - Upload progress fills in Studio - Encoding status transitions to Ready within a couple minutes - Signed iframe renders on the learner-facing page - A direct curl of the iframe URL from an unauthorized origin returns 401 Compatibility today: Sumac, Teak, Ulmo. Tutor 19.x through 21.x. Python 3.11. Django 4.2 LTS. [Verawood](https://cubite.io/blogs/open-edx-verawood-features) is not tested yet: Verawood.1 shipped on July 30, 2026, and the tested releases are still Sumac, Teak and Ulmo. We'll re-verify on Verawood and tag a compatible release before listing it as supported. --- ## The Bottom Line Five years is a long time for a learning platform to be without a native video pipeline. The Open edX Bunny XBlock closes that gap with Studio-native upload, signed-URL playback, and a clean delegation to Bunny.net Stream for everything underneath — DRM, captions, chapters, allowlists, global delivery. The shape of the project is intentional: - The XBlock ships the bridge. Apache-2.0, public repo, two-command Tutor install. - Bunny ships the platform. Every Bunny Stream feature is one dashboard toggle away. - Cubite ships the integration — for teams that would rather not own this surface, we install, configure, and support the whole pipeline on managed Open edX hosting. If you've been improvising with YouTube embeds or maintaining a custom S3 pipeline, the cost of trying this is two Tutor commands and a 30-second test clip. The cost of not trying it is another year of improvising. --- # What Is Open edX? The Open-Source LMS for 100M+ Learners https://cubite.io/blogs/what-is-open-edx **By:** Amir Tadrisi **Updated:** 2026-10-01 Open edX is the free, open-source LMS built by Harvard and MIT. Here's what it does, who uses it, what it costs, and how it compares to Moodle in 2026. Over 100 million learners have taken a course delivered through Open edX. It runs at Harvard, MIT, Google, Microsoft, NASA, and the International Monetary Fund. And the entire platform is free to download. If you're evaluating a learning management system (LMS) and someone has mentioned Open edX, you've probably hit the same wall most people do: the project's own site is marketing-heavy, the architecture docs are written for engineers, and the ranking blog posts are mostly written by hosting vendors trying to sell you something. This guide is different. We've been deploying Open edX for years at [Cubite](https://cubite.io/), and we'll tell you what it actually is, what it actually costs, and — critically — when you should not use it. By the end you'll know whether Open edX is the right LMS for your organization, or whether Moodle, Canvas, or a custom build is a better fit. **Want Open edX without running it yourself?** Cubite operates managed, self-hosted Open edX from $1,260/mo, all-in and load-tested to 1,000 concurrent learners, with SSO, SCORM, xAPI, LTI, branding, and cloud resources included. See what is covered on [managed Open edX hosting](https://cubite.io/services/managed-open-edx). --- ## What Is Open edX? (The Short Answer) Open edX is a free, open-source learning platform originally built by Harvard and MIT in 2012 to power edX.org. Today, stewarded by the nonprofit Axim Collaborative, it powers 380+ websites and has reached over 100 million learners worldwide. Organizations download Open edX, host it on their own infrastructure, and use it to deliver online courses, training, and credentials at scale. A clarification that trips up a lot of people: edX (edx.org) and Open edX are not the same thing. - edX.org is a consumer-facing course marketplace where individuals enroll in courses from universities. It's currently owned by 2U / Outcomes-University. - Open edX is the open-source software that powers edX.org — and 380+ other independent sites built by universities, governments, and enterprises. You can download it and run your own version on your own domain, completely separate from edX.org. When this article says "Open edX," it means the software, not the consumer site. --- ## A Brief History — From Harvard & MIT to Axim Collaborative Open edX has an unusual lineage for a piece of enterprise software. - 2012 - Harvard and MIT jointly launch edX as a nonprofit, with the platform open-sourced from day one under AGPL/Apache licenses. - 2013 - The Open edX project goes public, and other universities and companies start self-hosting it. - 2021 - 2U, a publicly traded edtech company, acquires edX (the consumer site and brand) for ~$800 million. - 2022 - Axim Collaborative is founded as a nonprofit, funded by the proceeds of the 2U acquisition, to steward Open edX (the software) independently of the now-commercial edX brand. - 2024 - 2U files for Chapter 11 bankruptcy reorganization. The edX consumer site continues under restructured ownership; Open edX itself remains unaffected, governed by Axim and a global community of contributors. The takeaway: the software you'd be adopting is older, more battle-tested, and more independently governed than most commercial LMS products on the market. (See the [Wikipedia article on Open edX](https://en.wikipedia.org/wiki/Open_edX) for a fuller timeline.) Quick Check: edX or Open edX? Before going deeper, make sure the most common mix-up is settled. --- ## How Open edX Works — Core Architecture (in Plain English) You don't need to be an engineer to evaluate Open edX, but you do need a basic mental model. Here's the whole thing in five sentences. Open edX has two main pieces: Studio: where instructors build courses LMS: where learners take them. Both run on a shared backend written in Python (Django) with React-based front-ends. Course content lives in MongoDB; learner progress lives in MySQL; background tasks run on Redis and Celery; search is powered by Elasticsearch. Native iOS and Android apps let learners download content for offline use. And every piece of course content — every video, problem, simulation, or interactive lab — is built from a reusable component called an XBlock. The XBlock is the part most people miss, and it's the part that makes Open edX genuinely different. ### XBlocks — the Lego bricks of an Open edX course An XBlock is a self-contained, reusable unit of course content. The platform ships with built-in XBlocks for video, multiple choice, drag-and-drop, peer assessment, open response (essays graded by AI or peers), discussion, and dozens more. Anyone can write a custom XBlock — interactive coding labs, virtual chemistry simulations, branching scenarios, video annotation tools — and drop it into any Open edX course on any Open edX site. The [XBlock framework on GitHub](https://github.com/openedx/XBlock) is what enables the platform's signature ability: rich, interactive, course-native content that doesn't exist on most competing LMS platforms. --- ## What Can You Build with Open edX? Key Features Open edX is one of the few open-source LMS platforms where the feature list isn't aspirational — most of what's listed below ships in the core distribution and is used in production today. Course authoring & content - Studio — drag-and-drop course authoring with full XBlock library - 30+ built-in problem types (multiple choice, drag-drop, peer assessment, open response, custom Python graders) - Native video player with transcripts, captions, speed control, and analytics - Cohorts, gating, prerequisites, and adaptive release rules - Course import/export for portability Learning experience - Web LMS plus native iOS and Android apps with offline content download - Discussion forums (rebuilt in Python as of the Sumac release; rolled out in Teak) - Certificates and digital credentials, including [Accredible integration](https://docs.openedx.org/en/latest/community/release_notes/teak.html) (added in Teak, June 2025) - Programs, learning paths, and stackable micro-credentials Integration & extension - LTI Advantage Complete certified (2025) — connects with thousands of third-party tools - Single sign-on (SAML, OAuth, custom) - REST and GraphQL APIs - Custom XBlocks for any interactive content type Analytics & operations - Aspects — the new analytics layer with the Course Comparison Dashboard introduced in Sumac (December 2024) - Multi-tenancy / multi-site support - Full data export — your learner data lives in your databases, not a vendor's --- ## Who Uses Open edX? Adoption at Global Scale Open edX isn't a niche project. It's the infrastructure behind some of the largest online learning programs in the world. - 100 million+ learners have engaged with content delivered through Open edX (per the [Open edX community blog](https://openedx.org/blog/open-edx-community-reaching-100-million-learners-and-driving-global-impact/), 2024). - 380+ live websites worldwide run on the platform. - edX.org alone has surpassed [110 million total enrollments](https://press.edx.org/edx-passes-110-million-total-global-enrollments-up-29-million-year-over-year) (2024). Universities running Open edX include: Harvard, MIT, Stanford, Arizona State, University of Texas, Cornell, Caltech, Georgia Tech, NYU, and Duke. Enterprises running Open edX include: Google, Microsoft, McKinsey, Johnson & Johnson, and NASA — primarily for employee education, customer training, and partner certification. Government and NGO deployments include: The International Monetary Fund (online economics and finance training) and Tenaris (corporate education). To put that in market context: the global LMS market was estimated at USD 28.58 billion in 2025 and is projected to reach USD 123.78 billion by 2033 at a 20.2% CAGR, [according to Grand View Research](https://www.grandviewresearch.com/industry-analysis/learning-management-systems-market). Open edX's share of that market is concentrated where it matters — large-scale, structured online programs at institutions that can't afford lock-in. --- ## The Latest Open edX Releases: Verawood and What's Next Open edX ships a named community release roughly every six months. If you're evaluating the platform in 2026, these are the releases that matter. | Release | Date | Headline features | | --- | --- | --- | | Sumac (19th) | December 2024 | New Content Libraries with problem-bank randomization, search, filter, and tagging; Frontend "Slots" for plug-in UI customization; Aspects Course Comparison Dashboard; expanded LTI 1.3 support | | Teak (20th) | June 2025 | MFEs upgraded to React 18; new Python-based forums replacing the legacy Ruby comments service; Accredible integration for credential badges | | Ulmo (21st) | January 2026 | Course Home Carousel (resume-where-you-left-off); first unified authorization model (starting with Content Libraries); pip replaced with `uv` for 2–5× faster Docker builds; redesigned course catalog; reusable LTI configurations; new design tokens for theming | | Verawood (22nd) | July 2026 | Rebuilt Instructor Dashboard; more granular team management in Studio; new Studio sidebar; easier content tagging and taxonomy management; LTI Advantage Complete certification | Dates are each release's first tagged version (Sumac.1, Teak.1, Ulmo.1 and Verawood.1) in the [Open edX release table](https://docs.openedx.org/en/latest/community/release_notes/named_release_branches_and_tags.html), checked October 1, 2026. Only the latest release is supported, so Verawood is the one supported release; the next, Willow, is targeted for mid-to-late February 2027 after a [delay announced on August 27, 2026](https://discuss.openedx.org/t/willow-release-delay/19461). The reason this matters for an evaluation: an LMS that ships meaningful releases every six months is one being actively developed. Many "alternatives" you'll see compared to Open edX have not had a similar release cadence — and a few have not had a major release in over a year. A particularly underrated milestone: Open edX is now LTI Advantage Complete certified (re-confirmed in Ulmo), meaning it can plug into virtually any modern educational tool ecosystem on standards-based authentication and grade passback. The Ulmo release also delivered the first piece of a long-promised unified authorization model — a quiet but important architectural improvement for organizations running multi-tenant or multi-team deployments. --- ## Open edX Pricing — What Does It Actually Cost? Open edX pricing is unusual: the software costs $0. The Open edX platform — running, in production, for real users — does not. Here's the honest breakdown. | Cost component | Self-hosted | Managed hosting | | --- | --- | --- | | Software license | $0 | $0 | | Cloud infrastructure | $100 – $2,000+/mo | Included | | DevOps engineering | 0.25 – 1 FTE ($30K – $200K/yr) | Included | | Upgrades (every ~6 months) | 1 – 3 weeks of engineering time per release | Included | | Custom development | Project-based ($1K – $20K+) | Project-based | | Typical all-in monthly cost | $200 – $2K+/mo at modest scale | $200 – $2,000+/mo | A few things to notice: 1. "Free" software ≠ free platform. Most organizations underestimate the DevOps cost of running Open edX themselves. 2. Managed hosting is usually cheaper than self-hosting for organizations under ~50,000 active learners, because you're sharing one team's expertise across many customers. 3. Custom XBlock or theme development is project-based — and is where most of the variability in budgets comes from. --- ## How to Get Started with Open edX You have three realistic paths. 1. Self-host with Tutor. [Tutor](https://docs.tutor.edly.io/) is the official Docker-based Open edX distribution. It runs on any 64-bit UNIX system (and Windows via WSL2), supports AMD64 and ARM64, and requires Docker Compose v2 plus 4–5 GB of RAM allocated to the Docker daemon. This path is right if you have in-house DevOps capacity and want full control. Plan for ongoing maintenance — Open edX ships a major release every six months and you'll need to keep up. 2. Use a managed hosting partner. [Open edX managed hosting](https://cubite.io/services/custom-lms) providers — Cubite, Edly, eduNEXT, Raccoon Gang, Appsembler — will host, maintain, and upgrade the platform for you. This path is right for most organizations under ~50,000 learners, especially when DevOps isn't your core competency. You still own your data; you don't own the operational headache. 3. Hire a custom development partner. If you need significant customization — a custom theme, custom XBlocks, deep SSO integration, a multi-tenant architecture — a development partner will scope and build to your spec, then either hand it back to you or operate it on your behalf. --- ## Frequently Asked Questions ### What is Open edX? Open edX is a free, open-source learning platform originally created by Harvard and MIT in 2012 to power edX.org. Today, stewarded by the nonprofit Axim Collaborative, it powers 380+ websites and has reached over 100 million learners worldwide. Organizations self-host it to deliver online courses at scale. It's used by universities (Harvard, MIT, Stanford, ASU), enterprises (Google, Microsoft, McKinsey, Johnson & Johnson, NASA), and governments (IMF). Because it's open-source, organizations have full control over their data, infrastructure, and customization — none of which is true with proprietary cloud LMS products. ### Is Open edX free? Open edX itself is free — there are no license fees because it's released under open-source licenses (AGPL/Apache). However, organizations pay for hosting infrastructure, DevOps maintenance, customization, and any commercial support. Most adopters work with managed hosting partners to avoid running it themselves. A reasonable mental model: the software is free; the platform costs roughly what any production web application costs to operate — somewhere between $200/month (managed, small scale) and $20,000+/month (self-hosted, enterprise scale). See the cost section above for a fuller breakdown. ### What's the difference between edX and Open edX? edX (edx.org) is a consumer-facing online course marketplace currently owned by 2U / Outcomes-University. Open edX is the underlying open-source software that powers edX.org and 380+ other sites. Anyone can download Open edX and self-host their own learning platform — completely separate from edX.org's catalog or branding. Putting it differently: edX is one site built on Open edX. Your Open edX deployment is your site built on the same software. The two are independent — you don't need an edX.org account, partnership, or relationship to run Open edX. ### Who uses Open edX? Open edX is used by leading universities including Harvard, MIT, Stanford, Arizona State, NYU, and Duke, plus enterprises such as Google, Microsoft, McKinsey, Johnson & Johnson, and NASA. The International Monetary Fund and many governments also run training programs on the platform. It serves over 100 million learners globally. Adoption skews toward institutions running structured, scalable online programs — corporate training, MOOC-style cohorts, partner enablement, and certification programs. Smaller, classroom-first deployments are more often on Moodle or Canvas. ### Is Open edX better than Moodle? Neither is universally "better." Open edX excels at MOOC-style, large-scale, structured online courses with rich interactive components via XBlocks. Moodle excels at traditional classroom and blended learning with simpler setup and a larger plugin library. Open edX requires more DevOps expertise; Moodle runs on standard shared hosting. The right question is "which fits your use case?" If you're delivering scaled online programs with custom interactive content, Open edX. If you're running a school or training department with limited DevOps and a need for the broadest plugin marketplace, Moodle. See the comparison table above for a full breakdown. ### How much does Open edX cost to run? The software is free, but real-world costs come from hosting (cloud infrastructure), DevOps engineering, ongoing maintenance and upgrades, and any custom development. Self-hosted setups typically run from a few hundred to several thousand dollars per month depending on scale. Managed hosting providers offer all-inclusive plans starting around $200–$500/month. ### What is the latest Open edX release? As of October 1, 2026, the current Open edX release is Verawood, the 22nd community release: Verawood.1 shipped on July 30, 2026 with a rebuilt Instructor Dashboard, more granular team management in Studio and a new Studio sidebar. Ulmo (January 2026), Teak (June 2025) and Sumac (December 2024) are no longer supported. The next release, Willow, is targeted for mid-to-late February 2027. Open edX ships a named release approximately every six months, and only the latest one is supported: the [Open edX documentation](https://docs.openedx.org/en/latest/community/release_notes/named_release_branches_and_tags.html) says the community does not currently have the ability to support more than one release at a time. A deployment that stays one or two releases behind is therefore running an unsupported release. --- ## Bringing It Together Open edX is the open-source LMS for organizations that need scale, rich interactive content, and full data ownership — and that can accept higher operational complexity than Moodle in exchange. Choose Open edX if you need: - Online programs at scale (thousands to millions of learners) - Custom interactive content (labs, simulations, code editors, branching scenarios) - Full data ownership and freedom from SaaS lock-in - Standards-based interoperability (LTI Advantage Complete) - Long-term institutional viability backed by a real nonprofit foundation Choose something else if you need: - The fastest possible setup with the lowest technical overhead → Moodle - Best-in-class classroom UX in K-12 or higher-ed → Canvas - A small training operation that doesn't justify the operational footprint → Moodle or a SaaS LMS --- # LearnDash Self-Hosted vs SaaS: The Honest 2026 Breakdown https://cubite.io/blogs/learndash-self-hosted-vs-saas **By:** Amir Tadrisi **Updated:** 2026-10-01 LearnDash self-hosted vs SaaS (StellarSites Learning) after the StellarWP dissolution: real Year-1 costs, real risks, and the enterprise L&D alternative. # LearnDash Self-Hosted vs SaaS: The 2026 Breakdown > **DANGER:** After the April 2026 StellarWP dissolution, the LearnDash decision is no longer "which flavor of LearnDash." It's "should you buy LearnDash at all?" Here's the math, the risk, and the alternative built for enterprise. On April 22, 2026, Liquid Web confirmed that StellarWP — LearnDash's parent brand — has been dissolved. The learndash.com domain now redirects to liquidweb.com. The Product Owner was laid off five months earlier, in a round of cuts that removed roughly 25% of the team. There is no public roadmap. If you're an enterprise L&D leader still being pitched LearnDash self-hosted vs SaaS as if it's a normal feature decision, this article is for you. We'll reproduce the comparison honestly — pricing, lock-in, ops burden — and then show why both paths share the same strategic risk, and what to evaluate instead. **Where Cubite fits this decision:** Cubite sells Cubite LMS and publishes this comparison. If the SaaS path wins for you, Cubite is a fully hosted LMS at a flat $290/mo ($2,900/yr billed annually) - no server to run and no plugin stack to patch. SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. To see the real effort and cost of moving your specific site, start with a free [LearnDash migration assessment](https://cubite.io/learndash-migration). --- ## The Decision in 90 Seconds **TL;DR** - Both LearnDash paths share the same platform-extinction risk - At list price, SaaS is only $0–$50/year more than self-hosted. - Add a maintenance retainer and self-hosted becomes more expensive than SaaS - Neither path meets enterprise L&D needs natively. - For enterprise buyers, the strategic question changed **Why it matters:** It's no longer self-hosted vs SaaS. It's LearnDash vs purpose-built --- ## What Just Happened to LearnDash (Vendor Timeline) You can't evaluate LearnDash self-hosted vs SaaS without understanding what both paths now sit on top of. The vendor story matters more than the feature comparison. March 2025. StellarWP cut roughly 5% of staff, concentrated in development and marketing. October–November 2025. A deeper round. Roughly 36 people — a quarter of the remaining team — were let go. Among them: Taylor Walden, LearnDash's Product Owner since April 2024, and Ben Meredith, GiveWP's Director of Customer Service. KadenceWP's founder Benjamin Ritner had already left; GiveWP co-founder Matt Cromwell gave notice. April 22, 2026. Liquid Web officially dissolves StellarWP. The plugin portfolio collapses to four surviving products under "Liquid Web by Nexcess." learndash.com, kadencewp.com, and givewp.com all begin redirecting to liquidweb.com. April 2027. Liquid Web's stated end of security patches for retired and sunset features. The core plugin continues to ship — but on what cadence, by whom, against which roadmap, has not been published. The track record matters too. StellarWP previously discontinued MemberDash, SolidWP, Iconic, and Restrict Content Pro. Whether LearnDash gets that treatment isn't a question anyone outside Liquid Web can answer right now. The point is that nothing about the past 13 months would let a procurement team estimate the probability honestly. --- ## The Side-by-Side: LearnDash Self-Hosted vs SaaS Both paths run the same LearnDash plugin code. What differs is who owns the WordPress stack underneath, who pays for what, and how easy it is to leave. | | Self-Hosted | SaaS (StellarSites Learning) | | --- | --- | --- | | What it is | Buy a plugin license, run on your own WordPress hosting | Liquid Web managed bundle (hosting + LMS + extras) | | Hosting choice | You pick any WP host | Locked to Nexcess / Liquid Web | | Control | Full server access | Managed — limited customization | | Ops burden | You handle updates, backups, security | Bundled | | Lock-in | Low (portable WP site) | High (full migration to leave) | | Year 1 cost | ~$470–$650 | ~$487–$607 | | Implementation time | 2–3 weeks | 1.5–2 weeks | --- ## The Real Cost: Self-Hosted LearnDash pricing in 2026 isn't a single number. Self-hosted LearnDash isn't "buy the license, install, done" — it's a stack of paid components plus ongoing operational work. Here's the honest Year-1 line-item view. | Line item | Cost (USD/yr) | | --- | --- | | LearnDash Essentials license | $259 | | WordPress shared hosting | $60–$120 | | WooNinjas Monetization add-on (per-module sales) | $79 | | Domain (.com) | $12–$15 | | Bunny.net Stream (pay-as-you-go video CDN) | $60–$180 | | DataFast / PayPhone plugin | Free | | Bunny.net WP plugin | Free | | **Total** | **$470–$653** | So far, so reasonable. But this stack only stays at $470–$650 if a human inside your organization is doing the operations work for free. That includes: - Plugin updates and regression testing — every WordPress core release, every PHP version bump, every plugin patch needs to be tested against the LearnDash + WooCommerce + WooNinjas + Bunny + analytics chain - Backups and disaster recovery — most shared hosts have weak backup policies; you need your own - Security monitoring — see the next section on why this is a much bigger commitment than it sounds - Performance scaling — shared hosting struggles the moment video traffic spikes The realistic option for a non-technical operator is a WordPress maintenance retainer. Market rate runs $50–$150 per month, or $600–$1,800 per year. Add that, and your Year-1 total lands at $1,070–$2,450. That's the number that matters for the comparison. --- ## The Real Cost: SaaS (StellarSites Learning) Before April 2026, this comparison was known as "LearnDash Cloud vs plugin." The plugin side hasn't moved — it's still the same self-hosted license. The Cloud side was renamed. In 2026, Liquid Web rebranded LearnDash Cloud as StellarSites Learning, and the Starter / Growth / Pro tiers became Essential / Plus / Ultimate at the same monthly price points: $29, $55, $79. | Line item | Cost (USD/yr) | | --- | --- | | StellarSites Learning Essential ($29/mo annual) | $348 | | — includes LearnDash + hosting + domain + SSL + backups + AI tools | — | | WooNinjas Monetization add-on | $79 | | Bunny.net Stream (video CDN) | $60–$180 | | DataFast / PayPhone plugin | Free | | **Total** | **$487–$607** | The bundle is operationally simpler. The price is roughly cost-parity with self-hosted at list. The catch is on the back end of the relationship: lock-in severity is critical. Your domain, hosting, billing, and login are all inside Liquid Web's ecosystem. Leaving means a full migration of every layer of the stack, not just exporting a database. Renewal pricing is also exposed. Liquid Web just consolidated its hosting tiers as part of the StellarWP dissolution. Expect more pricing actions — that's the standard pattern when a hosting parent absorbs a SaaS bundle. --- ## The Honest Math (Year 1 + Year 2+) This is the table most LearnDash comparison articles never publish: | Scenario | Year 1 | Year 2+ | Risk Level | | --- | --- | --- | --- | | Self-Hosted (no retainer) | $470–$650 | $410–$590 | Critical | | Self-Hosted + maintenance retainer | $1,070–$2,450 | $1,010–$2,390 | High | | SaaS (StellarSites Essential) | $487–$607 | $487–$607 | High | | SaaS + maintenance retainer | $487–$1,200 | $487–$1,200 | High | The only scenario where self-hosted is cheaper is the first row — and that row assumes someone inside your organization absorbs the ops work at zero cost. For an enterprise L&D buyer, that assumption is never true. Internal ops time is the most expensive time you have. --- ## Shared Risks - What Both Paths Carry The self-hosted vs SaaS choice is operational, not strategic. Both paths inherit the same vendor risk and most of the same technical risk. ### Vendor and ecosystem risks | # | Risk | Severity | | --- | --- | --- | | 1 | LearnDash brand dissolved April 22, 2026 — learndash.com redirects to liquidweb.com | Critical | | 2 | Product Owner laid off November 2025; ~25% of StellarWP team cut | Critical | | 3 | No public roadmap; security patches for retired features only through April 2027 | High | | 4 | History of killing products (MemberDash, SolidWP, Iconic, RCP all discontinued) | High | | 5 | Per-module sales depends on a single-developer 3rd-party add-on (WooNinjas) | High | | 6 | Liquid Web is a hosting company — its incentive is infrastructure retention, not LMS quality | Medium | ### Technical and operational risks | # | Risk | Severity | | --- | --- | --- | | 7 | 5 plugins from 4 vendors in the checkout chain — fragile | High | | 8 | WordPress update tax — core/PHP releases can break the chain | High | | 9 | Anti-piracy is manual config in the Bunny dashboard — not native to LearnDash | High | | 10 | Payment success does not equal access granted (add-on can fail silently) | Medium | | 11 | No native multi-tenant — multiple branded academies = multiple WP installs | Medium | | 12 | WordPress sprawl — themes, builders, conflicting plugins accrete over time | Medium | ### The WordPress security exposure (self-hosted only, but worth understanding) Self-hosted LearnDash inherits WordPress's full risk profile. The 2026 numbers, from [Patchstack's State of WordPress Security whitepaper](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/), are not subtle: - 11,334 vulnerabilities disclosed across the WordPress ecosystem in 2025 — up 42% year over year - 91% of those vulnerabilities live in plugins, not in WordPress core - More high-severity vulnerabilities disclosed in 2025 than in the previous two years combined - 13,000 WordPress sites are hacked daily; median time-to-exploit after disclosure is 5 hours - 55% of WordPress breaches trace back to compromised plugins - 43% of vulnerabilities are exploitable without any authentication - 52% of plugin developers do not patch before public disclosure — meaning more than half of WordPress plugins leave their users exposed at the moment a vulnerability becomes public - Traditional Web Application Firewalls block only 12% of WordPress-specific attacks Recent LMS-adjacent examples: Tutor LMS had a [high-risk SQL injection vulnerability (CVE-2025-58993)](https://www.safetybis.com/blog/september-wordpress-vulnerability/) patched in version 3.8.0. User Registration & Membership had a SQL injection vulnerability (CVE-2025-9085) patched in version 4.4.0. In October 2025, more than [150,000 WordPress sites](https://sqmagazine.co.uk/wordpress-plugin-vulnerabilities-october/) were exposed by flaws in popular plugins. If you run self-hosted LearnDash, you are responsible for catching every one of those patches inside the five-hour window before exploit code hits the wild. SaaS shifts that responsibility to Liquid Web — which solves the patching problem but not the platform-extinction problem. --- ## Self-Hosted-Only Risks | # | Disadvantage | Impact | | --- | --- | --- | | 13 | Security is the client's problem — WordPress is the #1 attacked CMS | Critical | | 14 | Backups are the client's problem — cheap hosting often has weak policies | High | | 15 | Plugin updates are the client's problem — manual testing or $50–$150/mo retainer | High | | 16 | Performance scaling — shared hosting struggles with video traffic | Medium | The hidden cost of #15 is the one that flips the comparison. Add a maintenance retainer of $600–$1,800/yr and self-hosted is more expensive than SaaS for every realistic profile. What enterprise L&D buyers chronically underestimate is the testing cycle. Every WordPress core release, every PHP version bump, and every plugin patch needs to be regression-tested against the full LearnDash + WooCommerce + WooNinjas + Bunny.net + analytics chain before it touches production. A single broken interaction between two plugins after a security patch can take a course offline for days — and the patch window, per Patchstack, is five hours. That's not "developer hobby" work; it's a real ops function with a real headcount cost. --- ## SaaS-Only Risks | # | Disadvantage | Impact | | --- | --- | --- | | 17 | Total lock-in to Liquid Web — domain, hosting, billing, login all in their ecosystem | Critical | | 18 | No SSH / no full server access — customizations limited | High | | 19 | Pricing exposure — Liquid Web can raise renewal prices (just did a 4-tier consolidation) | High | | 20 | No version control — you get the LearnDash version Liquid Web ships | Medium | | 21 | The bundle itself could be sunset — StellarWP just was, in 4 weeks | Critical | Risk #21 is the one most buyers underweight. The same parent company that just dissolved a $multi-million plugin portfolio in 4 weeks is now selling you a hosting bundle. That is the same incentive structure with the same actor. --- ## When Each LearnDash Path Makes Sense (and When Neither Does) Honest version: | Client profile | Best choice | | --- | --- | | Has dedicated tech ops staff, values portability | Self-Hosted | | Solo operator, no tech ops, "just works" expectation | SaaS | | Cares about long-term platform stability | Neither — risk too high | | Cares about video piracy protection | Neither — anti-piracy is not native to LearnDash | | Needs multi-tenant / branded academies | Neither — not built for it | | Enterprise L&D (SSO, SCORM, compliance) | Neither — see next section | For a solo course creator selling three programs, StellarSites Learning is a fine launch pad. For an in-house WordPress team that wants control and accepts the platform risk, self-hosted is defensible. For everyone in the middle — and for every enterprise L&D operation — neither path is the right answer. --- ## The Enterprise L&D Reality Check The corporate Learning Management System market is growing fast. [Precedence Research estimates](https://www.precedenceresearch.com/corporate-learning-management-system-market) it at $14.49B in 2025, rising to $17.47B in 2026 and projected to reach $72.30B by 2034 — a 19.65% CAGR. North America holds 39% of that market. That growth has pulled enterprise L&D requirements up dramatically. Modern procurement teams are grading platforms against a checklist that looks nothing like the WordPress LMS feature set: - Identity Federation via SAML 2.0 or OIDC with native integration to Okta, Azure AD, Ping Identity ([industry consensus](https://disprz.ai/blog/enterprise-learning-management-guide)) - SCORM and xAPI compliance for third-party content compatibility ([ProProfs LMS Requirements Checklist](https://www.proprofstraining.com/blog/lms-requirements/)) - Multi-tenant architecture for serving employees, customers, and partners under different brands ([ProProfs Multi-Tenant LMS Guide](https://www.proprofstraining.com/blog/multi-tenant-lms/)) - SOC 2 Type II, ISO 27001, GDPR, FERPA compliance ([TechClass on LMS compliance](https://www.techclass.com/resources/learning-and-development-articles/5-security-features-your-compliance-lms-needs-to-satisfy-iso-and-soc-2-auditors)) - TLS 1.3 in transit, AES-256 at rest, with proper Key Management and tenant isolation - Audit logs, role-based access control, session monitoring Here's how LearnDash — either path — grades against that checklist: | Enterprise requirement | LearnDash Self-Hosted | LearnDash SaaS | Native to platform? | | --- | --- | --- | --- | | SAML 2.0 / OIDC SSO | Paid plugin add-on (miniOrange, WP SAML Auth) | Paid plugin add-on | No | | SCORM | Paid third-party add-on | Paid third-party add-on | No | | xAPI | Paid third-party add-on | Paid third-party add-on | No | | Multi-tenant academies | Not supported — requires multiple WP installs | Not supported | No | | SOC 2 Type II | Operator's responsibility | Liquid Web infra-level only | No | | FERPA / GDPR | Operator's responsibility | Operator's responsibility | No | | Audit logs | Paid plugin add-on | Limited | No | | Native SSO with Okta / Azure AD | Plugin sprawl required | Plugin sprawl required | No | | Cohort management | Paid add-on (LearnDash Groups) | Paid add-on | Partial | | Proctoring | Paid integration | Paid integration | No | Every checkbox is "no" or "paid plugin add-on." For an enterprise L&D buyer, that means every requirement adds another vendor to the dependency chain — and another item to the [Patchstack risk surface](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/) we covered earlier. --- ## The Cubite Alternative — Purpose-Built for Enterprise L&D This is where the LearnDash self-hosted vs SaaS comparison ends and the strategic question begins: if neither LearnDash path is the right answer for enterprise L&D, what is? When you are ready to move, here is exactly how to [migrate from LearnDash to Cubite without losing data](https://cubite.io/blogs/migrate-from-learndash-to-cubite). Cubite offers, Cubite LMS, a proprietary platform with AI course generation, adaptive tutoring, white-label academies, and native multi-tenant. Built for organizations that want a managed product without the footprint. | LearnDash risk or gap | Cubite answer | | --- | --- | | No native multi-tenant | Native multi-tenant across Cubite LMS | | Plugin sprawl (5 plugins, 4 vendors in checkout chain) | Single integrated platform — no chain to break, no add-on dependency on a single-dev shop | | WordPress security exposure (11,334 vulns/yr, 5-hour exploit window) | Purpose-built stack; SOC 2, GDPR, FERPA compliant; managed patching is included, not a retainer line item | | No native SSO | SSO with Google, GitHub or Facebook sign-in, included at $290 a month or $2,900 a year; SAML SSO and SCIM on the Enterprise plan | | No SCORM / xAPI native | Both natively supported in Cubite LMS | | Anti-piracy in vendor dashboard | Signed URLs and DRM-ready video pipeline managed by Cubite — not a Bunny.net config exercise | | Per-module sales via single-developer add-on (WooNinjas) | Native commerce + Stripe; Moodle Storefront for multi-channel selling | | Migration cost / time | Zero-downtime migration playbook with full mapping of LearnDash content types into Cubite LMS | | 7+ years operating; 160,000+ learners on managed platforms (e.g., Aquent Gymnasium); bilingual/multi-region deployment | — | --- ## Bottom Line + Decision Tree The choice between LearnDash self-hosted vs SaaS comes down to one question for a non-enterprise buyer, and a different question for an enterprise buyer. If you have zero tech ops and run a small course business, StellarSites Learning is the lowest-blast-radius path. You're trading lock-in for operational simplicity, and at small scale the trade is reasonable. If you have full WordPress ops staff and accept the platform risk consciously, self-hosted LearnDash is defensible — but only if you've budgeted the maintenance retainer honestly. If you're enterprise L&D, neither LearnDash path is the right answer. Evaluate Cubite LMS,which is built against the requirement set LearnDash never targeted. Both LearnDash paths buy you into a product whose vendor just dissolved its brand, laid off its product owner, and has no public roadmap. The difference between self-hosted and SaaS is operational, not strategic. If you are weighing a move, we compared [every LearnDash alternative in 2026](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide) side by side. --- ## Frequently Asked Questions ### What is the difference between LearnDash self-hosted and SaaS? LearnDash self-hosted is the WordPress plugin you install on your own host ($199/yr), giving full control and portability. LearnDash SaaS — now called StellarSites Learning — is Liquid Web's managed bundle ($29–$79/mo) that includes hosting, LearnDash, SSL, and backups. SaaS is faster to launch but locks you into Liquid Web's ecosystem. Both paths run the same LearnDash plugin code. The choice is about who owns the operational layer (you or Liquid Web) and what you're willing to trade for that. Year-1 costs are roughly equal at list price, but they diverge fast once you price in WordPress maintenance work. ### Is LearnDash still maintained in 2026? Yes: LearnDash 5.2.1 shipped on September 30, 2026, but its parent brand StellarWP was dissolved on April 22, 2026, and learndash.com now redirects to liquidweb.com. LearnDash is one of four products that survived the cuts. The Product Owner was laid off in November 2025, roughly 25% of staff was cut, and there is no public roadmap. The plugin still ships and receives security patches. For features that have been retired or sunset, Liquid Web has stated security patches will continue through April 2027. What happens beyond that, and on what cadence the core plugin gets new features, has not been published. The product exists. The roadmap doesn't. ### Is LearnDash Cloud the same as StellarSites Learning? Yes. In 2026, Liquid Web rebranded LearnDash Cloud as StellarSites Learning. The Starter / Growth / Pro tiers became Essential / Plus / Ultimate at the same $29 / $55 / $79 monthly price points. The bundle includes managed WordPress hosting, LearnDash, a domain, SSL, daily backups, and AI tools. If you signed up to LearnDash Cloud before the rebrand, your account moved to StellarSites Learning automatically. Functionally, you're using the same product on the same infrastructure. The branding change reflects Liquid Web's broader consolidation of the StellarWP plugin portfolio under its hosting brand. ### How much does LearnDash actually cost per year? Self-hosted LearnDash runs $470–$650 in Year 1 (license, hosting, add-ons, video CDN). StellarSites Learning Essential runs $487–$607. Once you add a $50–$150/month maintenance retainer to self-hosted, total Year-1 cost rises to $1,070–$2,450 — making SaaS cheaper for any non-technical operator. The list-price comparison flips entirely once you price in operational labor. The only scenario where self-hosted is truly cheaper is the one where a member of your team performs WordPress maintenance, security monitoring, and update testing at zero internal cost. For enterprise L&D, that assumption is never true. ### What are the alternatives to LearnDash for enterprise L&D? The leading alternative is Cubite LMS. For SCORM, SSO, multi-tenant academies, and SOC 2 compliance, WordPress-based LMS plugins like LearnDash struggle — purpose-built platforms win on every enterprise requirement. ### Does LearnDash support SCORM and SSO? LearnDash supports SCORM via paid third-party add-ons, not natively. SSO requires additional plugins (e.g., miniOrange, WP SAML Auth) and configuration. Both add to the WordPress plugin sprawl and increase the security attack surface. Cubite LMS plays SCORM 1.2, SCORM 2004 and xAPI with a built-in learning record store in its Growth plan, $290 a month or $2,900 a year with unlimited learners. Cubite LMS's Growth plan also includes SSO with Google, GitHub or Facebook sign-in; SAML SSO and SCIM are on its Enterprise plan. For an enterprise procurement team, the practical effect is that every checkbox on the requirements list becomes another vendor dependency. Each add-on has its own patch cycle, its own security history, and its own break-on-WordPress-update risk. The cost isn't just the license fee — it's the ongoing testing burden on a chain that, [according to Patchstack](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/), exists on the most-attacked CMS surface in the world. ### Is self-hosted LearnDash secure? Self-hosted LearnDash inherits WordPress's risk profile: 11,334 plugin vulnerabilities were disclosed in 2025 (up 42% YoY), 91% of those in plugins, and exploits launch within five hours of disclosure. Security is the operator's responsibility — most don't have the in-house capability. SaaS shifts patch responsibility to Liquid Web but does not reduce platform-extinction risk. "Secure" is a workflow, not a feature. Self-hosted LearnDash can be operated securely by a team that has dedicated WordPress ops capability, a 24/7 monitoring stack, and a tested patch-rollout process. Most organizations don't have those. For them, the practical security posture of self-hosted LearnDash is whatever Patchstack and Wordfence catch before the attacker does. --- ## Key Takeaways - The April 2026 StellarWP dissolution changed the LearnDash question. Self-hosted vs SaaS is now a secondary choice underneath a shared platform-extinction risk. - Cost-parity at list, but not in reality. Add a maintenance retainer and self-hosted becomes the more expensive path for any non-technical operator. - Neither path meets enterprise L&D requirements natively. SSO, SCORM, multi-tenant, SOC 2 — every checkbox requires a paid add-on or isn't possible at all. - The strategic decision is no longer self-hosted vs SaaS. It's LearnDash vs purpose-built. --- # IndexNow for AI Visibility: Get Your Content Cited by ChatGPT https://cubite.io/blogs/indexnow-for-ai-visibility **By:** Amir Tadrisi **Updated:** 2026-10-01 ChatGPT pulls from Bing. Here's how IndexNow for AI visibility gets your Course Content, blogs and marketing pages cited — and why Moodle, Canvas, and Blackboard can't compete. # IndexNow for AI Visibility: How Cubite Gets Courses Cited by ChatGPT (And Why Most LMSes Can't) ## ChatGPT now handles 2.5 billion prompts per day **900 million reaches** — weekly users as of early 2026 Almost none of the ChatGPT answers are pulling from your course catalog, blogs or marketing pages and the reason has nothing to do with your content quality. It's because the LMS you run was built for an era when "search" meant "wait for Googlebot." That era is over. **ChatGPT Search, Perplexity, and Bing Chat all need to discover your pages in minutes**, not weeks, to consider citing them. The protocol that does that is called IndexNow, and Cubite LMS has it built in: once a site admin turns it on in Integrations, each public course and page is submitted when it is published or its content is updated. This article walks through the full chain: why AI search depends on IndexNow for AI visibility, how the protocol works, the OAI-SearchBot gotcha that breaks most setups, and exactly how Cubite wires it all up so your courses get found by AI assistants the moment you publish. Cubite sells Cubite LMS and publishes this guide. --- ## Why your course catalog is invisible to ChatGPT (and why it matters in 2026) The numbers tell the whole story: AI traffic is still a small slice of the total — about 1.08% of sessions on average — but the trajectory is what should be on your roadmap. Marketers now call this shift Generative Engine Optimization (GEO) — optimizing not just for Google's blue links but for citations inside AI-generated answers. The L&D buyers who used to type "best python programming course" into Google now ask ChatGPT instead. If your course pages aren't in the AI's retrieval layer, you don't exist in the conversation. Here's the part most platform vendors won't say out loud: none of the legacy LMSes — Moodle, Canvas, Blackboard — ship with IndexNow integration. They were architected before AI search existed, and ChatGPT SEO in 2026 looks nothing like classic Google SEO did. We'll get to the comparison further down. First, the protocol itself. --- ## What is IndexNow? The protocol behind faster AI discovery IndexNow is an open protocol that lets websites instantly notify search engines (Bing, Yandex, Naver, Seznam, Yep) when content is added, updated, or deleted. Instead of waiting days for crawlers, content enters the indexing queue within minutes — a critical advantage for ChatGPT Search and other AI engines that pull from Bing's index. Microsoft Bing and Yandex launched the protocol jointly in October 2021. The mechanic is simple: instead of search engines polling your site looking for changes, your site pings them. One HTTP request. The engine then prioritizes the URL for crawl. ### Adoption isn't theoretical anymore | Metric | 2024 | 2026 | | --- | --- | --- | | Daily URL submissions | 3.5B | 5B+ | | Active sites using IndexNow | — | 80M+ | | Share of Bing-clicked URLs from IndexNow | 18% | 22% (Dec 2025) | Sources: [Pressonify](https://pressonify.ai/blog/indexnow-instant-indexing-press-releases-2026), [Bing Webmaster — May 2025](https://blogs.bing.com/webmaster/May-2025/IndexNow-Drives-Smarter-and-Faster-Content-Discovery) WordPress's IndexNow plugins (Yoast, Rank Math, Microsoft's official) crossed 10 million active installs in July 2025. Shopify, Wix, and Milestone integrated it. Amazon prepared adoption mid-2025. The protocol has clearly graduated from experiment to infrastructure. ### Which engines actually support it | Search Engine | IndexNow Support | Notes | | --- | --- | --- | | Microsoft Bing | Yes | Primary adopter; powers ChatGPT Search retrieval | | Yandex | Yes | Co-creator of the protocol | | Naver | Yes | Dominant in South Korea | | Seznam.cz | Yes | Major Czech engine | | Yep | Yes | Brave's search partner | | Google | No | Tested since 2021, never adopted | That last row matters. IndexNow is not a Google play. For Google rankings you still rely on sitemaps and Search Console. IndexNow is specifically a Bing-and-AI-search lever — which, as the next section shows, is exactly where the citation game is being won. Quick check: Did the protocol basics land? --- ## The IndexNow → Bing → ChatGPT chain (and the OAI-SearchBot gotcha that breaks everyone's setup) ChatGPT Search uses Bing's index as its real-time retrieval layer. That single fact rewires how you should think about AI visibility: any signal that gets you into Bing faster gets you into ChatGPT faster. OpenAI's own developer documentation confirms the path: > You can trigger a crawl by the OAI-SearchBot by submitting your updated URLs to Bing Webmaster Tools or using the Bing IndexNow API. > — OpenAI Docs ### The OAI-SearchBot vs. GPTBot mistake This is the most-missed nuance in the entire space, and it's the reason most "AI-ready" sites still aren't appearing in ChatGPT answers. OpenAI runs two different crawlers, and they need separate robots.txt directives: - GPTBot — collects training data for OpenAI's foundation models - OAI-SearchBot — powers ChatGPT's live web search and citations Allowing GPTBot does not allow OAI-SearchBot. Most blog posts that tell you "just unblock GPTBot" are wrong by half. To be eligible for live ChatGPT citation, your robots.txt needs both: ```bash # robots.txt — minimum AI search permissions User-agent: GPTBot Allow: / User-agent: OAI-SearchBot Allow: / User-agent: CCBot Allow: / ``` Combine the two — IndexNow pings + correct OAI-SearchBot permissions — and you collapse a two-week wait into roughly two days. That's the window between you being invisible to ChatGPT and you being a candidate citation. Situation: A peer L&D team tells you their LMS has been "AI-optimized for six months." They updated robots.txt to explicitly allow GPTBot, submit a sitemap to Bing Webmaster Tools weekly, and added FAQ schema to every course page. Six months in, ChatGPT Search still doesn't cite a single one of their courses. They're frustrated and ready to blame OpenAI. --- ## How Cubite ships IndexNow natively This is our ship to AI pipeline. Out integration contains multiple main pieces. ### Enabling IndexNow First step in our learning management system is to enable IndexNow in our site Integrations settings Click on Enable, after enabling it Cubite assign a key to your tenant which helps the IndexNow to verify your tenant ### Automate call to IndexNow Next step is really straightforward ever content actions like publishing, updating and deletion makes a call to the IndexNow without need your intervention to keep your content updated on AI visibility. ### Manual Call to IndexNow To manually call the IndexNow endpoint you can visit the integrations -> IndexNow section and drop your URL in the input box and after clicking on the Push it indexes your content --- ## Why Moodle, Canvas, and Blackboard can't compete on AI visibility The big three institutional LMSes have all shipped meaningful AI features. None of them has shipped the AI search visibility layer for LMS content underneath those features. | Capability | Moodle | Canvas | Blackboard | Cubite | | --- | --- | --- | --- | --- | | Native IndexNow integration | No, Plugin required | No | None | Built in (a site admin turns it on) | | OAI-SearchBot allowed in default `robots.txt` | No | No | No | Yes | | Server-side rendered course pages | Partial (PHP) | No, It's SPA | Partial | Yes, Next.js SSR | | AI course generation | Yes | Yes | Yes (Design Assistant) | Yes | | AI tutor for learners | No, Plugin required | Roadmap | Limited | Yes | | AI multilingual content | No, Plugin required | Plugin | No | Yes | What each platform actually ships today: - Moodle offers Content Generation (drafts course descriptions, generates quiz items from uploaded docs), Summarise Data, and Predictive Analytics for at-risk students ([LearnWise](https://www.learnwise.ai/guides/ai-in-the-lms-how-it-works-in-canvas-moodle-brightspace-blackboard)). Strong AI-for-learning. No AI-discovery layer at all. - Canvas (Instructure) announced its IgniteAI initiative in July 2025 — an "agentic AI" approach with modular add-ons ([ListEdTech](https://listedtech.com/blog/the-future-of-ai-in-lms/)). Most of it is roadmap. The course pages themselves are still client-rendered, which AI crawlers handle poorly. - Blackboard's AI Design Assistant generates 10 quiz questions per click and produces grading rubrics. It "currently does not offer AI-powered content translation" ([LearnWise](https://www.learnwise.ai/guides/ai-in-the-lms-how-it-works-in-canvas-moodle-brightspace-blackboard)) and has no IndexNow path. This isn't a slight on those platforms. They were built when SEO meant Google and learning meant a classroom intranet. Retrofitting AI discovery onto a 20-year-old PHP monolith or a client-rendered SPA is not a configuration change — it's an architecture project. --- ## What IndexNow does NOT do (the honest caveats) Most articles in this space oversell IndexNow as a magic switch. It isn't. Here's what to keep in mind: - HTTP 200 from IndexNow ≠ guaranteed indexing. A 200 response confirms Bing received your URL. Bing still applies quality filters before indexing or surfacing it. Submitting thin or duplicate pages won't change the outcome. - It does nothing for Google rankings. Google has not adopted the protocol despite testing it since 2021. If your traffic is Google-dependent, IndexNow is additive, not a replacement for sitemap + Search Console hygiene. - It can't fix bad content. Faster indexing of a low-quality page just means a low-quality page gets indexed faster. The AI engines that cite you are looking for clear, well-structured, factual content. IndexNow is the on-ramp; the content still has to be worth citing. - AI traffic is still a small share of total sessions — about 1.08% on average ([Similarweb](https://www.similarweb.com/blog/marketing/geo/gen-ai-stats/)). The 527% YoY growth rate is what justifies investing now, not current click volume. Build the foundation while the cost of leadership is still low. By the time AI traffic reaches double-digit share, the LMSes that already ship IndexNow + correct crawler permissions + SSR HTML will have a multi-year head start in AI citation patterns. --- ## FAQ — IndexNow, AI search, and your LMS ### What is IndexNow? IndexNow is an open protocol that lets websites instantly notify search engines (Bing, Yandex, Naver, Seznam, Yep) when content is added, updated, or deleted. Instead of waiting days for crawlers, content enters the indexing queue within minutes — a critical advantage for ChatGPT Search and other AI engines that pull from Bing's index. The protocol was launched by Microsoft and Yandex in October 2021 and is now used by 80M+ sites submitting 5B+ URLs per day. It's free, open-source under a Creative Commons license, and supported by the major non-Google engines. ### Does IndexNow help with ChatGPT visibility? Yes. ChatGPT Search uses Bing's index as its real-time retrieval layer, so faster Bing indexing means faster ChatGPT discoverability. OpenAI's own documentation recommends submitting URLs via Bing Webmaster Tools or the IndexNow API to trigger crawls by OAI-SearchBot, the bot that powers ChatGPT's web search. Combined with allowing OAI-SearchBot in your robots.txt, IndexNow compresses the time between publishing a page and being eligible for ChatGPT citation from up to two weeks down to roughly 24–72 hours. ### Does Google support IndexNow? No. Despite testing the protocol since 2021, Google has not adopted IndexNow. The protocol is supported by Bing, Yandex, Naver, Seznam.cz, and Yep. For Google visibility you still need sitemaps and Search Console; IndexNow is specifically a Bing-and-AI-search play. This is why IndexNow is best understood as additive infrastructure for the GEO era, not a replacement for traditional SEO. Your Google strategy doesn't change; you're adding a second discovery channel optimized for AI assistants. ### Do Moodle, Canvas, or Blackboard support IndexNow? Not natively. Moodle, Canvas, and Blackboard were built before AI search existed, and none ship with IndexNow integration out of the box. Site owners can add IndexNow via custom plugins or proxies, but it requires engineering work. Cubite LMS has IndexNow built in: a site admin turns it on in Integrations, and from then on each public course and page is submitted when it is published or its content is updated. The deeper issue isn't just IndexNow — it's the surrounding stack. Most legacy LMSes serve client-rendered or partially server-rendered pages that AI crawlers struggle to parse, and ship with robots.txt files that don't address the OAI-SearchBot/GPTBot distinction at all. ### How do I get my course pages cited by ChatGPT? Three steps: (1) allow OAI-SearchBot in robots.txt — note that allowing GPTBot does NOT cover OAI-SearchBot, (2) submit new and updated URLs through IndexNow so Bing — ChatGPT's retrieval source — indexes them in hours instead of days, (3) structure content with clear answers, schema markup, and citation-worthy facts. Beyond the mechanics, the content itself has to earn the citation: direct 40–60 word answers near the top of each section, FAQ schema where applicable, and statistics with sourced links. AI engines preferentially cite content they can quote cleanly. ### What's the difference between GPTBot and OAI-SearchBot? GPTBot is OpenAI's training-data crawler; OAI-SearchBot powers ChatGPT's live web search. They are separate user-agents requiring separate robots.txt directives. Allowing one does not allow the other. For ChatGPT Search citations, you must explicitly allow OAI-SearchBot. This is the single most-missed configuration detail in AI SEO. Many sites that proudly announce "we allow GPTBot" still aren't appearing in ChatGPT Search results because OAI-SearchBot is implicitly blocked by default Disallow rules higher up in the file. --- ## Bottom line — modern LMSes need to be findable by AI If you sell, market, or distribute courses online, your discovery surface is shifting from Google-only to a mix of Google + ChatGPT + Perplexity + Bing Chat. The platforms that win the next decade of L&D will be the ones whose content is discoverable in every layer. Three things to take away: - IndexNow is a direct path into Bing, and therefore into ChatGPT Search. Instead of waiting for a crawler to notice a change, your site tells Bing which URLs changed, so it can prioritize crawling them. - Allowing GPTBot is not enough. OAI-SearchBot needs its own robots.txt line, and most LMSes don't have it. - Cubite LMS ships all of this in one platform: native IndexNow submission (a site admin turns it on in Integrations), a robots.txt that allows OAI-SearchBot on public pages, and server-rendered course and blog pages. --- # Financial Services Compliance Training LMS: What a FINRA Exam Tests https://cubite.io/blogs/financial-services-compliance-training-lms **By:** Amir Tadrisi **Updated:** 2026-10-01 FINRA's Regulatory Element, Firm Element, and AML training all end in one place: a record an examiner can ask for years later. Here is what a financial services compliance training LMS must capture, and how Cubite LMS keeps it exam-ready. Cubite sells Cubite LMS and publishes this guide. Short answer (updated October 1, 2026): Cubite LMS costs $290 a month or $2,900 a year per site, with unlimited learners and courses. SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. Since January 1, 2023, FINRA's Regulatory Element has been due every year, by December 31, for each registration a person holds. Miss it and the registration goes inactive. Yet the requirement that actually decides your next exam is quieter: every completion has to leave a record you can produce years later. _FINRA enforcement_ ## The stakes on getting compliance records right are rising **$154M FINRA sanctions, 2025** — FINRA's total monetary sanctions climbed in 2025 even as the number of cases fell, which raises the cost of a compliance program that cannot prove what it delivered. Total FINRA monetary sanctions rose about 77% from $87M in 2024 (reported by Financial Advisor magazine). ## What FINRA actually requires you to train, and how often Registered representatives face three recurring training obligations, and they run on different clocks. The Regulatory Element is annual, due by December 31 for each registration, under FINRA Rule 1240. It became an annual requirement on January 1, 2023, replacing the old multi-year cycle. The Firm Element is your program. FINRA Rule 1240 requires each broker-dealer to administer it according to an annual needs analysis and a written training plan, and to maintain records documenting the content and completion of the program. What you train is tailored to your firm's size, structure, scope of business, and regulatory concerns. Anti-money-laundering training is a third track. FINRA Rule 3310 requires firms to provide ongoing training for appropriate personnel, alongside annual independent testing of the AML program. These stack: a single registered person can owe Regulatory Element, Firm Element, and AML training in the same year. - Regulatory Element: annual, by December 31, per registration (FINRA Rule 1240). - Firm Element: annual needs analysis plus a written training plan, with records of content and completion (Rule 1240). - AML training: ongoing for appropriate personnel, with annual independent testing (Rule 3310). - Records: preserved at least six years when no other period applies, in a Rule 17a-4 format (FINRA Rule 4511). ## The exam is a records test, not a training test A FINRA or SEC examiner does not watch your training. They ask for evidence: who was assigned, who completed, on what date, and the written plan that says why. Your training program is judged on the record it leaves, not on the courses you bought. > **WARNING:** FINRA Rule 4511 requires firms to preserve books and records for at least six years when no other retention period applies, in a format that complies with SEA Rule 17a-4. A completion your system cannot reproduce on demand is, for the purposes of an exam, a training that never happened. This is where a general-purpose LMS quietly fails a regulated firm. It can play a course and mark it complete, but it cannot always reconstruct the assignment, the completion date, the expiry, and the plan they map to, then hand all of it to an examiner in one export. ## What a financial services compliance training LMS has to capture Strip away the marketing and the requirement is concrete. For a broker-dealer or a dually registered advisory firm, the platform has to do six things, and most of them are about the record rather than the lesson. The standards point matters more than it looks. Firms often license their Firm Element and AML content as SCORM or xAPI packages from providers such as WebCE or a compliance consultant. If your LMS needs a paid add-on or an external learning record store to play and track that content, the record is now split across two systems. ## How Cubite LMS handles the record Cubite LMS treats the record as the product, not an afterthought. It supports native SCORM 1.2 and 2004 and xAPI with a built-in learning record store, so licensed compliance content plays and reports completion without a separate LRS or paid add-on. On the reporting side, Cubite LMS ships fourteen built-in reports, including certificate expiry, at-risk watchlists, and exam item analysis, plus one-click CSV export. When an examiner asks for three years of completions, that is an export, not a week of digging. See our guide to [LMS reporting that flags at-risk learners](/blogs/lms-reporting-at-risk-learners) for how the same data prevents a lapse before it happens. For a regulated firm, where the data lives is itself a control. Cubite LMS gives each academy an isolated, white-label tenant on your own domain, with SSO through Google, GitHub or Facebook sign-in (SAML SSO and SCIM provisioning on the Enterprise plan), run against SOC 2, GDPR, and FERPA commitments. See how we approach [enterprise SSO and provisioning](/blogs/lms-sso-saml-guide) for the access-control side. | What the exam asks for | Generic LMS | Cubite LMS | | --- | --- | --- | | Regulatory Element deadline status per rep | Often manual or absent | Built-in report against the annual deadline | | Firm Element mapped to a written plan | Course list, not plan-aware | Assignments tied to roles and the plan | | Six-year record retrieval | Export varies, may need IT | One-click CSV export | | Licensed SCORM or xAPI content | Often a paid add-on or external LRS | Native, with a built-in LRS | | Certificate and CE expiry | Tracked ad hoc | Monitored with an expiry report | | Isolated learner records | Shared multi-tenant pool | Isolated white-label tenant | ## Build a Firm Element program that survives an exam - Annual Firm Element needs analysis documented and on file - Written training plan mapped to each registration and role - Regulatory Element deadline tracked per rep (annual, by December 31) - AML training assigned and logged for all appropriate personnel (Rule 3310) - Completion records preserved at least six years in a 17a-4-compliant format (Rule 4511) - Certificate and CE expiry monitored, not rediscovered at renewal - One-click export ready to hand an examiner without a fire drill ## When you might not need a dedicated compliance LMS If you are a small firm with a handful of registered persons, you may not need a platform yet. FINRA's own Financial Learning Experience (FLEX) can supply Firm Element content, the Regulatory Element is completed through FINRA's own system, and a careful spreadsheet can track a short roster. If you outsource CE administration to a provider like WebCE or a compliance consultant, that arrangement may already cover you. An LMS earns its place when the roster and the roles outgrow the spreadsheet: when mapping the written plan, tracking expiry, and retrieving records by hand starts to consume real time and introduce real risk. Be honest about where your firm sits before you buy anything. One more boundary worth stating plainly. An LMS delivers and documents training. It does not replace FINRA's regulatory content, your written supervisory procedures, or the judgment of your compliance team. It makes their record defensible, and that is the job. ## Where Cubite LMS fits If your real exposure is the record, Cubite LMS is the delivery, tracking, and audit layer that sits under your compliance program: native standards, certificate and CE expiry tracking, isolated [white-label](/services/white-label-lms) records, and an export an examiner can accept. It is the same records-first approach we take to [compliance training generally](/blogs/compliance-training-lms) and to [HIPAA training records](/blogs/hipaa-training-lms), applied to FINRA's clocks. ## FINRA compliance training LMS: frequently asked questions Short answers to what compliance officers ask before choosing a platform. ### How often must registered representatives complete FINRA continuing education? The Regulatory Element is due annually, by December 31, for each registration a person holds, under FINRA Rule 1240. Separately, your firm must run an annual Firm Element program from a written training plan. AML training is ongoing for appropriate personnel under FINRA Rule 3310. ### What is the difference between the Regulatory Element and the Firm Element? The Regulatory Element is standardized FINRA training on rules and regulatory developments, completed annually through FINRA's system. The Firm Element is your own program: each broker-dealer designs it from an annual needs analysis and a written plan, tailored to its size, business, and roles, and documents completion. ### How long must a broker-dealer keep training records? FINRA Rule 4511 requires firms to preserve books and records for at least six years when no other retention period applies, in a format that complies with SEA Rule 17a-4. Training completion records fall under this baseline, so keep them retrievable and exportable for the full period. ### Does FINRA require annual AML training? FINRA Rule 3310 requires ongoing AML training for appropriate personnel rather than naming a fixed interval, and it requires annual independent testing of the AML program on a calendar-year basis. Most firms run AML training at least yearly and log each completion to evidence the ongoing requirement. ### Can we use any LMS for FINRA compliance training? You can, if it does the regulated work: tracking Regulatory Element deadlines, mapping Firm Element assignments to your written plan, playing licensed SCORM or xAPI content, and preserving completions for six years with an examiner-ready export. A general LMS that cannot reproduce that record leaves a gap. ## See your FINRA training records go exam-ready Book a 30-minute walkthrough and we will map your Regulatory Element, Firm Element, and AML training to an examiner-ready record in Cubite LMS. [Book a 30-minute compliance walkthrough](https://cubite.io/go/book?src=financial-services-compliance-training-lms) --- # Customizable LMS: What You Can Configure Without Code (and When You Need Custom Development) https://cubite.io/blogs/customizable-lms **By:** Amir Tadrisi **Updated:** 2026-10-01 Most teams do not need a custom-built LMS. They need a customizable one. Here is what a modern LMS lets you brand, configure, and integrate without code, and the narrow set of needs that still require a custom build. Cubite sells Cubite LMS and publishes this guide. Short answer (updated October 1, 2026): Cubite LMS costs $290 a month or $2,900 a year per site, with unlimited learners and courses. SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. Most teams shopping for a custom LMS do not actually need one. They need a customizable LMS: an existing platform they can bend to their brand, their roles, and their systems without paying to build software from scratch. The gap between those two decisions is real money. Cubite quotes a custom build at 15,000 to 25,000 dollars for an MVP and 40,000 to 80,000 dollars for a full platform, while a configurable subscription is something you set up yourself. So the real question is not custom versus off-the-shelf. It is narrower: where does configuration end and custom code begin? This guide maps what a modern LMS lets you change without a developer, the parts buyers forget to check, and the short list of needs that genuinely require a custom build. ## Customizable, customized, and custom-built are three different things These words get used interchangeably on sales calls, and the confusion costs buyers either too much money or too much flexibility. It helps to separate them before you compare platforms. | Approach | What it means | Who does the work | Typical cost | | --- | --- | --- | --- | | Configuration | Change settings the platform already exposes: branding, roles, domains, catalog | You, in the admin UI | Included in your subscription | | Customization | Extend behavior through plugins, themes, or API and webhook integrations | You or a developer, within extension points | Plugin or developer time | | Custom development | Build features, or a whole platform, that do not exist yet | An engineering team | 15,000 to 80,000 dollars and up (Cubite, 2026) | A customizable LMS lives in the first two rows. You configure most of it yourself and reach for the API only when you need to connect another system. You cross into custom development, and its cost and maintenance, only when your requirements outrun what any vendor ships. ## What you can configure without writing code On a modern platform, the list of no-code changes is longer than most buyers expect. A configurable SaaS such as TalentLMS lets you add a logo and favicon, change portal colors and fonts, map a custom domain, edit every email and notification, and ship a branded mobile app, all from settings (TalentLMS, 2026). Cubite LMS covers the same ground and adds isolated, per-brand academies. None of that touches a line of code. It is why a configurable LMS goes live in days: the features are already built and tested, so your time goes into setup, not engineering. ## The parts buyers forget to check Branding sells the demo, but four less visible questions decide whether a platform is actually customizable enough for you. Ask them before you sign, because they are expensive to discover later. - Data portability. Can you export learners, content, progress, and certificates on demand, or is your data effectively locked in? - Tenant isolation. If you run several branded academies, is each one a genuinely separate tenant, or just a logo swapped over a shared database? - API coverage. Does the API reach every object you need, from enrollment to analytics to payments, or only a token few? - Role granularity. Do the built-in roles match how your team actually works, or will you fight the permission model every day? A platform can be beautifully brandable and still fail all four. Cubite LMS answers them with fully isolated tenants, on-demand export, a REST API that covers courses, enrollment, progress, analytics, and payments, and [SSO with Google, GitHub or Facebook sign-in](/blogs/lms-sso-saml-guide) (SAML SSO and SCIM are on the Enterprise plan). ## Customizable LMS vs custom development: the honest boundary Configuration is not infinite. There is a real line where an off-the-shelf platform, however flexible, cannot follow you, and pretending otherwise is how projects blow their budget. Cubite is direct about where that line sits. > **WARNING:** If a vendor tells you everything is possible with no code, be skeptical. Deep ERP integration, certified compliance environments, and features that do not exist yet are custom development, no matter how polished the configuration screens look. - Per-user pricing becomes unsustainable at your scale, and you need to own the cost structure. - You need deep, two-way integration with existing HR, CRM, or ERP systems. - Your industry demands a certified environment such as HIPAA or FedRAMP. - You need a feature no SaaS vendor offers today. If two or more of those describe you, read our [custom LMS development guide](/blogs/custom-lms-development-guide) before you shop for a SaaS. If none of them do, a customizable LMS will serve you for far less money and far less risk. - The platform maps to my own domain with SSL, with no vendor branding left over - I can apply my logo, colors, fonts, emails, and certificate designs without code - The built-in roles and permissions match how my team actually works - There is a REST API and webhooks for the systems I run (HRIS, CRM, payments) - I can export learners, content, progress, and certificates on demand - Each branded academy is a genuinely isolated tenant, not a shared database - Native SSO (SAML or OAuth) supports my identity provider ## How Cubite LMS handles configuration Cubite LMS was built headless and multi-tenant from the start, which is why so much is configurable rather than bolted on. Every brand you launch is a genuinely isolated, [white-label academy](/services/white-label-lms) with its own theme, domain, catalog, users, and analytics, managed from one dashboard. Courses are authored in a [built-in block editor with no plugins](/blogs/lms-course-builder-no-plugins) to install, update, or secure. The same principle runs through the platform. What other stacks solve with a plugin or a developer, Cubite exposes as a setting, an API call, or a block. ## Configure, plugins, or code: a quick comparison | Need | Cubite LMS | Moodle | WordPress LMS plugin stack | | --- | --- | --- | --- | | Branding and custom domain | Configured in settings | Theme edits, some code | Theme plus plugins | | Add a quiz or SCORM | Built-in block, native tracking | Core plus plugins | Add-on plugins and an LRS | | Roles and multi-tenant academies | Isolated tenants, built in | Limited, needs plugins | Not native | | Connect HR or CRM | REST API and webhooks | Plugins or custom code | Plugins or custom code | | Ongoing maintenance | Handled by the vendor | You patch core and every plugin | You patch WordPress and every plugin | ## When a customizable LMS is the wrong choice To be fair, configuration is not always the answer. If you run three courses for fifty learners and already live inside Google Workspace, a full LMS is more platform than you need, and a lightweight course tool will cost you less setup and less money. - You need a certified HIPAA or FedRAMP environment that no SaaS in your budget offers. - Your core requirement is a feature no vendor has built, and you are ready to own the engineering. - Your catalog is tiny and static, and a simpler tool would do the same job for less. ## Frequently asked questions about a customizable LMS ### What is a customizable LMS? A customizable LMS is an existing learning platform you configure to fit your brand, roles, and workflows without building software from scratch. You change branding, custom domains, permissions, catalog, and integrations from settings and an API, so it deploys in days rather than the months a fully custom build takes. ### Can you customize an LMS without coding? Yes. On a modern LMS you can customize branding, colors, fonts, a custom domain, email templates, certificates, user roles, and the course catalog entirely from the admin interface, with no code. You only need a developer when you connect a bespoke internal system or build a feature the platform does not offer. ### What is the difference between a customizable LMS and a custom LMS? A customizable LMS configures a ready-made platform, so most features are already built and you set them up yourself. A custom LMS is engineered from scratch for your exact workflows. Custom gives maximum flexibility but costs far more, roughly 15,000 to 80,000 dollars and up, plus ongoing maintenance. ### Is Moodle a customizable LMS? Moodle is highly customizable, but mostly through code. Its flexibility comes from more than 1,500 third-party plugins in the Moodle Marketplace, plus theme and core edits. That power is real, yet every plugin is software you install, update, and secure yourself, a maintenance load a configurable SaaS avoids. ### How much does LMS customization cost? Configuration is usually included in your subscription, since you change settings yourself. Custom development is where cost climbs: a custom LMS MVP runs about 15,000 to 25,000 dollars and a full platform 40,000 to 80,000 dollars, with maintenance on top. Match the approach to how much genuinely needs to change. ## See how far you can configure Cubite LMS Book a 30-minute call and we will map your branding, roles, and integrations to what Cubite configures out of the box, and flag anything that genuinely needs custom work. [Book a 30-minute configuration review](https://cubite.io/go/book?src=customizable-lms) --- # LMS SSO: SAML, OAuth, and What Enterprise Buyers Should Require https://cubite.io/blogs/lms-sso-saml-guide **By:** Amir Tadrisi **Updated:** 2026-10-01 Single sign-on is table stakes for an enterprise LMS, but "we support SAML" hides a lot. Here is how LMS SSO actually works, what to require beyond the login button, and how to evaluate it before you sign. Cubite sells Cubite LMS, managed Open edX and managed Moodle, and publishes this guide. Short answer (updated October 1, 2026): Cubite LMS costs $290 a month or $2,900 a year per site, with unlimited learners and courses. SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. Ask an LMS vendor whether they support single sign-on and almost every one says yes. Ask what happens after the login button and the answers diverge fast. For an enterprise or a university, LMS SSO is not one feature, it is a stack of them, and the distance between a real implementation and a checkbox is where roll-outs stall and audits fail. This guide explains how LMS single sign-on actually works, what to require beyond the words "we support SAML", and how to evaluate it before you sign. ## What single sign-on actually means for an LMS Single sign-on lets a person reach your LMS with the same account they already use for email and every other work app, instead of a separate LMS username and password. Two parties do the work. Your identity provider, or IdP (think Okta, Microsoft Entra ID, or Google Workspace), verifies who the user is. The LMS, acting as the service provider, trusts that verification and starts a session. The flow is deliberately hands-off for the learner. When someone opens the LMS, it sees no active session and redirects them to your IdP. The IdP checks their credentials, including any multi-factor step you enforce, and sends back a signed token. The LMS validates that token and grants access, and the user never types an LMS-specific password. OneLogin sums up the division of labor cleanly: you use SAML for authentication and OAuth for authorization. ## SAML, OAuth, OIDC, LDAP and LTI, without the jargon SAML, the Security Assertion Markup Language, is the workhorse of enterprise SSO. As OneLogin describes it, web applications use SAML to transfer authentication data between two parties, the identity provider and the service provider, in XML. The verified credential the IdP hands over is called a SAML assertion, and it is what tells the LMS this person is who they claim to be. OAuth 2.0 and OpenID Connect are the modern pair. Okta puts the split plainly: OAuth 2.0 provides authorization via an access token containing scopes, while OpenID Connect adds authentication by introducing an ID token that carries identity. In practice, SAML still dominates corporate and campus environments, and OIDC shows up in newer web and mobile sign-in flows. Two more standards round out an enterprise setup. LDAP and Active Directory connect the LMS to your existing user directory for provisioning and group sync. LTI, the Learning Tools Interoperability standard maintained by 1EdTech, handles single sign-on into external tools: LTI 1.3 adds deep linking, grade passback, and names-and-roles roster sync, so a proctoring tool or a publisher's content can launch inside a course without a second login. | Standard | What it does | Reach for it when | | --- | --- | --- | | SAML 2.0 | Authenticates a user and passes a signed assertion to the LMS | Your IdP is Okta, Entra ID, Ping, or a campus Shibboleth setup | | OAuth 2.0 | Authorizes access to a resource with a scoped token | An app or API needs delegated access, not a human login | | OpenID Connect | Adds an identity layer on top of OAuth 2.0 | You want modern authentication for web and mobile sign-in | | LDAP / Active Directory | Syncs users and groups from your directory | You provision accounts and enrollments from an internal directory | | LTI 1.3 | Single sign-on plus roster and grade sync into external tools | You launch third-party tools or content inside a course | ## The login button is easy. Provisioning is the hard part. Most SSO disappointments are not about the login screen. They are about what does not happen after it. If your LMS authenticates a user through SSO but has no record of them, someone still has to create that account, assign a role, and enroll them in the right courses by hand. At a few hundred learners that is annoying. At tens of thousands, with staff joining and leaving every week, it is unworkable. The fix is automatic provisioning. With just-in-time provisioning, the account is created on the user's first SSO login, with their name, email, role, and department mapped straight from your IdP. Group membership in the IdP can then drive enrollment, so adding someone to the "Nursing 2026" group in your directory puts them in the right courses without an administrator touching the LMS. - Create the account on first sign-in, so there is no pre-loading of users. - Map attributes like name, email, role, and department from the identity provider. - Drive course and group enrollment from IdP groups, not a manual spreadsheet. - Remove access the moment someone is deprovisioned in the directory. ## The 2026 reason SSO moved up every checklist Single sign-on used to be a convenience line item. After the [2026 Canvas data breach](/blogs/canvas-data-breach-2026) put learner data on the front page, it became a security control that boards ask about by name. Routing every login through one identity provider means you enforce multi-factor authentication in one place, apply your password policy everywhere, and cut off a departing employee's access to the LMS the instant you disable their directory account. > **WARNING:** SSO is not the same as security. Single sign-on centralizes authentication, but on its own it just means one stolen credential now opens more doors. It earns its keep only alongside enforced multi-factor authentication and real tenant isolation, so a breach in one customer's environment cannot reach yours. Ask for all three, not just the login integration. Higher education has lived this for years. Campuses federate identity through Shibboleth, the SAML-based system behind the InCommon Federation, which by its own account connects more than 1,000 research, education, and industry partners to over 6,000 services. If you serve universities, supporting that federation is not optional, and it is a fair question to put to any LMS you evaluate. ## What to require before you sign Turn the ideas above into a purchasing checklist. A vendor that answers yes to all of these has real enterprise SSO. A vendor that hedges on provisioning, MFA, or fallback is selling you a login button and calling it a platform. Work through it in your next demo and make them show, not tell. - Support for both SAML 2.0 and OpenID Connect, not just one of them. - Native support for your specific identity provider (Okta, Entra ID, Google Workspace, Ping, or Shibboleth). - Just-in-time provisioning that creates accounts on first sign-in. - Attribute mapping for name, email, role, and department. - Group-to-enrollment automation driven by your IdP groups. - Multi-factor authentication enforced at the identity provider. - A hybrid fallback so local admin login still works if SSO goes down. - LTI 1.3 for single sign-on, roster sync, and grade passback into external tools. - An audit log that records every sign-in. - Tenant isolation, so SSO is not stitched across a database you share with other customers. ## SSO on Cubite LMS, plan by plan Measured against the checklist above, the Growth plan covers the sign-in itself and the learner account on first sign-in. It does not connect to a corporate directory, so roles, groups and enrollments do not flow in from your identity provider: your admins set them, or another system does through the API. SAML SSO and SCIM are on the Enterprise plan. SSO also sits on the part of Cubite that makes it enterprise-grade in the first place: every customer runs on a white-label site on its own domain, and Cubite is SOC 2, GDPR, and FERPA aligned. That isolation is why [real multi-tenancy beats a logo swap](/blogs/white-label-lms), and it is the difference between SSO as a genuine security control and SSO as a convenience feature bolted onto shared infrastructure. ## When you might not need enterprise SSO Be honest about your own situation before you make SSO a dealbreaker. If you are a small team without a corporate identity provider, if your learners are the general public rather than employees, or if you run a few dozen accounts that rarely change, local logins with strong passwords and MFA are perfectly reasonable. Adding SAML there buys you complexity, not safety. The calculus flips the moment you have an IdP, a compliance obligation, or regular onboarding and offboarding at scale. At that point manual account management is the risk, and SSO with automatic provisioning is what keeps access accurate. If the quiz above put you in the enterprise-ready band, you may already have what you need. If it did not, the checklist is your shortlist of questions. ## Where Cubite fits Cubite LMS is built for the organizations that feel this most: universities, enterprises, and training providers that run courses for people who already sign in somewhere else. Its Growth plan, $290 a month or $2,900 a year per site, gives each academy its own white-label site and signs learners in with Google, GitHub or Facebook. Signing in through Microsoft Entra ID, Okta or a campus identity provider is not part of Growth: SAML SSO and SCIM are on its Enterprise plan, and our guide to choosing a [LearnDash alternative for universities and enterprise](/blogs/learndash-alternative-for-universities) covers the rest of the institutional checklist. If you run Open edX or Moodle instead, SSO (SAML / OIDC) implementation is included in every Cubite managed Open edX tier, from $1,260 a month, and in every managed Moodle tier, from $690 a month. Our [SSO integration service](/services/sso-integration) connects an existing Open edX site to your identity provider. ## Frequently asked questions about LMS single sign-on ### Does Cubite LMS support SSO? Yes. On Cubite LMS, SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. On the Growth plan, $290 a month or $2,900 a year per site, each site connects its own Google, GitHub or Facebook app, and a new learner gets an account the first time they sign in that way. ### What is SSO in an LMS? SSO, or single sign-on, lets learners access your LMS with the same credentials they use for email and other work apps, verified by your identity provider. The LMS never stores a separate password. It reduces password fatigue, centralizes security policy, and removes a login step that otherwise drops course completion. ### What is the difference between SAML and OAuth? SAML and OAuth solve different problems. SAML handles authentication: it proves who a user is and passes a signed assertion to the LMS. OAuth 2.0 handles authorization: it grants scoped access to a resource with a token. OpenID Connect adds an authentication layer on top of OAuth for modern sign-in. ### Is single sign-on secure without MFA? Not really. SSO centralizes authentication, so without multi-factor authentication one stolen credential can open every connected system, including your LMS. Enforce MFA at the identity provider and pair SSO with tenant isolation. Together they contain a breach; SSO alone only widens the blast radius of a compromised password. ### How long does LMS SSO setup take? For a platform with native support and an existing identity provider, connecting SSO usually takes a few business days, covering IdP configuration, attribute mapping, and testing. The variable is provisioning: mapping roles, departments, and group-driven enrollment correctly is where the real work sits, so budget time to test before go-live. ### What is just-in-time provisioning? Just-in-time provisioning creates a learner's LMS account automatically on their first SSO login, using attributes like name, email, role, and department from your identity provider. Combined with group-driven enrollment, it means new staff land in the right courses without an administrator creating accounts or assigning enrollments by hand. ## Put your LMS SSO through a real review Book a 30-minute session on enterprise access: your identity provider, provisioning, MFA, and what a clean SSO setup looks like on isolated, white-label infrastructure. [Book a 30-minute SSO review](https://cubite.io/go/book?src=lms-sso-saml-guide) --- # Moodle vs LearnDash: The Honest 2026 Comparison https://cubite.io/blogs/moodle-vs-learndash **By:** Amir Tadrisi **Updated:** 2026-10-01 ## Moodle vs LearnDash: The Honest 2026 Comparison Most "Moodle vs LearnDash" posts pick a side in the first paragraph. This one will not, because the two tools are not really competing for the same job. Moodle is a free, open-source, standalone learning platform built for institutions. LearnDash is a paid WordPress plugin built for creators and small teams who already live in WordPress. Choosing between them is less about which is "better" and more about which problem you actually have: do you need a serious teaching engine, or do you need to bolt courses onto a WordPress site? Here is the quick verdict, then the full head-to-head, then an honest accounting of where each one wins, the catch they share, and one option that sidesteps the whole question. ### Quick verdict - Pick Moodle if you are a university, training department, or large institution that needs deep pedagogy, native standards support (SCORM and xAPI), cohorts, and the ability to scale to tens of thousands of learners, and you have IT or DevOps to run it. - Pick LearnDash if you already run a WordPress site, you are selling courses to the public, and you want monetization and a familiar editor without standing up separate infrastructure. - Pick neither if what you actually want is enterprise-grade learning (native SCORM and xAPI, white-label, analytics) without becoming a platform operator. That is the gap we will get to at the end. ## Moodle vs LearnDash at a glance The single most important fact, and the one most comparison posts blur: these two products are not the same kind of software. Moodle is a standalone application you host yourself (or buy hosted via MoodleCloud). LearnDash is a plugin that only runs inside an existing WordPress installation. That one architectural difference drives almost everything else in the table below. | | **Moodle** | **LearnDash** | | --- | --- | --- | | **Architecture** | Standalone open-source LMS (GPL). Does not use WordPress. | WordPress plugin. Requires a WordPress site to run. | | **License cost** | Free. No per-seat fee, ever. | Paid: Essentials $259 / Pro $399 / Elite $599 per year (unlimited courses and learners, MemberDash bundled). | | **What you actually pay** | Hosting and operations. Roughly $50 to $150/mo to self-host a small deployment, or MoodleCloud's managed tiers. | License plus WordPress hosting plus add-ons (video, e-commerce, SCORM) plus maintenance. | | **SCORM and xAPI** | Native. SCORM, xAPI, and AICC supported out of the box. | Not native. Needs a paid add-on (GrassBlade or Tin Canny) plus a separate LRS. | | **Pedagogy and assessment** | Deep: cohorts, competencies, conditional activities, rich quiz engine, gradebook. | Lighter: drip content, quizzes, certificates. Strong for linear courses, thinner for institutional teaching. | | **E-commerce / selling courses** | Not built in. Requires third-party integration. | Strong. Sits inside WordPress with WooCommerce, memberships, and order flows close at hand. | | **Hosting and maintenance** | You (or a Moodle Partner) run the server, upgrades, and security. | You run the WordPress stack: core, theme, and every plugin's updates and patches. | | **Admin UX** | Powerful but dated and complex. Real learning curve. | Familiar to anyone who knows WordPress. Faster to start. | | **Scales to** | Very large institutions (universities run it). | Creators, course businesses, small to mid teams. | | **Who it's for** | Institutions that need depth, standards, and scale, and have IT. | WordPress-native creators and small teams who want speed and monetization. | If you only read the table, read this row twice: Moodle has native SCORM and xAPI; LearnDash does not. For anyone shipping compliance training or off-the-shelf course packages, that is not a minor footnote. It is often the whole decision. ## Where Moodle wins We are not going to pretend Moodle is the weaker tool. For a large class of buyers it is clearly the right one, and it has earned its place running learning for universities and governments worldwide. - It is genuinely free, with no per-seat tax. There is no license fee, ever. A 50-person pilot and a 50,000-person rollout cost the same in licensing: zero. You pay for hosting and the people who run it, not for headcount. - Native SCORM and xAPI. Upload a SCORM package or pipe xAPI statements to an LRS without buying anything extra. This is the feature LearnDash cannot match without paid add-ons. - Serious pedagogy. Cohorts, competency frameworks, conditional release of activities, a deep quiz engine, and a real gradebook. If your courses are more than "watch the video, take the quiz," Moodle has the primitives. - It scales. Moodle runs some of the largest learning deployments on earth, proven at institutional volume. - You own it. GPL-licensed and self-hostable. No vendor can dissolve the brand and leave you stranded (a real concern in the WordPress LMS world right now, as we will see). The honest tradeoff: Moodle's admin UX is dated and complex, and someone has to run it. Installs, upgrades, security hardening, and performance tuning are real DevOps work. MoodleCloud removes the server management but caps users and blocks plugins on its standard plans. If you are weighing who runs it, our [Moodle hosting guide](https://cubite.io/blogs/moodle-hosting) compares MoodleCloud, managed hosting and self-hosting on price and limits. Moodle rewards organizations that have, or are willing to hire, the operational muscle. ## Where LearnDash wins LearnDash is the most popular WordPress LMS for good reasons, and if you are already on WordPress it is hard to beat on time-to-launch. - It lives in WordPress. If your marketing site, blog, and brand already run on WordPress, LearnDash adds courses to the stack you know. No second system to learn or log into. - Fast to launch. The editor is familiar. A creator can build and price a course in an afternoon, where Moodle might take a week of setup. - Built for selling. Memberships, WooCommerce, order bumps, and drip campaigns are all a plugin away. Moodle treats e-commerce as an afterthought; LearnDash treats it as the point. - Predictable, all-in license tiers. Essentials $259, Pro $399, Elite $599 per year, all with unlimited courses and learners and MemberDash bundled. You know the number up front. The honest tradeoff: LearnDash has no native SCORM, and the WordPress dependency cuts both ways. Standards-based content needs a paid add-on (GrassBlade or Tin Canny) plus a separate LRS, which adds cost and moving parts. And everything LearnDash does, it does on top of a WordPress site you are now responsible for keeping patched. Which brings us to the part most comparisons skip. ## The catch they (and the whole WordPress-LMS category) share Here the comparison gets interesting, because the real risk is not Moodle vs LearnDash. It is the model LearnDash belongs to. These two do not share a maintenance burden, because they are different kinds of software. Moodle's burden is running one standalone application. LearnDash's is running an entire WordPress plugin stack: core, a theme, LearnDash itself, and the long tail of add-ons (video, e-commerce, SCORM bridge, membership) that a real course site accumulates. Each is independently maintained code sitting inside the same trust boundary as your learner accounts and payments. That stack is exactly where the WordPress LMS model strains. When we ran an external, non-intrusive scan of [174 live LearnDash sites in 2026](https://cubite.io/blogs/learndash-security-scan-2026), the picture was sobering: about 43% were running a version associated with at least one known critical CVE, roughly half were on an out-of-support WordPress core, and the median site ran about 7.5 third-party plugins. None of that is a knock on LearnDash's code specifically. It is the predictable result of asking site owners to keep a multi-plugin stack patched by hand, forever. And the maintenance question got sharper in 2026. LearnDash's parent organization, StellarWP, was dissolved by Liquid Web in April 2026, with committed security patches for retiring features ending around April 2027. If you are choosing a WordPress LMS now, "who ships the next patch, and how fast" is a fair question to put on the table. We lay out the full picture and every realistic exit in our [LearnDash alternatives and migration guide](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide). Moodle is genuinely insulated from that particular failure mode. It is one application, GPL-licensed, with a single upstream project and no plugin-stack sprawl required to function. The flip side, again, is that you are the one keeping that application patched and upgraded unless you pay someone to. So the shared catch is really this: both paths make you the operator. With LearnDash you operate a WordPress plugin stack. With self-hosted Moodle you operate a standalone application. Either way, security, upgrades, and uptime are your problem. Plenty of teams want learning outcomes, not an operations job. ## Or skip the plugin model entirely If you have read this far and quietly concluded "I want institutional-grade learning, but I do not want to run a server or babysit a plugin stack," that is a legitimate third answer, and it is the one we build. [Cubite LMS](https://cubite.io) is a fully managed learning platform at a flat $290/mo, all-in: unlimited users and unlimited courses, with hosting, maintenance, and support bundled into the price. There are 0% transaction fees on what you sell. It ships with the things institutions actually ask for and the things LearnDash makes you buy separately: - Native SCORM and xAPI, like Moodle, with no add-on or separate LRS to license. - White-label branding, certificates, and built-in analytics. - SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. The honest framing: Cubite is not "better than Moodle" in the abstract, and it is not trying to be a WordPress plugin. It is the managed pick for teams that want the depth (native standards, white-label) without becoming a platform operator. If you are a university with a strong IT department and a love of control, self-hosted Moodle may genuinely be your best home. If you are a training team, an academy, or a course business that wants enterprise features without the ops job or the plugin-patching treadmill, that is the gap Cubite fills. For teams specifically coming off LearnDash: LearnDash's WordPress export (WXR) carries course content only; learners, enrollments, progress, quiz scores and certificates live in the database, so a move to a hosted LMS needs a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. We documented the whole move, data export, course mapping, and learner migration, in our [LearnDash to Cubite migration guide](https://cubite.io/blogs/migrate-from-learndash-to-cubite), and the [free LearnDash migration assessment](https://cubite.io/learndash-migration) maps what carries over for your site. ## How to actually decide Strip away the marketing and the choice comes down to three questions: 1. Do you need native standards (SCORM, xAPI) and deep pedagogy? If yes, Moodle or Cubite. LearnDash needs paid add-ons to get there. 2. Are you already committed to WordPress and selling courses to the public? If yes, LearnDash is the path of least resistance, as long as you accept the plugin-stack maintenance. 3. Do you want to run the platform yourself, or do you want it run for you? Self-hosted Moodle and LearnDash both make you the operator. A managed platform like Cubite does not. There is no universally correct answer, and any post that gives you one is selling you something. Moodle is an outstanding free, open-source LMS for institutions with IT. LearnDash is a strong, fast WordPress LMS for creators. And if neither the DevOps of Moodle nor the plugin-stack upkeep of LearnDash appeals, a managed platform is a real third option rather than a compromise. ## Moodle vs LearnDash: frequently asked questions ### Is Moodle better than LearnDash? Neither is universally better; they solve different problems. Moodle is a free, standalone, open-source LMS built for institutions, with native SCORM and xAPI and deep pedagogy, but you host and maintain it. LearnDash is a paid WordPress plugin built for creators who want fast course monetization inside a site they already run. ### Is Moodle free and LearnDash paid? Yes. Moodle is free and GPL-licensed with no per-seat fee, so you pay only for hosting and operations, roughly $50 to $150 a month for a small self-hosted deployment. LearnDash is a paid WordPress plugin priced at Essentials $259, Pro $399, and Elite $599 per year, plus WordPress hosting and add-ons. ### Does LearnDash have native SCORM like Moodle? No. Moodle supports SCORM, xAPI, and AICC natively, out of the box. LearnDash has no native SCORM and needs a paid add-on such as GrassBlade or Tin Canny plus a separate Learning Record Store. For compliance training or off-the-shelf course packages, that native-standards gap is often the whole decision. ### Should I choose Moodle or LearnDash? Choose Moodle if you need native standards, deep pedagogy, and institutional scale and have IT to run it. Choose LearnDash if you already use WordPress and want to sell courses quickly. If you want native SCORM, SSO with Google, GitHub or Facebook sign-in, and white-label without operating a server, a managed platform like Cubite is a third option. ## Ready to get started? If you want help mapping your situation to the right choice, including an honest read on whether you should stay on what you have. No pressure, just a straight answer about the best home for your courses [book a free migration assessment](https://calendly.com/cubite/30min) --- # LifterLMS vs LearnDash (2026): An Honest Comparison https://cubite.io/blogs/lifterlms-vs-learndash **By:** Amir Tadrisi **Updated:** 2026-10-01 Both LifterLMS and LearnDash are WordPress LMS plugins. That single fact decides 80% of this comparison before you ever look at a feature list, because it means both inherit the same WordPress hosting, plugin-stack, and security burden no matter which one you pick. This page is a genuinely fair head-to-head. We will tell you where LifterLMS is the better buy, where LearnDash is, and the one thing the marketing pages on both sides leave out. Then, if it turns out the problem is the plugin model itself and not the plugin, we will show you the managed way out. This is a spoke of our [LearnDash alternatives and migration hub](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide). If you already know you are leaving WordPress, jump straight to the [LearnDash to Cubite migration guide](https://cubite.io/blogs/migrate-from-learndash-to-cubite). ## Quick Verdict: LifterLMS vs LearnDash If you want the one-line answer before the detail: - Pick LifterLMS if you are building an all-in-one course business with memberships, coaching, and a community, and you want most of that in one vendor's stack rather than five. - Pick LearnDash if you want the most widely deployed, most third-party-supported WordPress LMS, with the deepest add-on ecosystem and the most tutorials, contractors, and integrations to draw on. - Pick neither if your real problem is that you do not want to own a WordPress server, a plugin stack, and a patch cadence at all. In that case a managed platform like [Cubite LMS](https://cubite.io/) (flat $290/mo, hosting and maintenance bundled) removes the burden both of these tools hand you. SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. Now the honest detail. ## Head-to-Head Comparison Table Here is the side-by-side. Everything below is current as of 2026. | Dimension | LifterLMS | LearnDash | | --- | --- | --- | | Architecture | WordPress plugin (freemium: free core + paid add-ons) | WordPress plugin (paid, feature-tiered) | | Pricing | Free core; bundles from ~$199/yr (first year), higher tiers above | Essentials $259 / Pro $399 / Elite $599 per year | | Memberships and community | Built in (native membership, coaching, community) | Needs add-ons (MemberDash bundled for membership) | | SCORM / xAPI | No native SCORM; third-party add-on (e.g. GrassBlade) + LRS | No native SCORM; paid add-on (GrassBlade or Tin Canny) + LRS | | Certificates and quizzes | Native | Native | | Hosting and maintenance | You own it (WP host, updates, backups, security) | You own it (WP host, updates, backups, security) | | Plugin-stack burden | Inherits full WordPress plugin/security surface | Inherits full WordPress plugin/security surface | | Who it is for | All-in-one course + membership + coaching businesses | Course sites wanting the largest WP LMS ecosystem | The rows that actually separate these two are memberships and community (LifterLMS leans native) and ecosystem depth (LearnDash leans larger). On the rows that decide whether your LMS survives 2027, namely hosting, maintenance, and security, the two are effectively identical. ## Where LifterLMS Wins LifterLMS is genuinely strong, and a fair comparison says so plainly. It is more of an all-in-one out of the box. LifterLMS ships native memberships, coaching tools, and community features in its own stack. With LearnDash you typically assemble that from separate pieces. MemberDash is now bundled for membership, but community and coaching still tend to mean reaching for additional plugins. If your business model is "course plus membership plus a place for students to talk," LifterLMS gets you there with fewer moving parts. The freemium on-ramp is friendlier. LifterLMS has a genuinely usable free core, so you can stand up a real course before paying. Its paid bundles start around $199/yr in the first year, which is below LearnDash's $259 Essentials entry point. For a solo creator validating an idea, that lower floor and the free tier matter. It is independently maintained by a focused vendor. LifterLMS is built and shipped by an independent company whose entire business is that plugin. There is no parent-conglomerate reorganization hanging over it. For buyers who got spooked by the changes around LearnDash's ownership, that focus is reassuring, and it is a fair point in LifterLMS's favor. Fewer add-on line items for the membership use case. Because more is native, a membership-driven site can sometimes hit a lower total add-on bill than the LearnDash equivalent, even though LearnDash's base license can look cleaner on the pricing page. ## Where LearnDash Wins LearnDash earns its lead too, and pretending otherwise would make this page a hit piece instead of a useful comparison. The ecosystem is bigger. LearnDash is the most widely deployed premium WordPress LMS. That scale compounds: more third-party add-ons, more integrations, more developers who already know it, more agencies who will support it, and more written and video tutorials for any problem you hit. When something breaks at 11pm, "lots of people have solved this" has real value. Tiered pricing is predictable. LearnDash's 2026 tiers are clean: Essentials $259, Pro $399, Elite $599 per year, each with unlimited courses and learners and MemberDash bundled. You know what tier you are on and what it includes. There is no first-year-discount cliff to model. It is the safer default for pure course delivery. If your need is "sell and deliver structured courses on WordPress" without a heavy membership or community layer, LearnDash is the conventional, well-trodden choice. Conventional is not a weakness here. It means fewer surprises and an easier time hiring help. Institutional familiarity. LearnDash is the LMS plenty of universities, agencies, and established course businesses already run, so it is often the path of least resistance inside organizations that standardized on it years ago. So this is a real toss-up on the merits: LifterLMS for native all-in-one, LearnDash for ecosystem and predictability. Which brings us to the part neither vendor puts on the comparison slide. ## The Catch They Both Share Here is the thing the head-to-head obscures: LifterLMS and LearnDash are both WordPress plugins, so they hand you the exact same maintenance and security burden. Choosing between them is choosing the paint color of a house you still have to maintain yourself. When you run either one, you own: - A WordPress host you have to keep patched, backed up, and performant. - WordPress core updates that can break plugin compatibility. - A PHP runtime that goes end-of-life on its own schedule. - A stack of third-party plugins, each an independently maintained component with its own patch cadence, sitting inside your site's trust boundary. - The security headers and hardening that do not configure themselves. This is not hypothetical. We ran an external, non-intrusive [security scan of 174 live LearnDash sites in 2026](https://cubite.io/blogs/learndash-security-scan-2026), and the installed base showed what an unowned maintenance burden looks like in practice: - 43% were running a version associated with at least one known critical CVE. - About 50% were on an out-of-support WordPress core. - 77% of sites that disclosed a PHP version were on end-of-life PHP. - 90% had no HSTS header, 87% had no Content-Security-Policy, 81% had no X-Frame-Options. - The median site ran about 7.5 third-party plugins alongside the LMS. That scan looked at LearnDash sites, but nothing in those numbers is specific to LearnDash the plugin. They are properties of the WordPress-plugin operating model: outdated cores, EOL PHP, missing headers, and a stack of independently maintained plugins. A site built on LifterLMS sits in the same operating model and is exposed to the same class of findings. Swap the LMS plugin and the burden does not move. The only variable that changes the picture is who owns the patch cadence, and on both LifterLMS and LearnDash, that owner is you. For a small hobby site, that burden is fine and the [self-hosted versus SaaS tradeoff](https://cubite.io/blogs/learndash-self-hosted-vs-saas) often favors staying put. For an LMS that earns revenue, trains for compliance, or grants credentials, an unowned maintenance burden is a standing liability. ## Or Skip the Plugin Model Entirely If reading the section above made you realize the question was never really "LifterLMS vs LearnDash" but "do I want to run a WordPress server at all," there is a third answer. Cubite LMS is a managed platform, not a plugin. It exists for teams who want the LMS outcome without the WordPress operating model underneath it. One flat price covers the whole stack: - $290/mo, flat, with unlimited users and unlimited courses. - Hosting, maintenance, and support bundled in, so the cores, runtimes, and security headers from that scan are simply handled for you, not your weekend project. - 0% transaction fees on what you sell. - Native SCORM and xAPI, no third-party add-on and no separate LRS to license and babysit. This is a real gap for both WordPress plugins: LearnDash needs a paid add-on like GrassBlade or Tin Canny plus an LRS, and LifterLMS needs a third-party add-on like GrassBlade too. Standalone platforms (Moodle) and Cubite have SCORM natively; the WordPress plugins do not. - White-label, certificates, and analytics included. - SSO with Google, GitHub or Facebook sign-in included. The honest framing: Cubite is not the right pick if you specifically want to live inside WordPress and own every layer of your stack. If that is you, LifterLMS or LearnDash is the correct tool, and you should choose between them on the merits above. Cubite is the right pick when you have decided the plugin model itself is the cost you want to stop paying. If you are leaving LearnDash, Cubite runs the move for you from a database export, and the [free LearnDash migration assessment](https://cubite.io/learndash-migration) maps what carries over. ## How to Choose A short decision guide for the three live options: - Choose LifterLMS if you want a WordPress-native all-in-one for courses, memberships, coaching, and community, and you value an independent vendor and a low entry price. - Choose LearnDash if you want the largest WordPress LMS ecosystem, predictable tiered pricing, and the deepest pool of add-ons, integrations, and people who know the tool. - Choose Cubite LMS if you are done owning a WordPress host, a plugin stack, and a patch cadence, and you want native SCORM and xAPI and bundled hosting and support, all at a flat $290/mo. Both LifterLMS and LearnDash are legitimate, well-built tools, and many teams should stay on one of them. The managed path is for the teams who want out of the model, not away from a particular plugin. ## Frequently Asked Questions ### Is LifterLMS better than LearnDash? Neither is universally better. LifterLMS wins for all-in-one course-plus-membership-plus-community businesses and has a lower entry price with a usable free core. LearnDash wins on ecosystem size, predictable tiered pricing ($259 / $399 / $599 per year), and the largest pool of add-ons and contractors. Both are WordPress plugins, so they share the same hosting and maintenance burden. LifterLMS leans more native for memberships and coaching, which can mean fewer add-on line items for that use case. LearnDash leans on scale: more integrations, more tutorials, more agencies. Pick LifterLMS for an integrated membership business, LearnDash for conventional course delivery with maximum ecosystem support. ### Does LifterLMS or LearnDash support SCORM? Neither LifterLMS nor LearnDash supports SCORM natively. Both require a paid third-party add-on (such as GrassBlade for LifterLMS, or GrassBlade or Tin Canny for LearnDash) plus a separate Learning Record Store (LRS) to handle SCORM and xAPI content. That is an extra cost and an extra integration to maintain on either plugin. If native SCORM and xAPI matter to you, standalone platforms have the edge. Moodle include SCORM natively, and managed platforms like Cubite include native SCORM and xAPI with no add-on or separate LRS to license. ### Are LifterLMS and LearnDash the same kind of product? Architecturally, yes. Both are WordPress LMS plugins with a freemium or paid model, and both run inside a WordPress site you host and maintain yourself. That means both inherit the same WordPress core updates, PHP runtime lifecycle, third-party plugin stack, and security hardening responsibilities. The differences are at the feature and ecosystem layer, not the architecture layer. LifterLMS bundles more (memberships, coaching, community) into its own stack, while LearnDash relies on a larger external ecosystem. Neither choice changes the underlying operating model or who owns the patch cadence: you do. ### How do I move off a WordPress LMS plugin entirely? To leave the WordPress-plugin model, you migrate to a standalone or managed platform rather than swapping one plugin for another. LearnDash's WordPress export (WXR) carries course content only; learners, enrollments, progress, quiz scores and certificates live in the database, so a move to a hosted LMS needs a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. Cubite LMS itself is a managed LMS with bundled hosting, maintenance, native SCORM and xAPI, and white-label, at a flat $290 a month or $2,900 a year. Start with the [free LearnDash migration assessment](https://cubite.io/learndash-migration), the [LearnDash to Cubite migration guide](https://cubite.io/blogs/migrate-from-learndash-to-cubite) for the mechanics, or the full [LearnDash alternatives hub](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide) to compare every path before committing. ## What to Do Next The 30-second summary: - LifterLMS and LearnDash are both solid WordPress LMS plugins. LifterLMS is the better all-in-one for memberships and community at a lower entry price. LearnDash has the bigger ecosystem and cleaner tiered pricing. - Neither supports SCORM natively. Both need a paid add-on plus an LRS. - Both hand you the identical WordPress hosting, plugin-stack, and security burden, the same one our [174-site scan](https://cubite.io/blogs/learndash-security-scan-2026) measured: outdated cores, EOL PHP, missing security headers. - If the burden, not the plugin, is your real problem, a managed platform removes it. Cubite LMS is $290/mo all-in, with native SCORM and xAPI. Whichever plugin you would have chosen, the question worth answering first is whether you want to keep owning the server underneath it. > Not sure if you should switch plugins or leave the plugin model entirely? > > Tell us your setup and we will tell you the lowest-friction path off WordPress, with a fixed-scope migration plan. No deck, no upsell. > ## Ready to get started? Join thousands of learners and start building your skills today. [Book a free migration assessment](https://calendly.com/cubite/30min) --- --- # LearnPress vs LearnDash: The Honest 2026 Comparison https://cubite.io/blogs/learnpress-vs-learndash **By:** Amir Tadrisi **Updated:** 2026-10-01 ## LearnPress vs LearnDash: The Honest 2026 Comparison If you are choosing between LearnPress vs LearnDash in 2026, here is the short version before the detail: pick LearnPress if budget is the deciding factor and you want a capable course plugin for free or near-free, and pick LearnDash if you want the more polished, feature-complete commercial product and you are comfortable paying for it. Both are good at what they do. Both are also WordPress plugins, which means they share the same long-term liability, and that is the part most comparison posts skip. This page lays out the head-to-head fairly, names where each one genuinely wins, then explains the catch they both carry, and finally covers the path for teams that would rather leave the WordPress-plugin model entirely. ## The quick verdict | If you are... | Choose | | --- | --- | | On the tightest budget, comfortable assembling add-ons | **LearnPress** (free core) | | Want the most polished commercial plugin and will pay for it | **LearnDash** | | Already on LearnDash and want a lighter, cheaper WP option | **LearnPress** (ThimPress ships a free migration tool) | | Leaving WordPress, need native SCORM/xAPI and zero maintenance | **A managed platform** (see the last section) | Neither plugin is a mistake. The mistake is choosing between the two without asking whether a WordPress plugin is the right architecture for what your LMS actually does in 2026. ## LearnPress vs LearnDash, head to head Both products are mature, widely deployed WordPress LMS plugins. The real differences are about packaging, polish, and price, not about whether they can run a course. | | **LearnPress** | **LearnDash** | | --- | --- | --- | | **Vendor** | ThimPress | LiquidWeb (formerly StellarWP) | | **Architecture** | WordPress plugin | WordPress plugin | | **Pricing model** | Freemium: free core, paid add-ons | Commercial: paid tiers | | **Entry cost** | $0 (free core) | $259/yr (Essentials) | | **Full-featured cost** | ~$149-$299/yr (Pro bundle) | $399/yr (Pro) to $599/yr (Elite) | | **Course builder** | Drag-and-drop builder | Drag-and-drop builder + Gutenberg blocks | | **Quiz question types** | ~5 native (true/false, single choice, multiple choice, fill-in-the-blank, sorting) | Broader native set + question banks | | **Drip content** | Paid add-on | Included in tiers | | **Payments** | Stripe/advanced gateways via paid add-ons | Stripe/PayPal/WooCommerce supported | | **Native SCORM** | No | No (needs a paid add-on like GrassBlade or Tin Canny + an LRS) | | **Native xAPI** | No | No (add-on + LRS) | | **Hosting** | Your WordPress host | Your WordPress host | | **Maintenance burden** | You own the full WP stack | You own the full WP stack | | **Migration help** | Free LearnDash-to-LearnPress migration tool | Migration add-on (imports from LearnPress, Tutor, Sensei) | | **Best for** | Budget-first creators and small sites | Course businesses and teams wanting a premium plugin | A note on the pricing rows, because they are the crux of the decision. LearnPress is the most budget-oriented option in the WordPress LMS market. Its core is genuinely free, and you can launch a real course site for $0. The cost only appears when you need specific commercial features (drip scheduling, advanced payment gateways, richer quizzing), each a paid add-on, with a Pro bundle landing around $149-$299/yr. LearnDash has no free tier: 2026 pricing runs Essentials at $259/yr, Pro at $399/yr, and Elite at $599/yr, each an unlimited-courses-and-learners license with MemberDash bundled in. You pay more, and get a more complete out-of-the-box product. ## Where LearnPress wins Price, plainly. LearnPress is the cheapest credible way to run courses on WordPress. A free core plus a drag-and-drop builder gets a small creator from zero to a published course without spending anything, and the optional Pro bundle stays well under LearnDash's entry license. For a side project, a single instructor, or a site testing whether paid courses will work at all, that matters enormously. Lower switching cost off LearnDash. ThimPress, the company behind LearnPress, ships a free LearnDash-to-LearnPress migration tool. If you are already on LearnDash and your only goal is to keep your courses inside WordPress while cutting the license cost, LearnPress is the most direct and least expensive landing spot. The data model is similar enough that the move is comparatively painless. A clean enough authoring experience for simple courses. The drag-and-drop builder and roughly five native quiz question types (true/false, single choice, multiple choice, fill-in-the-blank, sorting) cover most introductory and intermediate courses. If your content is video plus a knowledge-check quiz, LearnPress handles it without add-ons. ## Where LearnDash wins Polish and completeness out of the box. LearnDash has been the premium WordPress LMS for years, and it shows. The builder is more refined, the included feature set (drip, more flexible quizzing with question banks, focus mode, certificates) is broader without bolting on a stack of separate add-ons, and the documentation and third-party ecosystem are deeper. You are paying for fewer assembly steps. Maturity of the ecosystem. Because LearnDash has dominated the premium WordPress LMS segment, more themes, add-ons, page builders, and developers explicitly support it. If you need a specific integration, the odds that a maintained LearnDash add-on already exists are higher than for any other WP LMS plugin. Tiering that scales with features, not headcount. LearnDash's Essentials, Pro, and Elite tiers all include unlimited courses and learners, so you buy capability rather than being metered on growth. To be fair to both: LearnPress can reach much of LearnDash's feature set once you buy the right add-ons, and LearnDash is more expensive at the entry point. The honest framing is that LearnPress optimizes for lowest cost and LearnDash optimizes for least assembly. Which one is right depends on whether your scarce resource is money or time. ## The catch they both share Here is what no head-to-head between two WordPress plugins can resolve, because it is true of the architecture itself rather than either product. LearnPress and LearnDash are both WordPress plugins. That means whichever you pick, you also inherit the entire WordPress operational model: a self-hosted WordPress core, a theme, a page builder, a payment plugin, a caching plugin, an SEO plugin, and the LMS plugin, all updated on independent schedules, all sharing one trust boundary. The LMS is one component in a stack you are responsible for keeping current and secure. The risk in that model is not theoretical. In May 2026 we ran a passive, non-intrusive scan of 174 live LearnDash sites using public Shodan banner data ([see the full methodology](https://cubite.io/blogs/learndash-security-scan-2026)). The findings describe the installed base, and they apply just as squarely to any LearnPress site, because the exposure comes from the shared WordPress stack, not from LearnDash specifically: - 43% were running a version associated with at least one known critical CVE. - About 50% were on an out-of-support WordPress core. - 77% of sites that disclosed a PHP version were on an end-of-life PHP release. - The median site ran roughly 7.5 third-party plugins alongside the LMS, each its own patch cadence. - 90% sent no HSTS header, 87% no Content-Security-Policy, 81% no X-Frame-Options. None of those numbers are an indictment of LearnPress or LearnDash as software. They describe what happens when an LMS lives inside a self-maintained plugin stack: version currency and server hardening become the operator's full-time job. Switching from one WordPress LMS plugin to the other changes the LMS line item. It does not change who owns the patch cadence, the runtime, or the response headers. That is still you. For a hobby site or a tiny course with no compliance pressure, that burden is acceptable, keep the plugin current, harden the headers (most are one-line server settings), and you are fine. For an LMS that earns revenue, trains compliance, or grants certificates, an under-maintained plugin stack in production is a real liability, and choosing between LearnPress and LearnDash does not address it. ## Or skip the plugin model entirely If reading the section above made you wonder whether a WordPress plugin is the right home for your LMS at all, that is the useful question, and for a growing number of teams the honest answer is no. The platforms with native SCORM and xAPI are the standalone ones (Moodle are the open-source examples). Neither LearnPress nor LearnDash has native SCORM; both need a paid add-on plus a separate learning record store to get there. That is the gap [Cubite](https://cubite.io/) is built to close for teams leaving the WordPress-plugin model. It is a fully managed LMS at a flat $290/month, with the things a WordPress LMS makes you assemble or maintain handled for you: - Hosting, maintenance, and support bundled into the flat fee, so there is no WordPress stack to patch, no PHP version to chase, no security headers to configure. - Native SCORM and xAPI, no add-on and no separate LRS to license and operate. - Unlimited users and courses, with 0% transaction fees on what you sell. - White-label, certificates, and analytics included rather than priced as separate plugins. - SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. This is not the right answer for everyone. If you are a solo creator running one small course and budget is your only constraint, LearnPress's free core is hard to beat. If you want the most polished WordPress plugin and you are happy owning the stack, LearnDash earns its price. Cubite is the managed pick for the team in the middle: the one whose LMS matters enough that the maintenance and security burden of a plugin stack has stopped being worth it, and who wants SCORM/xAPI and predictable, all-in pricing without running infrastructure. If you are leaving LearnDash: LearnDash's WordPress export (WXR) carries course content only; learners, enrollments, progress, quiz scores and certificates live in the database, so a move to a hosted LMS needs a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. Start with the [free LearnDash migration assessment](https://cubite.io/learndash-migration). ## How to choose | Your situation | The honest recommendation | | --- | --- | | Smallest possible budget, simple courses | **LearnPress** (free core) | | Want a premium WP plugin, will pay, will own the stack | **LearnDash** | | On LearnDash, want cheaper, staying in WordPress | **LearnPress** (free migration tool) | | Need native SCORM/xAPI, want zero maintenance, leaving WP | **Cubite** ($290/mo, managed) | | Revenue, compliance, or certificates ride on the LMS | Reconsider the plugin model entirely | The LearnPress-versus-LearnDash decision is worth getting right, and for many sites a WordPress plugin is genuinely the correct tool. But if your LMS has outgrown the plugin model, the better comparison is not LearnPress against LearnDash, it is the whole plugin-stack approach against a managed platform that handles hosting, security, SCORM, and migration for you. ## Ready to get started? Not sure which side of that line you fall on? we will tell you honestly whether you should stay on a plugin or move off it [Book a free migration assessment](https://calendly.com/cubite/30min) --- Related reading: - Hub: [LearnDash Alternatives 2026: the full migration guide](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide) - Migrating off LearnDash specifically? See [how to migrate from LearnDash to Cubite](https://cubite.io/blogs/migrate-from-learndash-to-cubite) --- # We Scanned 174 Live LearnDash Sites in 2026: The Security Findings https://cubite.io/blogs/learndash-security-scan-2026 **By:** Amir Tadrisi **Updated:** 2026-10-01 43% of the 174 live LearnDash sites we scanned in May 2026 were running a version with at least one known critical CVE. That is the headline finding of an external, non-intrusive security scan of 174 publicly reachable LearnDash deployments. This page documents the numbers, explains why we ran the scan now, and lays out the methodology in enough detail that you can cite it, replicate it, or challenge it. It is a data report, not a product review. If you operate a LearnDash site, the [What it means for LearnDash operators](#what-it-means-for-learndash-operators) section is written to be neutral and factual. ## Why we ran this Two things changed the risk math for LearnDash operators in a way that motivated a fresh, measured look at the installed base. First, on April 22, 2026, Liquid Web wound down its StellarWP brand and reorganized its WordPress software into four core products, LearnDash among them. When the corporate structure behind a plugin changes, the practical question for site owners is simple: who ships the next security patch, and how fast? Second, Liquid Web's April 2026 announcement set a date that is easy to misread: critical security patches for the older tools it is retiring continue through April 2027. LearnDash is not one of those tools and is still updated (version 5.2.1 shipped on September 30, 2026), so the exposure that matters is whether each site installs the updates it is given. A plugin that sits in the authentication and payment path of a course business is exactly the kind of software where a patch-response gap matters, because a single unaddressed critical vulnerability can expose user accounts, course content, and transaction data. (Corrected October 1, 2026: an earlier version of this page read the April 2027 date for retiring tools as the end of LearnDash patches, here and in two later paragraphs.) We wanted a baseline measurement of where live sites actually stand today, rather than relying on anecdote. The 174-site scan is that baseline. You can [compare all the ways off LearnDash](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide) in our migration hub if the findings below change your planning. ## Key findings Each finding below is its own subsection with a bold, standalone number so it can be quoted independently. ### 43% were running a version with at least one critical CVE About 75 of the 174 sites (43%) were running a LearnDash version associated with at least one publicly disclosed critical CVE. A CVE (Common Vulnerabilities and Exposures) is a catalogued, publicly known security flaw. "Critical" here refers to the highest-severity tier (see the [Methodology](#methodology) section for the exact CVSS threshold used). This is the single most consequential number in the dataset because a known critical CVE on a public-facing site is, by definition, a vulnerability that an attacker can look up. ### About 50% were on an out-of-support WordPress core Roughly half of the scanned sites were running a WordPress core version that is no longer in the supported release window. LearnDash does not run in isolation. An out-of-support core means the platform underneath the plugin is itself no longer receiving the same security attention, which compounds any plugin-level exposure. ### 77% of sites exposing a PHP version were on end-of-life PHP Of the sites that disclosed a PHP version, 77% were running an end-of-life PHP release. End-of-life (EOL) means the PHP version no longer receives official security fixes. Note the qualifier: this percentage is calculated only over sites that exposed their PHP version in response headers, not over all 174 sites. ### The median site ran about 7.5 third-party plugins The median scanned site ran roughly 7.5 third-party plugins alongside LearnDash. Each additional plugin is additional code in the trust boundary of the site. This figure is a measure of attack surface, not of quality. A higher plugin count is not inherently insecure, but it does mean more independently maintained components that each need their own patch cadence. ### 90% had no HSTS header 90% of sites sent no HTTP Strict Transport Security (HSTS) header. HSTS tells browsers to only ever connect over HTTPS, which closes a class of downgrade and interception attacks. Its near-total absence across the sample is notable because HSTS is a one-line server configuration, not a code change. ### 87% had no Content-Security-Policy 87% of sites sent no Content-Security-Policy (CSP) header. CSP is the primary browser-level defense against cross-site scripting and content-injection attacks. Its absence does not mean a site is exploited, but it removes a major mitigating layer for a platform that renders user-influenced content. ### 81% had no X-Frame-Options header 81% of sites sent no X-Frame-Options header. This header defends against clickjacking, where a site is loaded invisibly inside an attacker's page to trick users into clicking. Like HSTS, it is a server-level setting rather than a code fix. ### Uncanny Owl Toolkit appeared on about 25% of sites The most common LearnDash add-on, the Uncanny Owl Toolkit, was detected on roughly 25% of scanned sites. This is an ecosystem observation, not a security claim about that specific add-on. It is included because the concentration of a single add-on across a quarter of the sample is a useful fingerprint of how the LearnDash ecosystem is actually deployed. ### Findings at a glance | Finding | Result | Base | | --- | --- | --- | | At least one critical CVE | 43% (~75 sites) | All 174 sites | | Out-of-support WordPress core | ~50% | All 174 sites | | End-of-life PHP | 77% | Sites exposing a PHP version | | Median third-party plugins | ~7.5 | All 174 sites | | No HSTS header | 90% | All 174 sites | | No Content-Security-Policy | 87% | All 174 sites | | No X-Frame-Options | 81% | All 174 sites | | Uncanny Owl Toolkit present | ~25% | All 174 sites | ## What it means for LearnDash operators These findings describe the installed base, not any single site, and they are reported without editorializing. Read straight, three things stand out. The first is that version currency is the dominant variable. The 43% critical-CVE figure is almost entirely a function of how recently a site updated its LearnDash version. Keeping the plugin current is the highest-leverage action available to an operator, and it matters most for the operators least able to update on their own. The second is that the cheapest wins are at the HTTP-header layer. HSTS, CSP, and X-Frame-Options were absent on the large majority of sites, and all three are server-configuration changes rather than code changes. They do not require touching LearnDash, WordPress, or any plugin. For most operators, these are same-day fixes. The third is that the stack underneath LearnDash matters as much as the plugin. The out-of-support-core and end-of-life-PHP numbers show that a meaningful share of risk lives in the hosting and runtime layer. An operator who updates the plugin but stays on an EOL PHP release has only addressed part of the exposure. None of this requires changing platforms. An operator can update LearnDash, update WordPress core, move to a supported PHP release, and add three response headers, and most of the findings above would no longer apply to their site. For operators who would rather not own that maintenance burden, consolidating the stack is one option (see the [footer](#run-by-cubite)); migrating the runtime, the headers, and the patch cadence to a single managed platform is another. The data here does not prescribe either path. ## Methodology ### Data source and scan posture Every figure in this study comes from a single source: [Shodan](https://www.shodan.io), the internet-wide device search engine. This is the most important thing to understand about our method, so we will state it plainly. We never connected to, probed, scanned, logged into, or sent a single packet to any of the 174 sites. We did not run a vulnerability scanner against them. We did not fetch their pages. Shodan independently crawls the public IPv4 address space on a fixed set of common ports (HTTP/HTTPS among them), records the banner each service voluntarily returns to any ordinary client, and stores it in a searchable index. We queried that pre-existing index and analyzed the records. Nothing we did touched the sites themselves. This makes the study passive and non-intrusive by construction. Banner data is information these servers already broadcast publicly to every visitor. We did not access anything a site operator had not already exposed to the open internet, and we performed no act that could be characterized as unauthorized access. The unit of analysis is "a public banner Shodan already holds," not "a site we tested." ### How the 174 LearnDash sites were identified LearnDash ships as a WordPress plugin whose internal slug is sfwd-lms. When a LearnDash site renders a page, it enqueues CSS and JavaScript assets from under wp-content/plugins/sfwd-lms/, and those asset URLs appear in the HTML that Shodan captures in its http.html banner. That asset-path string is a high-confidence fingerprint: a generic WordPress site does not reference sfwd-lms paths, so its presence in the captured HTML is a strong positive signal for LearnDash. We located candidate sites using Shodan's HTTP content filters, which match against the HTML and component metadata Shodan already stored for each host: - http.html - matches literal strings in the captured page source (for example, the sfwd-lms asset path or LearnDash-specific markup and class names). - http.component - matches Shodan's own technology fingerprints (for example, that the host is WordPress). - http.favicon.hash - matches the MurmurHash3 of a site's favicon, usable as a secondary asset fingerprint. An illustrative query of the shape we used (shown for transparency, not as the literal production string) is: http.component:"WordPress" http.html:"wp-content/plugins/sfwd-lms" From the raw matches we deduplicated to unique live hosts (collapsing multiple banners or ports belonging to the same site), discarded records that did not resolve to a reachable LearnDash front end, and arrived at the final sample of 174 publicly reachable live LearnDash sites. All banner data reflects Shodan's index as of the May 2026 data pull. The 174 sites are the complete set that met our criteria in Shodan's index at that time; they are a sample of Shodan-indexed LearnDash sites, not a census of all LearnDash sites on the internet (see Limitations). ### How each finding maps to a Shodan data field Every published number is derived from a specific, named field in the Shodan banner. We did not infer anything we could not read directly from the captured record. - Security response headers (HSTS, CSP, X-Frame-Options). Shodan stores the full HTTP response headers a server returns. We checked each captured banner for the presence of Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options. A header was counted as "missing" only when it was absent from the banner Shodan recorded. Findings: 90% had no HSTS, 87% had no CSP, 81% had no X-Frame-Options. - PHP version. When a server discloses PHP, it typically appears in the X-Powered-By (for example, PHP/7.4.33) or Server header. We read the version from those headers. Many sites suppress this header, so this finding is reported only over the sites that actually exposed a PHP version, and the headline figure is stated that way: of those sites, 77% were on an end-of-life PHP release. - WordPress core version. WordPress version strings surface in the captured HTML through the tag and through ?ver= query parameters appended to enqueued core assets. We parsed those strings from the http.html banner. About 50% of sites were on a WordPress core version that is no longer in the actively supported branch. - LearnDash version and plugin inventory. Plugin presence and versions are read the same way: from wp-content/plugins// asset paths and their ?ver= strings in the captured HTML. Counting the distinct third-party plugin slugs referenced per site gave a median of about 7.5 plugins per site. The same parsing identified that about 25% of sites referenced the Uncanny Owl "Toolkit for LearnDash" add-on via its plugin asset path. - CVE association. Shodan attaches a vulns object to a banner when a detected product/version maps to known CVEs. Each entry carries a cvss score, a summary, references, and a verified boolean. We used the detected WordPress/LearnDash/PHP versions and Shodan's CVE mapping to determine whether a site was running a version associated with a known critical CVE. On that basis, 43% of the sample (about 75 of 174) was running at least one component version associated with a critical CVE. ### What "critical" means here We define a vulnerability as critical using the standard CVSS v3.1 qualitative scale published by FIRST, under which a base score of 9.0 to 10.0 is rated Critical. Shodan's vulns entries carry CVSS scores, so a site was placed in the "critical" bucket when at least one CVE associated with one of its detected versions had a CVSS v3.1 base score of 9.0 or higher. ### Honest framing of the CVE finding This is a version-inference result, and we have worded the finding deliberately to reflect that. The 43% figure means "43% were running a version that has a known critical CVE," not "43% are confirmed exploitable." Shodan itself distinguishes verified: true vulnerabilities (actively confirmed) from verified: false ones (implied from the version number alone), and it explicitly warns that version-inferred associations can carry false positives. The mapping is based on the disclosed version string, not on a successful exploit. A site flagged this way may in fact be protected: it may have backported a security patch without changing its public version number (a patch that does not bump the version is invisible to Shodan), it may sit behind a WAF or CDN that blocks the relevant attack path, or the vulnerable code path may not be reachable in its configuration. We did not, and could not, test exploitability without touching the sites, which we chose not to do. The careful phrasing throughout this study - "running a version with a critical CVE" - is exact and intentional. ## Limitations - Shodan is an index, not a census. Our sample is limited to LearnDash sites that Shodan had already crawled and indexed on the ports it scans. Sites Shodan had not yet visited, sites on non-standard ports, and sites that block or evade Shodan's crawlers are not represented. The 174 sites are a sample of Shodan-indexed LearnDash installs, not the entire population of LearnDash sites on the internet, and they should not be read as a statistically random sample of it. - Fingerprint and version detection can miss or misclassify. LearnDash, WordPress, and plugin identification depend on version strings and asset paths appearing in the captured HTML. Sites that strip the generator meta tag, remove ?ver= parameters, rename assets, or otherwise obfuscate these markers may be undercounted or have their versions misread. Conversely, cached or stale markup could in rare cases misattribute a version. - Sites behind a CDN, reverse proxy, or WAF may hide data, so several findings are lower bounds. Cloudflare and similar layers frequently rewrite or suppress Server / X-Powered-By headers and can strip version markers from HTML. Where a protective layer hid a version or a header, the underlying software may still be outdated or the header may still be absent at origin - but we did not count what we could not see. The header-absence and end-of-life percentages should therefore be treated as conservative lower bounds, not ceilings. - The CVE mapping is version-based, not exploit-confirmed. As detailed in the Methodology, a "critical CVE" association means the detected version is one for which a critical CVE is known. It does not confirm the site is exploitable. Backported patches (which do not change the public version), WAF protection, and non-reachable code paths can all render a flagged site non-exploitable in practice. - Header and version findings are a point-in-time snapshot. Each banner reflects the single moment Shodan last crawled that specific host, and different hosts were last crawled on different dates. Shodan's crawl cadence means some records may be days or weeks old. A site may have added security headers, upgraded PHP, or patched WordPress after its banner was captured, and that change would not be reflected here. - Restricted-base percentages are stated over their base, not the full sample. The PHP figure (77% on end-of-life PHP) is calculated only over the subset of sites that actually exposed a PHP version in their headers, because PHP version disclosure is optional and many sites suppress it. It is not 77% of all 174 sites. All other percentages are over the full 174 unless explicitly noted. ## Cite this study This page is intended to be citable. If you reference these findings, please link to the source URL so readers can review the methodology and limitations. Plain citation > Cubite (2026). We Scanned 174 Live LearnDash Sites in 2026: The Security Findings. Retrieved from https://cubite.io/blogs/learndash-security-scan-2026 APA style > Cubite. (2026). We scanned 174 live LearnDash sites in 2026: The security findings. Retrieved from https://cubite.io/blogs/learndash-security-scan-2026 The underlying aggregate findings on this page are released under a [Creative Commons Attribution 4.0 International (CC BY 4.0)](https://creativecommons.org/licenses/by/4.0/) license. You may share and adapt the data, including for commercial use, with attribution to Cubite and a link to this page. ## Run by Cubite ## Ready to get started? This scan was run by Cubite. If the findings have you reconsidering who owns your stack's patch cadence, Cubite LMS is a managed LMS at a flat $290 a month or $2,900 a year (unlimited users and courses; hosting, maintenance, and support bundled; 0% transaction fees; SCORM and xAPI, white-label, certificates, and analytics), so the version updates, runtime, and security headers measured above are handled for you. SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. Moving off LearnDash? LearnDash's WordPress export (WXR) carries course content only; learners, enrollments, progress, quiz scores and certificates live in the database, so a move to a hosted LMS needs a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. Start with the free LearnDash migration assessment below. [book a free migration assessment](https://cubite.io/learndash-migration) --- # The Best LearnDash Alternative for Universities and Enterprise (2026) https://cubite.io/blogs/learndash-alternative-for-universities **By:** Amir Tadrisi **Updated:** 2026-10-01 Institutional buyers do not choose a learning platform the way a solo course creator does. A university procurement office or an L&D director at a 5,000-seat company starts with a requirements checklist, runs it past IT and legal, and disqualifies anything that fails on security, standards, or accessibility before price ever enters the conversation. According to the [2026 enterprise LMS buyer guides](https://innovito.com/nterprise-lms-buyer-guide-2026/), the items that get a platform cut early are almost always the same: no proper SSO, no native content standards, weak audit logging, or an unanswered question about who owns the data. LearnDash is the most popular learning management plugin for WordPress, and for a single instructor selling courses it is genuinely excellent. But the institutional checklist is where the WordPress-plugin model starts to strain, because many of the things a university or enterprise treats as table stakes are, on LearnDash, either "no," "paid add-on," or "bring your own third-party plugin." This page grades that honestly and explains where a managed platform like [Cubite LMS](https://cubite.io) fits. One boundary up front, because SSO is on nearly every institutional checklist: Cubite LMS costs $290 a month or $2,900 a year, and SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. ## LearnDash Alternative for Universities and Enterprise: What Actually Matters Before comparing products, it helps to name what institutional buyers actually require. A [comprehensive LMS requirements checklist](https://www.d2l.com/blog/lms-requirements/) for 2026 deployments consistently includes: - Cohorts and scheduled sessions - run the same program for different groups on different start and end dates. - SSO via SAML 2.0 / OIDC - integrate with Azure AD, Okta, Google Workspace, or campus LDAP so nobody manages a separate password. - Native SCORM and xAPI - import Articulate, Captivate, and iSpring packages and track them, plus xAPI activity statements for a learning record store. - Programmatic certificates - issue verifiable completion credentials automatically at scale. - Advanced analytics and reporting - cohort progress, completion rates, quiz analytics, exportable for compliance. - White-label and multi-tenant academies - your brand, your domain, and (for many institutions) separate sub-academies per department, client, or partner. - Accessibility - WCAG 2.1 AA conformance with a current VPAT, because [15% of the population lives with a disability](https://www.proprofstraining.com/blog/lms-requirements/) and inaccessible platforms create real legal exposure. - Data ownership and security - clear data residency, audit logs, RBAC, and a path to SOC 2 / ISO 27001 conversations. The "learndash alternative for universities" and "learndash alternative for enterprise" searches are really searches for a platform that says "yes" to most of this list out of the box, without stacking five vendors on top of WordPress to get there. ## Grading LearnDash Honestly Against the Institutional Checklist LearnDash is a WordPress plugin, so its institutional capabilities depend on what WordPress, the hosting stack, and a chain of add-ons provide. That is not a knock. It is just the architecture, and it is the single most important thing for a procurement team to understand. Here is the honest grade. | Institutional requirement | LearnDash (WordPress plugin) | Cubite LMS (managed platform) | | --- | --- | --- | | Cohorts / scheduled sessions | Yes, native via Group Start and End Dates | Yes, native cohorts and scheduling | | SSO (SAML 2.0 / OIDC) | No native; needs a third-party plugin (miniOrange, WPO365) | Google, GitHub or Facebook sign-in included; SAML SSO and SCIM on Enterprise | | Native SCORM import | No; needs a paid add-on (GrassBlade or Tin Canny) | Yes, native SCORM 1.2 / 2004 | | xAPI + learning record store | No native; add-on plus an LRS required | Yes, native xAPI | | Programmatic certificates | Yes, built in | Yes, built in | | Advanced analytics / reporting | Basic built-in; advanced via ProPanel add-on | Yes, advanced analytics included | | White-label | Yes, via WordPress theming | Yes, full white-label included | | Multi-tenant academies | No; not a core capability | Yes, native multi-tenant | | Accessibility (VPAT) | Core plugin has a VPAT; add-ons not yet third-party audited | Platform-level accessibility | | Hosting, security, uptime | Your responsibility (self-managed WordPress) | Managed and bundled | | Data ownership | Yes, your database, but you operate it | Yes, your data, operated for you | A few of these deserve credit, because a fair comparison earns trust. LearnDash genuinely does cohorts well: [Group Cohorts with Start and End Dates](https://www.learndash.com/support/docs/users-groups/groups/group-cohorts/) let you run seasonal sessions cleanly, and group courses auto-enroll members. Certificates are built in. White-labeling through WordPress theming is flexible and well understood. And LearnDash has done real accessibility work: it [publishes a VPAT / Accessibility Conformance Report](https://www.learndash.com/accessibility/learndash-lms-compliance/) for the core plugin, which many WordPress LMS plugins do not bother with. Where it gets more nuanced is that LearnDash notes its add-ons have not yet been third-party audited, so an institution relying on ProPanel or other add-ons cannot yet point to a complete conformance picture. The pattern across the rest of the table is the WordPress-plugin model showing its seams. SCORM and xAPI are not native: you need a paid add-on like [GrassBlade xAPI Companion](https://www.nextsoftwaresolutions.com/grassblade-xapi-companion/) or [Tin Canny by Uncanny Owl](https://www.uncannyowl.com/downloads/tin-can-lrs-learndash-report-toolkit/), and in many cases a separate learning record store, to do what universities consider basic. SSO is the same story: there is no native SAML, so you license a [SAML SSO plugin like miniOrange or WPO365](https://plugins.miniorange.com/learndash-wordpress-single-sign-on-sso). Advanced reporting means [ProPanel 3.0](https://www.learndash.com/propanel-by-learndash/), another add-on. Each addition is a license, an update cycle, and a vendor dependency that your team has to keep compatible through every WordPress and PHP upgrade. ### The hidden cost: total stack, not the sticker price LearnDash's 2026 pricing is straightforward on paper: Essentials at $259/year, Pro at $399/year, and Elite at $599/year, all with unlimited courses and learners and MemberDash bundled. That is reasonable. But the institutional total cost of ownership is the plugin plus a SCORM/xAPI add-on, plus an LRS, plus an SSO plugin, plus hosting that can survive enrollment spikes, plus a developer or agency to keep all of it patched and secure. For an institution, the integration burden and the security ownership are usually the bigger line items than any one license. ## Cubite LMS: The Managed Institutional Pick [Cubite LMS](https://cubite.io) is built for the buyer who wants the institutional checklist answered without assembling and operating a WordPress stack. It is a managed platform at a flat $290/month, and that single number bundles what would otherwise be five or six separate decisions: - Unlimited users and courses - no per-seat pricing to renegotiate as a program scales from one department to the whole organization. - Native SCORM and xAPI - import your authoring-tool packages and track xAPI activity without buying GrassBlade, Tin Canny, or a separate LRS. - SSO with Google, GitHub or Facebook sign-in - included. Connecting Azure AD, Okta or a campus identity provider needs SAML SSO; SAML SSO and SCIM are on the Enterprise plan. - Programmatic certificates - automatic, verifiable completion credentials. - Advanced analytics and reporting - cohort progress, completion, and quiz analytics in the core product. - White-label and multi-tenant - your brand, your domain, and separate academies per department, client, or partner. - Hosting, maintenance, and support bundled - uptime, security patching, and backups are operated for you, not added to your team's backlog. - 0% transaction fees - if you sell or charge for programs, you keep the revenue. The framing matters. LearnDash gives you the parts and asks you to be the integrator and the operator. Cubite gives you the assembled, maintained platform and asks you to focus on the learning. For an institution where the engineering team is busy and procurement is allergic to "you'll need a few more plugins for that," the managed model is usually the cheaper and safer path once you count the people-hours. If you are leaving LearnDash, Cubite runs the move for you from a database export, and the [free LearnDash migration assessment](https://cubite.io/learndash-migration) maps what carries over. ## Ready to get started? Join thousands of learners and start building your skills today. [Book a free migration assessment](https://calendly.com/cubite/30min) > > CTA type: hard. Trigger: the reader has just seen the institutional feature gap and wants it priced against their own setup. ## White-Label and Multi-Tenant Academies For universities and enterprises, white-label is rarely a single branded site. It is usually a multi-tenant requirement: one platform hosting many distinct academies. A university runs separate portals for continuing education, the medical school, and corporate partnerships. A company runs separate academies for employees, for channel partners, and for customer training. Each needs its own branding, its own domain or subdomain, its own admins, and isolated learner data. This is where the WordPress-plugin model hits its hardest wall. LearnDash white-labels well through theming, but it is not multi-tenant by design. Serving ten isolated branded academies typically means ten WordPress installs (or a complex multisite setup) to provision, patch, and secure. That multiplies the operational surface area: ten update cycles, ten sets of add-on licenses, ten places a vulnerability can appear. Cubite treats multi-tenancy as a first-class feature. You spin up multiple white-labeled academies from one managed platform, each with its own brand, domain, administrators, and data boundary, while billing, hosting, and security stay centralized. For an institution that needs to launch a partner academy this quarter and another next quarter, that is the difference between a configuration change and an infrastructure project. ## A Note on the Open-Source Self-Host Path If your institution has a dedicated IT team that wants to own the full stack on its own servers, the standalone open-source platforms are worth knowing about. [Moodle](https://moodle.org) are mature, standalone (not WordPress) systems with native SCORM support and deep institutional roots in higher education. They are genuinely capable and they are free to license. The tradeoff is that "free to license" is not "free to run." Self-hosting either one means your team owns provisioning, scaling, upgrades, security patching, and accessibility remediation indefinitely. For institutions with that capacity it can be the right call. For the much larger group that wants institutional capability without standing up an ops team, a managed platform removes that burden. We mention these once for completeness, not as a recommendation over Cubite. ## How Cubite Compares Across the Model | Dimension | WordPress plugins (LearnDash, LifterLMS) | Self-host open source (Moodle) | Cubite LMS | | --- | --- | --- | --- | | Architecture | WordPress plugin | Standalone open source | Managed standalone platform | | Native SCORM / xAPI | Add-on required | Native | Native | | SSO / SAML | Third-party plugin | Native (you configure) | Google, GitHub or Facebook sign-in included; SAML SSO and SCIM on Enterprise | | Multi-tenant academies | Not by design | Possible, you build it | Native | | Who operates it | You | Your IT team | Cubite (managed) | | Predictable cost | License plus your stack | Free license plus infra and staff | Flat $290/mo, bundled | ## Frequently Asked Questions ### Does LearnDash support SCORM and xAPI natively? No. LearnDash does not include native SCORM or xAPI support. To import SCORM packages or send xAPI statements, you need a paid third-party add-on such as GrassBlade xAPI Companion or Tin Canny, and for many setups a separate learning record store. Standalone platforms like Cubite, Moodle, handle SCORM natively, which is why content standards are a common reason institutions look past WordPress plugins. ### Can LearnDash do SSO with our university or corporate identity provider? Not natively. LearnDash has no built-in SAML 2.0 or OIDC single sign-on. You add it through a third-party WordPress plugin such as miniOrange or WPO365, which becomes another license and dependency to maintain. Cubite LMS includes SSO with Google, GitHub or Facebook sign-in at $290 a month or $2,900 a year, with no extra plugin. Signing in through Azure AD, Okta or a campus identity provider needs SAML SSO, and SAML SSO and SCIM are on Cubite's Enterprise plan. ### Is LearnDash a good fit for a university or enterprise? LearnDash can work for institutions, but you should go in clear-eyed: it is a WordPress plugin, so SSO, native SCORM/xAPI, multi-tenancy, hosting, and security are your responsibility or your add-ons' responsibility. It does cohorts and certificates well and publishes a core-product VPAT. The question is whether your team wants to be the integrator and operator. If not, a managed platform like Cubite answers more of the institutional checklist out of the box. ### What does it cost to make LearnDash enterprise-ready? The LearnDash license itself is $259 to $599 per year (Essentials to Elite, checked October 1, 2026). The institutional total cost is higher: add a SCORM/xAPI add-on, often an LRS, an SSO plugin, the Pro tier or higher for advanced reporting, enterprise-grade hosting, and the staff time to keep it all patched and compatible. Cubite bundles SCORM/xAPI, SSO with Google, GitHub or Facebook sign-in, analytics, certificates, white-label, multi-tenancy, hosting, maintenance, and support into a flat $290 a month or $2,900 a year with 0% transaction fees; SAML SSO and SCIM are on its Enterprise plan. ### How hard is it to migrate from LearnDash to Cubite? LearnDash's WordPress export (WXR) carries course content only; learners, enrollments, progress, quiz scores and certificates live in the database, so a move to a hosted LMS needs a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. The practical first step is a mapping exercise: which of your institutional requirements are native in Cubite versus add-ons in your current stack. You can walk through that, and get a migration plan, in a [free LearnDash migration assessment](https://cubite.io/learndash-migration). For the step-by-step process, see the [migrate from LearnDash to Cubite guide](https://cubite.io/blogs/migrate-from-learndash-to-cubite). ## The Bottom Line LearnDash is a strong WordPress LMS plugin, and for a single creator it is hard to beat. For universities and enterprises, the calculus is different. The institutional checklist - SSO, native SCORM and xAPI, multi-tenant white-label academies, advanced analytics, accessibility, and clear data ownership - is where the plugin model turns into a stack of add-ons, licenses, and operational responsibilities that your team has to own. If you want those capabilities answered natively and operated for you, Cubite LMS is the managed institutional pick: $290/month flat, native SCORM and xAPI, SSO with Google, GitHub or Facebook sign-in (SAML SSO and SCIM on Enterprise), white-label and multi-tenant academies, programmatic certificates, advanced analytics, and 0% transaction fees. This is not about LearnDash being bad. It is about whether your institution wants to run a WordPress stack or wants to run learning programs. ## Ready to get started? Join thousands of learners and start building your skills today. [book a free migration assessment](https://calendly.com/cubite/30min) --- # Free LearnDash Alternatives in 2026 (and Their Hidden Cost) https://cubite.io/blogs/free-learndash-alternatives **By:** Amir Tadrisi **Updated:** 2026-10-01 Search "free LearnDash alternative" and you get two honest answers and one inconvenient catch. The honest answers: yes, there are genuinely free WordPress LMS plugins (LearnPress, Tutor LMS, Masteriyo, Sensei LMS), and yes, there are free, open-source, self-hosted platforms (Moodle is the big one). The catch: "free" describes the download, not the operation. The moment you sell courses, support learners, or keep the thing patched, a price tag reappears in a different column. This page does what most "free LMS" roundups avoid. It tells you, plugin by plugin, what the free tier includes versus what Pro gates, then puts a real number on the part nobody quotes: the maintenance, hosting, and security cost of running a "free" LMS yourself. If this is part of a larger move, our [LearnDash alternatives hub](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide) maps every path off LearnDash, paid and free. ## What "free LearnDash alternative" actually means There are two genuinely different kinds of free here, and conflating them is how people end up surprised by a bill. Free-tier WordPress plugins are free to install but live inside WordPress, which you still host, secure, and maintain. The free version is a real product, not a trial, but monetization and serious features sit behind a paid Pro tier. Free open-source self-hosted platforms (Moodle is the main one) have no paid tier at all. The catch moves entirely to operations: you run the servers, the upgrades, and the security yourself, or pay someone to. Both are legitimate. Neither is free once you operate it. The right "free" depends entirely on what you are trying to do. ## The free-tier WordPress plugins: what you actually get These four are the realistic free LearnDash alternatives that stay inside WordPress. All are real, capable plugins with large install bases, and all follow the same pattern: a usable free core, with monetization and advanced features in a paid tier. Here is the honest free-vs-Pro split. | Plugin | Free tier includes | Gated behind Pro | Pro price (annual) | | --- | --- | --- | --- | | LearnPress | Unlimited courses and lessons, quizzes, basic course builder, some free add-ons | Drip content, advanced quizzes, grading, most monetization add-ons (25+ paid extensions) | Pro Bundle ~$249.99/yr (3 sites) | | Tutor LMS | Course and lesson builder, quizzes, front-end dashboard, ~70k+ installs | Certificates, advanced quiz types, content drip, AI Studio, pro themes | From $199/yr (1 site) | | Masteriyo | Built-in payments (Stripe, PayPal), certificate builder, distraction-free focus mode, WooCommerce add-on | Advanced reporting, subscriptions, deeper integrations | $149/yr year one, $299/yr on renewal | | Sensei LMS | Unlimited courses, lessons, quizzes, course management | Selling courses (WooCommerce), interactive blocks, quiz timers, groups and cohorts, content drip | $149/yr (1 site) | A few honest observations, because fairness is the point of a page like this. [Masteriyo](https://masteriyo.com/pricing/) has the most generous free tier of the four. Built-in payment processing and a certificate builder in the free version mean a solo creator can genuinely launch and take money without paying for Pro on day one. That is a real strength. [Sensei LMS](https://senseilms.com/pricing/) is built by Automattic (the team behind WordPress.com and WooCommerce), so it is the most "native" to the WordPress world. The honest catch: the free tier lets you build and run courses but not sell them, since selling lives in Sensei Pro via WooCommerce. [Tutor LMS](https://tutorlms.com/pricing/) and [LearnPress](https://learnpresslms.com/pricing-plan/) both ship a strong free builder and gate the things a real course business needs (certificates, drip, advanced quizzing, monetization) behind Pro. LearnPress in particular sells its value as a library of 25+ paid add-ons rather than one tier. The pattern is consistent: the free tier is enough to validate an idea, and Pro is what you buy the day you get serious, landing roughly in the $149 to $299 per year band. That is the floor, not the ceiling, which is where the hidden cost starts. ## The free self-hosted platforms: Moodle If you want free with no paid tier at all, you leave WordPress and go to open-source self-hosted. Moodle is the dominant one: free, open-source, used by universities and large organizations worldwide, and with native SCORM support out of the box (which LearnDash does not have, since LearnDash needs a paid add-on like GrassBlade or Tin Canny plus a separate Learning Record Store). For formal education, compliance training, and standards-based content, Moodle is a genuinely powerful free option and deserves its reputation. Open edX is the other major open-source self-hosted platform, also free and also with native SCORM, built for large-scale structured delivery. The thing to understand here: there is no license fee because the cost was never in the license. It is in the operation. A self-hosted instance is software you are now responsible for hosting, upgrading, backing up, and securing. "Free" describes the download accurately and the year incompletely. ## The wedge: "free" is not free once you operate it Here is the part the roundups skip. Whichever free path you pick, the bill reappears the moment you go from "installed" to "operating." It just arrives in three quieter columns. 1. Monetization re-prices the plugins. As the table above shows, the day you need certificates, drip content, real quizzing, or the ability to actually sell, you are buying Pro. That is roughly $149 to $299/yr for the mid-tier plugins, and that is before hosting. So "free LearnDash alternative" quietly becomes "$149 to $299/yr LearnDash alternative" for any business that, well, does business. (For LearnDash's own current tiers, see our dedicated [LearnDash pricing breakdown](https://cubite.io/blogs/learndash-pricing-2026); the short version is its paid tiers run higher, but the plugin-tier logic is the same.) 2. Self-hosting carries a real maintenance and hosting cost. A free Moodle (or any WordPress plugin, free or Pro) still needs a server, a database, backups, monitoring, and upgrades. LMS-grade managed hosting alone runs from a few hundred to a couple thousand dollars a year, and a major version jump is a project, not a checkbox. That work is either your evenings or a developer's invoice. 3. The security cost is the one that hurts, and it is measurable. This is the column that turns "free" into a liability. We ran an external, non-intrusive scan of 174 live LearnDash sites in May 2026, and the result is a fair proxy for any self-operated WordPress LMS stack that nobody is paid to keep current: [43% were running a version with at least one known critical CVE](https://cubite.io/blogs/learndash-security-scan-2026), and about half were on an out-of-support WordPress core. The free LMS plugins above run on the same WordPress substrate, so they inherit the same exposure the moment patching slips. A CVE (Common Vulnerabilities and Exposures, a catalogued, publicly known security flaw) on a public site that takes payments and holds user accounts is not theoretical; it is lookup-able. Put the three columns together and you get the real total cost of ownership (TCO): | "Free" cost line | Free-tier plugin path | Self-hosted Moodle | | --- | --- | --- | | Software license | $0 free / $149 to $299/yr at Pro | $0 (no paid tier) | | Hosting | You buy and manage it | You buy and manage it | | Upgrades and maintenance | Your time, every plugin | Your time, major version jumps are projects | | Security patching | Your responsibility (see 43% finding) | Your responsibility | | Developer time (TCO) | The real recurring cost | The real recurring cost | The honest summary: the license is the cheapest part of running an LMS. The expensive part is the developer-hours, hosting, and security cadence that "free" hands to you. For a solo creator validating an idea, that trade is fine. For a team running revenue, training, or compliance through the platform, the hidden cost is the whole cost. ## So when is free actually the right call? Free is the right answer in real cases, and it is worth being direct about them. - You are a solo creator validating a course idea and have not made a dollar yet. Start free (Masteriyo's free tier is especially good for this) and pay only when revenue justifies it. - You are a university, school, or org with in-house IT that already runs servers. Moodle's free-and-native-SCORM combination is a genuinely strong fit, and the operations cost is absorbed by a team you already pay. - You are technical, you enjoy owning your stack, and the maintenance is a feature to you, not a tax. If you are one of those, a free LearnDash alternative is the correct tool, not a compromise. The trade flips when the LMS becomes load-bearing for a business and nobody wants to be the one patching it at 2am. Then you are no longer choosing between "free" and "paid," but between "I absorb the hidden cost" and "someone else does." That is the same decision we walk through in [LearnDash self-hosted vs SaaS](https://cubite.io/blogs/learndash-self-hosted-vs-saas): it depends on who you want owning the maintenance and the patch cadence. ## The paid exit that removes the hidden cost: Cubite LMS If the appeal of "free" was never the zero on the invoice but the simplicity you imagined came with it, there is a cleaner version of that, and it is a paid one. [Cubite LMS](https://cubite.io) is a managed platform at a flat $290/month, all-in. No WordPress plugin stack to assemble, no add-ons to renew, no server for you to patch. That one number bundles the exact line items that turn a "free" LMS into a four-figure operation: hosting, maintenance, and support, plus unlimited users and courses, 0% transaction fees, native SCORM and xAPI, white-label, certificates, and analytics. SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. The 43% critical-CVE problem above is not your problem on Cubite, because keeping the runtime current and secure is what the monthly fee buys. | What you are really paying for | Free LMS path (operated) | Cubite LMS | | --- | --- | --- | | Monthly / annual cost | $0 to ~$299/yr license, plus hosting and your time | $290/mo, all-in | | Hosting | You buy and manage it | Included | | Maintenance and upgrades | Your job, every component | Included | | Security patching | Your responsibility | Included and managed | | Native SCORM + xAPI | Moodle yes; plugins need add-ons | Included, native | | White-label, certificates, analytics, SSO | Add-ons or DIY | Included (SSO with Google, GitHub or Facebook sign-in; SAML SSO and SCIM on Enterprise) | | Transaction fees | Varies by gateway and add-on | 0% | This is not a knock on Moodle or the free plugins. They are good software, and for the right team they are the right call. Cubite is simply the option for teams that want out of the WordPress-plugin model entirely and would rather pay one predictable bill than pay in developer-hours and security risk. If your free plan keeps turning into a maintenance job, the paid exit is the one that gives you back the time it was costing you. If you are coming from LearnDash specifically: LearnDash's WordPress export (WXR) carries course content only; learners, enrollments, progress, quiz scores and certificates live in the database, so a move to a hosted LMS needs a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. Here is how to [migrate from LearnDash to Cubite without losing data](https://cubite.io/blogs/migrate-from-learndash-to-cubite), and the [free LearnDash migration assessment](https://cubite.io/learndash-migration) maps what carries over for your site. ## Ready to get started? Join thousands of learners and start building your skills today. [Book a free migration assessment](https://calendly.com/cubite/30min) ## Frequently asked questions ### What is the best free LearnDash alternative in 2026? For a free WordPress plugin, Masteriyo has the most generous free tier (built-in payments and certificates in the free version), while Tutor LMS, LearnPress, and Sensei LMS offer capable free cores with monetization gated behind Pro. For a free, no-paid-tier self-hosted platform, Moodle is the strongest option and includes native SCORM. The best choice depends on whether you want to stay in WordPress or self-host, and on whether you will own the maintenance. ### Are free LearnDash alternatives really free? The download is free; the operation is not. Free-tier plugins gate monetization and key features behind a Pro tier that typically runs $149 to $299 per year, and they still need WordPress hosting and patching. Free self-hosted platforms like Moodle have no license fee at all but shift the full cost to hosting, upgrades, and security, which you do yourself or pay a developer to do. Free stays genuinely free only while you stay small and own the maintenance. ### Does Moodle have native SCORM and LearnDash does not? Yes. Moodle supports SCORM natively, out of the box. LearnDash does not have native SCORM; it requires a paid add-on such as GrassBlade or Tin Canny plus a separate Learning Record Store (LRS). If standards-based content is a hard requirement, that is a meaningful difference between the free self-hosted platforms and the LearnDash plugin model. ### What is the hidden cost of a free LMS? Three things: monetization (Pro tiers at roughly $149 to $299/yr the day you sell or certify), hosting and maintenance (you own the servers, backups, and upgrades), and security patching. The security cost is sharpest: in a May 2026 scan of 174 live LearnDash sites, 43% ran a version with at least one known critical CVE, which is what happens to any self-operated WordPress LMS when patching slips. The license is the cheapest part; developer time and security cadence are the real recurring cost. ### When should I pay for a managed LMS instead of using a free one? Pay for managed when the LMS becomes load-bearing for a business, that is, when it earns revenue, delivers compliance or training, and downtime or a breach would actually hurt. Then the question stops being "free vs paid" and becomes "who owns the maintenance and security." A managed platform like Cubite ($290/mo, all-in) removes the hosting, upgrade, and patching burden entirely. If you are a solo creator validating an idea, free is still the right call. ## The bottom line - The free options are real. Free-tier plugins (LearnPress, Tutor LMS, Masteriyo, Sensei LMS) and free self-hosted Moodle are legitimate LearnDash alternatives, not traps. - Free describes the download, not the year. Plugin Pro tiers land around $149 to $299/yr the moment you monetize, and every path still needs hosting, upgrades, and security work. - The security cost is measurable. 43% of 174 live LearnDash sites ran a version with a known critical CVE in May 2026, the exposure any self-operated WordPress LMS inherits when patching slips. - Free is right for solo creators and IT-equipped orgs, and is the hidden cost for teams running revenue or compliance on it. - Cubite is the paid exit from that hidden cost. $290/mo, all-in, managed, no plugin stack, with hosting, security, native SCORM and xAPI, and white-label bundled in. ## Ready to get started? If your "free" plan keeps turning into an unpaid maintenance job, the smartest next step is to price your real all-in cost against one flat number. we will do that math with you [Book a free migration assessment](https://calendly.com/cubite/30min) --- # Thinkific vs LearnDash (2026): An Honest Comparison https://cubite.io/blogs/thinkific-vs-learndash **By:** Amir Tadrisi **Updated:** 2026-10-01 ## Thinkific vs LearnDash: the quick verdict If you want a course platform you never have to host or patch, Thinkific is the simpler answer. If you want your courses to live inside your own WordPress site with full control over content, SEO, and customization, LearnDash is the more flexible one. That is the whole comparison in two sentences, and it is genuinely close for a lot of buyers. The catch is that these two products are not the same kind of thing. Thinkific is a hosted SaaS platform: you sign up, and the hosting, updates, and security are someone else's job. LearnDash is a WordPress plugin: you own the site, the data, and the entire maintenance burden that comes with running WordPress in production. So "Thinkific vs LearnDash" is really a question about which model you want, not just which feature list you prefer. This guide compares them fairly, shows where each one wins, names the one risk LearnDash and every other WordPress LMS plugin share in 2026, and then offers a third path for teams that want hosted simplicity without giving up the things WordPress was good at. | | Thinkific | LearnDash | | --- | --- | --- | | Architecture | Hosted SaaS (no WordPress) | WordPress plugin | | You host and maintain | No (vendor handles it) | Yes (you run WordPress) | | Pricing (2026) | Free plan; paid roughly $49 to $199/mo | $259 / $399 / $599 per year (Essentials / Pro / Elite) | | Transaction fees | 0% on paid plans (US) | None (you run your own checkout) | | SCORM / xAPI | SCORM on higher / Plus tiers only | No native SCORM; needs a paid add-on plus an LRS | | Data ownership | Lives on Thinkific's platform | Lives in your own database | | SEO and customization | Templated, platform-controlled | Full control via WordPress | | Plugin / security upkeep | None | Ongoing (WordPress + plugin stack) | | Best for | Solo creators wanting hosted simplicity | WP-native teams wanting control | --- ## Where Thinkific wins Thinkific removes an entire category of work. Because it is hosted SaaS and not WordPress, there are no plugins to update, no PHP version to babysit, no database to back up, and no hosting bill to manage separately. You log in and build courses. For a solo creator or a small team without a developer, that is a real advantage, and it is the main reason people pick it. A few concrete strengths: - Onboarding is fast. There is a free plan to start on, and paid plans run roughly $49 to $199 per month depending on tier and features. You can have a course live the same day without touching infrastructure. - No transaction fees on paid plans. In the US, Thinkific charges 0% transaction fees on its paid plans, so the platform does not take a cut of each sale (you still pay normal payment-processor fees). - Predictable, all-in cost. Hosting, uptime, security patching, and updates are bundled into the subscription. You are not quoted one price and then surprised by a hosting and maintenance bill on top. - No maintenance liability. When a vulnerability is disclosed in the platform, Thinkific patches it. You are not the person responsible for noticing and fixing it. Choosing Thinkific does mean leaving WordPress entirely. That is the trade: you give up the WordPress plugin ecosystem, deep SEO control, and full ownership of your data and site, and in return you stop running infrastructure. For a creator whose business is the courses and not the website, that trade is often the right one. --- ## Where LearnDash wins LearnDash wins on control and ownership. It is a WordPress plugin, so your courses live inside a site you fully own, sitting next to your blog, your marketing pages, and whatever else WordPress already runs for you. If you have invested in WordPress and want your LMS to be part of that, LearnDash fits in a way a hosted SaaS never can. Where it pulls ahead of Thinkific: - Full data ownership. Your course content, users, and progress live in your own database on your own hosting. Nothing is locked inside a vendor's platform. - Deep SEO and customization control. WordPress gives you control over URLs, schema, page structure, themes, and every SEO lever. Thinkific's templated approach cannot match that depth. - The WordPress plugin ecosystem. Memberships, page builders, marketing tools, CRMs, and thousands of integrations plug straight in. LearnDash also bundles MemberDash in its 2026 tiers. - Flat annual pricing, unlimited courses and learners. LearnDash's 2026 pricing is Essentials $259, Pro $399, and Elite $599 per year, with unlimited courses and learners on every tier. You run your own checkout, so the platform takes no cut of sales. LearnDash also has one notable gap worth stating plainly: it has no native SCORM support. To run SCORM packages you need a paid add-on such as GrassBlade or Tin Canny, plus a separate Learning Record Store (LRS). Thinkific supports SCORM only on its higher / Plus tiers, so neither product makes SCORM effortless, but it is a real limitation to plan around if compliance or corporate training content matters to you. --- ## The catch they do not advertise (and only one of them has) Here is the part most comparison articles skip. Thinkific and LearnDash are not symmetric on risk, because only one of them is a WordPress plugin. Thinkific, as hosted SaaS, carries no plugin-stack maintenance burden for you. LearnDash, as a WordPress plugin, carries the full one. And in 2026 that burden is not theoretical. When we ran an external, non-intrusive scan of [174 live LearnDash sites](https://cubite.io/blogs/learndash-security-scan-2026) in May 2026, the numbers were sobering: - 43% were running a LearnDash version associated with at least one known critical CVE. - About 50% were on an out-of-support WordPress core. - 77% of the sites that exposed a PHP version were on an end-of-life PHP release. - The median site ran about 7.5 third-party plugins alongside LearnDash, each one its own patch cadence. - 90% sent no HSTS header, 87% no Content-Security-Policy, and 81% no X-Frame-Options. None of that is a knock on LearnDash the software. It is a description of what happens when responsibility for updates, runtime, security headers, and a stack of plugins lands on busy site owners who would rather be building courses. The same pattern applies to any WordPress LMS plugin: LearnDash, LifterLMS, Tutor LMS, or LearnPress all inherit the WordPress maintenance and security model. So the honest framing of "Thinkific vs LearnDash" includes this: part of what you are really comparing is who owns the patch cadence. With Thinkific, the vendor does. With LearnDash, you do, forever, across WordPress core, PHP, and every plugin in the stack. This matters more in 2026 specifically. On April 22, 2026, Liquid Web, which has owned LearnDash since 2021, announced that it was concentrating its WordPress software into four core products, LearnDash among them. The StellarWP brand that sat above them is gone. LearnDash itself is still sold and updated (version 5.2.1 shipped on September 30, 2026); the April 2027 date in the announcement is when critical security patches end for the older tools Liquid Web is retiring, and it lists no LearnDash tools among them. What did not change is who installs those updates on your site: you do. For the full picture of what changed and the realistic ways off, see our [LearnDash alternatives and migration guide](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide). If you are already on LearnDash and weighing a move, the [step-by-step migration walkthrough](https://cubite.io/blogs/migrate-from-learndash-to-cubite) covers the mechanics. --- ## Or skip the plugin model entirely There is a third option that does not show up in most "Thinkific vs LearnDash" comparisons, and it solves the exact tension the two products force on you. Thinkific asks you to leave WordPress and give up data ownership, deep SEO control, and the plugin ecosystem in exchange for hosted simplicity. LearnDash asks you to keep all of that but own a permanent maintenance and security burden. A managed LMS lets you stop running a plugin stack without surrendering the things that made owning your platform worth it. [Cubite LMS](https://cubite.io/) is built for exactly the team that wants out of the WordPress-plugin model but still wants a real, owned platform. It is a flat $290/month, all-in: - Unlimited users and courses, with hosting, maintenance, and support bundled into the one price (no separate hosting bill, no surprise upkeep cost). - 0% transaction fees, so the platform takes no cut of your sales. - Native SCORM and xAPI out of the box, with no paid add-on and no separate LRS to wire up. - White-label, certificates, and analytics included rather than sold as extras. - SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. That is the managed pick: Thinkific's "you never patch anything" simplicity, paired with the ownership and control LearnDash users do not want to give up. For teams running corporate or compliance training, native SCORM and xAPI on every plan removes the add-on-plus-LRS workaround that both Thinkific's standard tiers and LearnDash leave you to assemble. If you are leaving LearnDash: LearnDash's WordPress export (WXR) carries course content only; learners, enrollments, progress, quiz scores and certificates live in the database, so a move to a hosted LMS needs a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. Start with the [free LearnDash migration assessment](https://cubite.io/learndash-migration). To be clear about the wider field: if you need a fully self-hosted, open-source platform with native SCORM and you have the engineering team to run it, standalone options like Moodle exist too. For most teams leaving the plugin model, though, the point is to stop running infrastructure, not to take on a different stack. ## Ready to get started? Join thousands of learners and start building your skills today. [Book a free migration assessment](https://calendly.com/cubite/30min) --- ## Frequently asked questions ### Is Thinkific better than LearnDash? Neither is universally better; they are different models. Thinkific is hosted SaaS, so it is better for solo creators who want zero hosting and maintenance work. LearnDash is a WordPress plugin, so it is better for teams that want full data ownership, deep SEO control, and the WordPress plugin ecosystem, and are willing to own the upkeep. The deciding question is usually not features but responsibility: do you want to never touch infrastructure (Thinkific), or own your platform and accept the maintenance that comes with it (LearnDash)? A managed LMS like Cubite is a third path that gives ownership without the upkeep. ### Does Thinkific or LearnDash support SCORM? Both support SCORM only with caveats. Thinkific supports SCORM on its higher / Plus tiers, not its standard plans. LearnDash has no native SCORM at all; it requires a paid add-on such as GrassBlade or Tin Canny plus a separate Learning Record Store (LRS). If SCORM or xAPI is central to your training, neither makes it effortless. Standalone platforms like Moodle include native SCORM, and managed platforms such as Cubite LMS include native SCORM and xAPI on every plan, which removes the tier-gating and add-on assembly entirely. ### How much do Thinkific and LearnDash cost in 2026? Thinkific has a free plan and paid plans running roughly $49 to $199 per month, with 0% transaction fees on paid plans in the US (hosting and maintenance are bundled in). LearnDash is priced per year: Essentials $259, Pro $399, and Elite $599, each with unlimited courses and learners and MemberDash bundled. Remember that LearnDash's license is not the full cost. Because it runs on WordPress, you also pay for hosting and carry the time cost of maintaining WordPress core, PHP, and your plugin stack. Thinkific's price is all-in by design. ### Do I have to leave WordPress to leave LearnDash? No. You can stay in WordPress and switch to another plugin such as LifterLMS, Tutor LMS, or LearnPress, since all of them run on the same WordPress site. The migration is shorter because the database, hosting, and admin stay the same. The catch is that you also keep the same WordPress maintenance and security model. You only need to leave WordPress if WordPress itself is the friction, for example when you want to stop owning the patch cadence, or you need native SCORM and xAPI without add-ons. In that case a hosted SaaS like Thinkific or a managed platform like Cubite LMS is the move. ## Bottom line - Pick Thinkific if you are a solo creator or small team that wants hosted simplicity, has no developer, and is happy to leave WordPress, its plugin ecosystem, deep SEO control, and data ownership behind in exchange for never touching infrastructure. - Pick LearnDash if you are already invested in WordPress, want full control over content, SEO, and your data, and accept that you own the ongoing maintenance and security of WordPress, PHP, and your plugin stack. - Pick a managed LMS if you want the best of both: ownership and control without the plugin upkeep. Cubite LMS is a flat $290/month all-in, with unlimited users and courses, native SCORM and xAPI, SSO with Google, GitHub or Facebook sign-in, white-label, certificates, and analytics. The real choice in 2026 is not just Thinkific or LearnDash. It is hosted simplicity, owned-but-maintained, or managed-and-owned. Decide which trade you actually want before you decide which logo to sign up for. ## Want a second opinion on which model fits your team? A 30-minute call gets you a straight recommendation, including the honest case for staying where you are if that is the right answer. [Book a free migration assessment](https://calendly.com/cubite/30min) --- # Why the LearnDash + BuddyBoss Stack Breaks for Course Communities https://cubite.io/blogs/learndash-buddyboss-community-alternative **By:** Amir Tadrisi **Updated:** 2026-09-30 A head-to-head look at why the LearnDash + BuddyBoss + bbPress stack breaks for course communities, what it costs, what you can take with you when you leave, and how Cubite handles the same jobs as one integrated platform. If you run an online course on WordPress, you almost certainly arrived at the same stack everyone else does: LearnDash for the courses, BuddyBoss for the social feed and groups, bbPress for forums, GamiPress for points and badges, and a handful of bridge plugins to make them talk to each other. It works, sort of, until it doesn't. Then you start searching for a LearnDash BuddyBoss alternative because the community side of your course - the part that was supposed to keep learners engaged - is fighting you instead of helping you. This is not the pillar overview. If you are still deciding whether you even want a forum built into your LMS, read [our complete guide to choosing an LMS with a built-in discussion forum](/blogs/lms-with-built-in-discussion-forum) first. This article is the head-to-head: what specifically breaks in the LearnDash + BuddyBoss + bbPress stack, what it tends to cost, what you can and cannot take with you when you leave, and how Cubite handles the same jobs as one integrated platform. Cubite sells Cubite LMS and publishes this comparison. ## The core problem: community is bolted on, not built in LearnDash is a course plugin. It does not ship a community. To get discussion, social feeds, groups, and gamification you assemble three to six separate products and then maintain the seams between them. Every seam is a place where an update on one side can silently break the other. Below are the failures that course creators report most often, each tied to a public source. > **WARNING:** Every plugin in the stack is a separate update surface and a separate point of failure. The community side of your course depends on integration seams that no single vendor owns end to end. ### Forum threads attach to courses, not lessons The native LearnDash + bbPress integration links a forum to a course group. It does not link a discussion thread to an individual lesson. When a creator asked the official bbPress support forum how to associate forum topics with specific LearnDash lessons, a bbPress.org moderator replied plainly: "I know of nothing that does this" ([bbPress.org support forum](https://bbpress.org/forums/topic/associating-forum-topics-to-learndash-lessons/)). So the question a learner has about Lesson 7 lands in the same undifferentiated forum as every other question in the course. There is no native way to scope the conversation to the unit it belongs to. ### Focus Mode hides the discussion entirely LearnDash's Focus Mode is the distraction-free lesson view most course sites turn on. The problem: Focus Mode strips out comments and discussion through the learndash_remove_comments function hooked at the wp level. Even if a student posts a comment, it disappears on the next page refresh. The documented fix is to edit functions.php with a PHP snippet, and even after that workaround the comments are visible to every user with no group-level filtering ([ldx.design](https://ldx.design/enable-comments-learndash/)). So the exact place where a learner is most engaged - inside the lesson - is the place where discussion is hardest to show. ### Notifications can email people who aren't even in the course Standard bbPress notifications email users regardless of whether they have access to the course the forum belongs to. The fix is yet another plugin: the "bbPress Notify (No-Spam) / LearnDash Bridge" from UseStrict Consulting, whose documented purpose is "Accurate notifications: no emails to users without course access" ([UseStrict Consulting](https://usestrict.net/product/bbpress-notify-no-spam-learndash-bridge/)). The existence of a paid bridge plugin to make notifications enrollment-aware points to a gap in the base integration. ### Your own UI improvements can break the integration LearnDash shipped a Modern UI (Beta) to improve its lesson experience. But BuddyBoss overrides standard LearnDash templates, so when Modern UI changes the underlying DOM and template hooks, BuddyBoss can stop recognizing the elements - JavaScript listeners fail to inject and video progression breaks silently, meaning videos no longer mark lessons complete. The documented resolution is to disable Modern UI entirely ([LMS Crafter case study](https://lmscrafter.com/case-study-fixing-learndash-video-progression-not-working-with-buddyboss/)). You can end up choosing between LearnDash's own UI roadmap and your community theme. ### Gamification can stop syncing after updates GamiPress is a common answer for points and badges, but its LearnDash integration is not auto-configured and can stop syncing silently after a plugin update. WordPress.org support threads document cases where GamiPress stopped detecting LearnDash entirely, with no LearnDash options appearing in achievement settings, and cases where points stopped awarding on quiz completion after an update ([WordPress.org support](https://wordpress.org/support/topic/gamipress-not-detecting-learndash-no-course-completion-tracking/)). The standard first response is a plugin-conflict test, which says a lot about how many moving parts are in the chain. ### The group-sync layer can be fragile A critical error was reported when creating a LearnDash group tied to a BuddyBoss Social Group while the Private Messaging component was disabled, filed as a high-priority bug, Issue #785, in the BuddyBoss Platform GitHub repository ([buddyboss-platform #785](https://github.com/buddyboss/buddyboss-platform/issues/785)). It was eventually patched, but it illustrates how partially enabling components can take the group-sync integration down. ### bbPress went years without a release bbPress went roughly 3.5 years without a release, from November 2021 to April 2025. Wordfence has flagged it as "abandoned" in vulnerability scans, and WPScan documents 10 vulnerabilities including a Cross-Site Request Forgery to Limited Privilege Escalation issue fixed in version 2.6.12 ([WPScan](https://wpscan.com/plugin/bbpress/)). Development resumed in 2025, but the multi-year gap set a maintenance pattern that security tooling still flags. ### And LearnDash's owner has wound down This is the part many creators have not fully absorbed. StellarWP was dissolved by Liquid Web on April 22, 2026. LearnDash's Product Owner was laid off in November 2025 in a roughly 25% staff reduction. LearnDash.com now redirects to Liquid Web's main domain, and Liquid Web has committed to security patches only through April 2027 for retiring features, with no published feature roadmap ([MemberPress](https://memberpress.com/blog/what-happened-to-learndash-stellarwp-collapse/)). Much of the team that built and maintained LearnDash has left. If you are choosing a stack for the next five years, that is a material fact. We mapped what changed and every way out in [the five migration paths off LearnDash](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide). > **INFO:** StellarWP was dissolved on April 22, 2026. Liquid Web has committed to security patches only through April 2027 for retiring features, with no published feature roadmap. The window to migrate deliberately is finite. --- ## What the stack tends to cost The sticker prices hide the real cost, because every piece of the stack is a separate license. On September 30, 2026, each vendor's own pricing page listed [LearnDash](https://www.learndash.com/pricing/) at $259, $399 or $599 a year (Essentials, Pro or Elite), and [BuddyBoss Launch](https://www.buddyboss.com/pricing/), the lowest BuddyBoss plan with the LearnDash integration and the BuddyBoss Theme, at $199 the first year and $399 a year after that. Hosting is not included in any BuddyBoss plan, so a WordPress host bills you on top, and add-ons such as Uncanny Owl's plugins and the other WordPress plugins for payments, SEO and forms come on top again. If you add the BuddyBoss mobile app, it is a separate product, from $499 the first year and $999 a year after that. Cubite LMS plays SCORM 1.2, SCORM 2004 and xAPI with a built-in learning record store in its Growth plan, $290 a month or $2,900 a year with unlimited learners. Every price, with its source, is in [LearnDash pricing 2026](https://cubite.io/blogs/learndash-pricing-2026). --- ## Cubite vs the LearnDash BuddyBoss alternative question: the head-to-head Cubite takes the opposite approach. The forum is not a plugin you bolt on, it is part of the LMS, per-site and per-course, with no integration seams to maintain. Here is how the two compare specifically on community. | Capability | LearnDash + BuddyBoss + bbPress stack | Cubite | | --- | --- | --- | | Discussion architecture | LearnDash plugin + BuddyBoss + bbPress + bridges | Built into the LMS, one platform | | Per-lesson discussion threads | Course-level only; moderator: "I know of nothing that does this" | Per-lesson topics that point at a specific unit | | Release-gated discussion | Not native | Lesson topics stay hidden until the gating engine unlocks the unit | | Cohort-scoped discussion | Requires social-group sync (can be fragile) | Cohort-divided topics; learners see only their own cohort's threads | | Discussion inside the lesson view | Focus Mode strips comments; needs functions.php edit | Discussion lives in the LMS learning experience; no code edits | | Accepted answers / endorsements | bbPress is a flat forum | Author/moderator accepted answer + separate staff endorsement | | Reputation model | GamiPress add-on, can stop syncing | Built-in quality-weighted reputation, tiers, leaderboard | | Moderation | Flat list of reports | Weighted queue with reporter-trust scoring + sensitivity floor | | Notifications scoped to enrolled students | Needs a paid bridge plugin | @mentions and notifications resolve only against enrolled participants | | Required / graded discussion | Not native | Discussion can gate unit completion and trigger certificate issuance | | Pseudonymous handles | Not native | Pseudonyms with homoglyph-aware anti-impersonation guard | | Maintenance burden | Multi-plugin update conflicts | Single platform, no inter-plugin seams | ### Per-lesson, release-gated, and cohort-divided topics Where the stack tops out at one forum per course, Cubite discussion topics can be scoped to the whole course or to an individual lesson unit. A lesson topic can be release-gated, meaning it stays hidden from a learner until the course's gating engine unlocks that unit, the same engine that controls sequential content release. Topics can also be cohort-divided: threads are stamped with the author's group at creation, and non-moderators only see threads from their own cohort, plus class-wide announcements. That is the lesson-level association the bbPress moderator said does not exist, plus two capabilities the stack has no native answer for at all. ### Discussion that counts toward completion In Cubite, a "Required discussion" block becomes a first-class gating type in the unit-completion engine. A unit is not complete until the learner has posted a minimum number of contributions in the linked topic, later units stay locked until the requirement is met, and posting recomputes completion inline, issuing the course certificate when everything, discussion included, is done. The LearnDash stack treats discussion as optional and social; Cubite can make participation a graded requirement that runs through the same engine as quizzes and assignments. ### Forum-grade quality signals and moderation Each Cubite thread is a discussion or a question. A question can have exactly one accepted answer, set by the thread author or a moderator, and moderators can separately endorse any reply with a "staff endorsed this answer" mark, two distinct quality signals that re-sort to the top. Reputation rewards helpfulness, not volume. > **SUCCESS:** Reputation rewards helpfulness, not volume: an accepted answer is worth 15 points, an endorsement 10, a like 2, a thread 2, and a reply 1, with Discourse-style trust tiers and a leaderboard. --- ## What you can actually take with you when you leave Migration is where the stack reveals its lock-in. Plan around these facts. If you decide to leave, see the full [LearnDash to Cubite migration guide](https://cubite.io/blogs/migrate-from-learndash-to-cubite). - Course content exports cleanly enough. LearnDash lessons, quizzes, featured images, and custom fields export as a JSON zip via the built-in Import/Export tool or the Transfer plugin by Honors WP. The export only covers LearnDash content, not broader WordPress content. - Progress data exports partially. Enrollments, quiz scores, and completion status can be included in the Transfer export by toggling Users Data: Yes, but only for students enrolled in a course or group. Unenrolled users are excluded. - WP All Import drops course associations. If you import via WP All Import instead of Transfer, lessons arrive without course associations and need manual reassignment, a real cost for a large catalog. - Community data does not transfer at all. bbPress threads, BuddyBoss activity-feed posts, social-group memberships, private messages, and user connections have no documented export path to a non-WordPress platform. This data is effectively stranded. - Gamification records need a custom extraction. GamiPress points, badges, and rank history live in custom WordPress tables with no native export tool. - Mobile app users lose access. If you bought the BuddyBoss app tier, those users lose app access on migration; the app is tightly coupled to the Platform plugin and cannot point at a third-party LMS. - The raw MySQL dump is the most complete artifact. It contains learner records, forum threads, and community data, but importing it into a non-WordPress platform requires custom mapping and developer time. - Prepare a redirect map. Course, lesson, and forum URLs change structure when you leave WordPress; build the redirect map before you migrate to preserve rankings and bookmarks. - License keys are sunk costs. LearnDash, BuddyBoss, and add-on licenses are tied to the WordPress install and carry no value to a new platform. > **INFO:** Given the StellarWP dissolution in April 2026 and the security-patch commitment that narrows in April 2027, course creators have a finite window to plan and execute a migration before the support safety net tightens further. Moving deliberately now beats moving in a panic later. --- ## Frequently asked questions ### What is the real cost of running LearnDash with BuddyBoss for a course community? Each piece is billed separately. On September 30, 2026, LearnDash cost $259, $399 or $599 a year, and BuddyBoss Launch, the lowest BuddyBoss plan with the LearnDash integration, cost $199 the first year and $399 a year after that, on each vendor's own pricing page. Hosting is not included in any BuddyBoss plan, and add-ons and other WordPress plugins are billed on top. Cubite LMS costs $290 a month or $2,900 a year per site, with unlimited learners and courses. ### Does LearnDash Focus Mode hide discussion and comments from students? By default, yes. Focus Mode removes comments through a LearnDash function that runs on the WordPress wp hook, so they disappear on refresh. Restoring them requires a functions.php edit, and even then the comments are not filterable by group (ldx.design). ### Can bbPress forum threads be tied to individual LearnDash lessons, not just the whole course? Not natively. The integration works at the course-group level. A bbPress.org moderator responded to a direct request for lesson-level threads with "I know of nothing that does this" (bbPress.org). Cubite supports per-lesson topics tied to a specific unit. ### Do bbPress email notifications respect LearnDash course enrollment? Not in the base integration. Standard bbPress emails go to users regardless of course access, which is why a paid bridge plugin exists specifically to scope notifications to enrolled students (UseStrict Consulting). In Cubite, notifications and @mentions resolve only against enrolled participants. ### Is bbPress still actively maintained and safe to use in 2025 and 2026? bbPress went roughly 3.5 years without a release and has been flagged as "abandoned" by Wordfence; WPScan lists 10 documented vulnerabilities (WPScan). Development resumed in 2025, but the long gap established a maintenance pattern security tools still flag. ### Is there an all-in-one alternative to the LearnDash + BuddyBoss + GamiPress plugin stack? Yes. Cubite is a multi-tenant LMS with the forum built in: per-lesson and cohort topics, accepted answers and endorsements, quality-weighted reputation and leaderboards, a weighted moderation queue, enrollment-scoped notifications, and discussion that can gate completion, all in one platform with no inter-plugin seams to maintain. ## Move your community to a platform that was built with one The LearnDash + BuddyBoss + bbPress stack asks you to assemble a course community out of products that were never designed to work together, then maintain the seams forever, while the company that owns LearnDash winds down. Cubite gives you the same outcomes, deeper in places, as one white-label LMS with the forum native to the product. Per-lesson and cohort-divided discussion, accepted answers and staff endorsements, reputation that rewards helpfulness, a trust-weighted moderation queue, and discussion that can actually count toward a certificate, with nothing to bridge and nothing to break on the next update. ## See course discussion and community as one platform Cubite handles per-lesson and cohort-divided discussion, accepted answers, reputation, moderation, and graded participation natively, with nothing to bridge and nothing to break on the next update. Start planning your migration while the window is open. [Explore Cubite](https://cubite.io) --- # LearnDash Pricing in 2026: The New Liquid Web Tiers https://cubite.io/blogs/learndash-pricing-2026 **By:** Amir Tadrisi **Updated:** 2026-09-30 Short answer (checked September 30, 2026): LearnDash sells [three annual plugin tiers](https://www.learndash.com/pricing/): Essentials $259, Pro $399 and Elite $599 a year, each with unlimited courses and learners and no per-student fees. Cubite sells Cubite LMS and publishes this guide. A LearnDash site has to assemble a licence, WordPress hosting, a SCORM or xAPI player plugin, a learning record store, and group, certificate and reporting add-ons; Cubite LMS ships these in one plan at $290 a month or $2,900 a year. The plugin price is the easy answer. The harder, more expensive answer is what a real production LearnDash stack actually costs once you add the paid add-ons a serious course business needs. This page gives you both: the verified plugin price, then every other line of the total cost of ownership (TCO) with its published price where the vendor publishes one, so you can compare it honestly against an all-in platform. If you have landed here while weighing a switch, you can also [compare all the ways off LearnDash](https://cubite.io/blogs/learndash-alternatives-2026-migration-guide) on our hub page. All-in alternative: Cubite LMS is $290/mo, or $2,900/yr billed annually, flat, with hosting, maintenance, support, SCORM and xAPI, white-label, certificates and analytics all included, versus a production LearnDash stack that pays for the plugin, each paid add-on and managed hosting separately (the dated tables below list each published price). SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. See every plan on [Cubite pricing](https://cubite.io/pricing), get [the free LearnDash migration assessment](https://cubite.io/learndash-migration), or [book a 30-minute call](https://cubite.io/go/book?src=learndash-pricing). ## LearnDash pricing 2026 at a glance (the quick answer) These are the current self-hosted plugin tiers. All are billed annually. There is no monthly option on the self-hosted plugin. | Tier | Price (annual) | Best for | What it adds over the tier below | | --- | --- | --- | --- | | Essentials | $259/yr | Solo creators, simple course catalogs | Core LMS: unlimited courses, unlimited learners, quizzes, drip content, MemberDash bundled | | Pro | $399/yr | Growing course businesses, teams | AI course outline and quiz builder, ProPanel reporting, weighted grading, custom report cards, group leader communications | | Elite | $599/yr | Academies, multi-instructor programs | Group course management and seat selling, instructor role, front-end course creation, multi-instructor courses, ratings and reviews | Every tier shares the same baseline that matters most for budgeting: unlimited courses, unlimited learners, and zero per-student or transaction fees on the plugin itself. You are not taxed for growing your audience. The differences between tiers are features, not seat counts. A quick read on which tier fits: - Essentials is enough if you sell a handful of courses and do not need cohorts, AI authoring, or deep reporting. - Pro is the practical floor for most businesses, because weighted grading, structured cohorts and real reporting are table stakes once you have more than a few learners. - Elite earns its price only if you sell seats to organizations, run multiple instructors or want learners and instructors building courses from the front end. ## LearnDash plus BuddyBoss (checked September 30, 2026) LearnDash and BuddyBoss are separate products with separate annual licenses, and neither license includes hosting. BuddyBoss's pricing page lists no separate LearnDash bundle, and buddyboss.com/bundle redirects to it; the LearnDash integration comes with the BuddyBoss Launch and Scale plans. The table shows what each vendor's own pricing page listed on September 30, 2026, with first-year and renewal prices, and Cubite LMS in the last row for comparison. | Product | Plan | Published price | What the vendor's page says | Source | | --- | --- | --- | --- | --- | | LearnDash | Essentials | $259 a year | One license with unlimited courses and learners and no per-student fees; renews annually | learndash.com/pricing | | LearnDash | Pro | $399 a year | Adds the AI course outline and quiz builder, ProPanel reporting, weighted grading and group leader communications | learndash.com/pricing | | LearnDash | Elite | $599 a year | Adds group course management, seat selling, the instructor role, front-end course creation and multi-instructor courses | learndash.com/pricing | | BuddyBoss | Start | $99 the first year, then $199 a year | No LearnDash integration; on this plan BuddyBoss takes 2.9% of sales made through its own Memberships and Courses | buddyboss.com/pricing | | BuddyBoss | Launch | $199 the first year, then $399 a year | The lowest plan with the LearnDash integration; adds the BuddyBoss Theme; no BuddyBoss fee on sales | buddyboss.com/pricing | | BuddyBoss | Scale | $349 the first year, then $699 a year | Everything in Launch plus points, badges, leaderboards and multilingual support | buddyboss.com/pricing | | BuddyBoss App | Solo | $499 the first year, then $999 a year | A branded app on one store, iOS or Android, sold separately from the web plans | buddyboss.com/pricing | | Hosting | Any WordPress host | Not included | BuddyBoss: you bring your own WordPress hosting, and it is not included in any plan | buddyboss.com/pricing | | Cubite LMS | Growth | $290 a month or $2,900 a year per site | Fully managed and hosted by Cubite on your domain, with native SCORM, xAPI and a built-in LRS and unlimited courses and students | cubite.io/pricing | So a LearnDash site with a BuddyBoss community needs a LearnDash tier plus BuddyBoss Launch or Scale, because Start does not include the LearnDash integration. BuddyBoss sells the first year at a 50% intro discount, and all renewals are at full price. Hosting and a SCORM or xAPI plugin come on top, and so does the app if you want one; the cost table further down lists each one. Cubite LMS costs $290 a month or $2,900 a year per site, with unlimited learners and courses. For what breaks between the two plugins, see [why the LearnDash + BuddyBoss stack breaks for course communities](https://cubite.io/blogs/learndash-buddyboss-community-alternative). ## What changed in LearnDash pricing in 2026 If you priced LearnDash a couple of years ago, the numbers above will not match your memory, and that is the point. The model changed in two structural ways. The pricing axis flipped from site count to features. The previous model was roughly $199, $399, and $799, tiered by the number of sites you could activate on. The 2026 model drops site-count tiers in favor of feature tiers: Essentials, Pro, and Elite. Do not budget against the old $199/$399/$799 numbers - they are no longer current, and we list them here only so you can see what moved. MemberDash is now bundled. Membership and content-protection functionality that you might previously have stitched in separately now ships inside every tier. That genuinely lowers the entry cost for a membership-style course site compared to buying memberships separately - which matters for the TCO math later on. For decided switchers, the takeaway is simple: the plugin got more capable at the bottom tier, but the price floor moved up, and the structure now rewards staying current rather than locking in a one-time deal. ## The lapse trap: legacy pricing does not come back This is the single most expensive footnote in LearnDash pricing, and it rarely shows up in comparison posts. If your subscription lapses, you cannot reactivate your old price. A lapsed plan forces you to buy a new plan at current pricing. Legacy and grandfathered rates cannot be reactivated once they expire. So if you are sitting on an older, cheaper renewal locked in years ago, that rate is contingent on never letting the subscription break - not on a one-time purchase. Why it matters for budgeting: - A missed renewal, an expired card, or a deliberate pause resets you to today's tiers. - The "I bought it years ago for less" advantage is fragile. It survives only as long as the auto-renew chain is unbroken. - When you model multi-year cost, model it at current pricing, not the rate you remember, because one lapse erases the difference. If price stability over five years is a deciding factor for you, this is the clause to weigh most carefully. ## The hosted option: a caveat we will not fake LearnDash has historically offered a hosted product (formerly known as LearnDash Cloud) that bundles hosting with the plugin so you do not manage WordPress yourself. A hosted option still exists in some form in 2026. Here is the honest part: we could not confirm the current hosted tier names or prices on a first-party page as of June 2026. Rather than print a number we cannot stand behind, we are flagging it. If a hosted plan is on your shortlist, get the current price directly from Liquid Web before you budget, and confirm what is and is not included (some hosted bundles cap features or add usage limits the self-hosted plugin does not have). Treat any "LearnDash Cloud pricing" figure you see floating around older blog posts as unverified until you check the source page yourself. ## The plugin tax: what a real LearnDash stack actually costs This is where the sticker price and the real price diverge. LearnDash is a plugin, not a platform. The base price buys you a capable core, but a production course business almost always needs paid add-ons that LearnDash does not include - plus LMS-grade managed hosting, because shared budget hosting buckles under quiz traffic and video. We call this the plugin tax: the recurring, easy-to-underestimate spend that turns a $399 line item into a stack of separate annual bills. Here is a realistic stack with each component's published price (hosting is priced by your host), checked on the vendor's own page on September 30, 2026. Not every site needs every row, but most serious ones need several. | Stack component | What it does | Published price (checked September 30, 2026) | Source | | --- | --- | --- | --- | | LearnDash Pro | The LMS plugin itself | $399 a year (Essentials $259, Elite $599) | learndash.com/pricing | | BuddyBoss Launch | Community, social learning, the BuddyBoss Theme and the LearnDash integration | $199 the first year, then $399 a year | buddyboss.com/pricing | | BuddyBoss App | A branded iOS or Android app | From $499 the first year, then $999 a year (one store) | buddyboss.com/pricing | | GrassBlade xAPI Companion plus an LRS | SCORM and xAPI playback and tracking, with a learning record store | Companion $99 a year; GrassBlade Cloud LRS from $144 a year | GrassBlade xAPI Companion, GrassBlade LRS | | Tin Canny Reporting | SCORM and xAPI upload and reporting inside LearnDash (an alternative to GrassBlade) | $199 the first year for one site, then $249 a year | uncannyowl.com | | ProPanel | Advanced reporting and dashboards | Included in LearnDash Pro and Elite | learndash.com/pricing | | MemberPress | Memberships, payments, subscriptions | Launch $199.50 the first year, then $399 a year, plus a 4.9% transaction fee; Growth $349.50 the first year, then $699 a year, with no transaction fee | memberpress.com/plans/pricing | | WPML | Multilingual courses | Multilingual CMS: EUR 99 a year, excluding VAT | wpml.org/purchase | | Zoom integration | Live sessions inside courses | Video Conferencing with Zoom Pro: $39.99 a year for one site | codemanas.com | | LMS-grade managed hosting | Performance, uptime, backups, security | Not included in the LearnDash plugin or in any BuddyBoss plan; priced by your host | buddyboss.com/pricing | Add the rows your business actually needs and the picture changes fast. A full corporate-training stack (SCORM via an LRS, community, memberships, multilingual, live sessions, premium hosting) pays each of those vendors, several of them at a first-year price that renews higher, and pays a host on top. Every row renews, every year. Three things make this worse than it looks on a spreadsheet: - Renewals are not stable. Several add-ons (MemberPress is the clearest example) sell at an intro rate that doubles at renewal, and some layer a percentage fee on payments on top. - You are the integrator. Every plugin is a separate vendor, a separate update cycle, and a separate thing that can break when WordPress or another plugin updates. Compatibility is your problem, not theirs. - The costs are recurring and they compound. This is annual spend that grows as you add capability, not a one-time build. None of this means LearnDash is a bad product. It means the honest price of a real LearnDash deployment is the stack price, not the plugin price - and that is the number you should compare against an all-in platform. ## The all-in comparison: Cubite vs a full LearnDash stack Once you price the whole stack, the comparison stops being "plugin vs plugin" and becomes "assemble-and-maintain vs all-in." That is the comparison that matters for a switcher. [Cubite LMS](https://cubite.io) is $290/mo, or $2,900/yr billed annually, all-in. That single number includes hosting, maintenance, support, SCORM and xAPI, SSO with Google, GitHub or Facebook sign-in, white-label, certificates, and analytics - the exact line items that become separate paid plugins in the LearnDash column. There are unlimited users and unlimited courses, 0% transaction fees, and no plugin renewals to track, because there are no plugins. | What you are paying for | LearnDash stack (prices checked September 30, 2026) | Cubite LMS | | --- | --- | --- | | Annual cost | Plugin $259 to $599/yr, plus each add-on and hosting (see the dated tables above) | $2,900/yr billed annually ($290/mo monthly), all-in | | Pricing model | Plugin + many add-ons + hosting | One platform, one bill | | Users / courses | Unlimited (on plugin) | Unlimited | | Transaction fees | 0% on plugin, but add-ons may charge (e.g. 4.9%) | 0% | | Hosting | You buy and manage it | Included | | Maintenance and updates | Your job, across every plugin | Included | | Support | Per-vendor, varies | Included | | SCORM + xAPI | Add-on: Tin Canny from $199 the first year, or GrassBlade $99/yr plus an LRS | Included | | SSO | Add-on or custom | Included (Google, GitHub or Facebook sign-in; SAML SSO and SCIM on Enterprise) | | White-label | Varies / add-on | Included | | Certificates and analytics | Often add-ons | Included | | Migration from LearnDash | n/a | Cubite-run migration from a database export | The honest read: if your needs are tiny and stay tiny, the LearnDash Essentials plugin at $259/yr can be the cheaper line item, and that is a legitimate choice. But the moment you need SCORM, SSO, community, memberships, multilingual, or genuinely reliable hosting, the stack price climbs into the same range as an all-in platform - except you are now the one assembling, integrating, and maintaining it, and absorbing renewal spikes and per-vendor support. Cubite collapses that stack into one predictable bill and one vendor to call. (For completeness, self-hosted open-source platforms like Open edX exist too, but they shift the maintenance burden onto you, which is the opposite of what most switchers want.) If you want to see exactly how the move works, here is how to [migrate from LearnDash to Cubite without losing data](https://cubite.io/blogs/migrate-from-learndash-to-cubite). [LearnDash's WordPress export (WXR)](https://cubite.io/blogs/export-learndash-courses) carries course content only; learners, enrollments, progress, quiz scores and certificates live in the database, so a move to a hosted LMS needs a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. Start with [the free LearnDash migration assessment](https://cubite.io/learndash-migration). ## Get a free LearnDash migration assessment Tell us about your LearnDash site and we will map exactly what carries over, from courses and quizzes to learner accounts, enrollments and certificates. Prefer to talk first? [Book a 30-minute call](https://cubite.io/go/book?src=learndash-pricing). [Get the free assessment](https://cubite.io/learndash-migration) ## Frequently asked questions about LearnDash pricing in 2026 ### How much does LearnDash cost in 2026? The LearnDash self-hosted plugin costs $259/yr (Essentials), $399/yr (Pro), or $599/yr (Elite), billed annually, as listed on LearnDash's own pricing page on September 30, 2026. All three tiers include unlimited courses and unlimited learners with no per-student fees, and MemberDash is included in every plan. The tiers differ by features, not by seat or site count. The cheaper read is the plugin price. The realistic read is the stack price: a production LearnDash site usually adds paid add-ons (community, SCORM and xAPI, multilingual, live sessions) plus managed hosting, each billed separately. Cubite LMS costs $290 a month or $2,900 a year per site, with unlimited learners and courses. ### What is the difference between LearnDash Essentials, Pro, and Elite? All three tiers share unlimited courses and unlimited learners, with no per-student fees. Essentials ($259/yr) is the core LMS. Pro ($399/yr) adds the AI course outline and quiz builder, ProPanel reporting, weighted grading, custom report cards and group leader communications. Elite ($599/yr) adds group course management and seat selling, the instructor role, front-end course creation, multi-instructor courses, and ratings and reviews. Pick Essentials for a simple catalog, Pro for most growing businesses (reporting and weighted grading are usually non-negotiable), and Elite if you sell seats to organizations, run multiple instructors or want front-end course building. ### Did LearnDash change its pricing? Yes. LearnDash moved from a site-count model (roughly $199, $399, and $799 by number of sites) to a feature-based model: Essentials $259, Pro $399, and Elite $599 per year. MemberDash is now bundled into every tier. Do not budget against the old numbers - they are no longer current and are shown here only for reference. The structural shift means you now pay for capabilities rather than for how many sites you activate on, and the entry price floor moved up. ### Can I keep my old LearnDash price? Only if your subscription never lapses. A lapsed plan forces you to buy a new plan at current pricing, and legacy or grandfathered rates cannot be reactivated once they expire. An expired card, a missed renewal, or a deliberate pause resets you to today's tiers. When you model multi-year cost, use current pricing rather than the rate you remember, because a single lapse erases any grandfathered discount permanently. ### Is LearnDash cheaper than an all-in LMS like Cubite? It depends entirely on your stack. The LearnDash plugin alone ($259 to $599/yr) is a smaller line item than Cubite's $2,900/yr. But a real production LearnDash site adds paid add-ons and managed hosting, each billed separately: BuddyBoss Launch, for example, was listed on buddyboss.com on September 30, 2026 at $199 the first year and $399 a year after that, and no BuddyBoss plan includes hosting. If the plugin, your host and the add-ons you need for the features below pass $2,900 a year together, Cubite's annual plan costs less. Cubite at $290/mo, or $2,900/yr billed annually, includes hosting, maintenance, support, SCORM and xAPI, white-label, certificates, and analytics, with 0% transaction fees and no plugins to maintain. SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. ### Does LearnDash still offer a hosted (Cloud) plan? A hosted option (formerly LearnDash Cloud) still exists in some form in 2026. We could not confirm the current hosted tier names or prices on a first-party page as of June 2026, so we will not quote a number. If a hosted plan is on your shortlist, confirm the current price and inclusions directly with Liquid Web before budgeting. Treat any "LearnDash Cloud pricing" figures in older blog posts as unverified until you check the source page yourself. ### Can I get a LearnDash migration quote without a call? Yes. Email your LearnDash site URL, or your course and learner counts, to amir@cubite.io and you will receive a written assessment within 48 hours on business days: what transfers as-is, what needs rework, and a fixed migration quote against Cubite's $290/mo all-in plan. A 30-minute call is available at calendly.com/cubite/30min if you prefer, but it is not required. ## The bottom line on LearnDash pricing in 2026 - Plugin pricing (checked September 30, 2026): Essentials $259/yr, Pro $399/yr, Elite $599/yr, all annual, all with unlimited courses and learners and no per-student fees. - The model changed: from site-count tiers (old ~$199/$399/$799) to feature tiers, with MemberDash now bundled. Budget against the new numbers. - The lapse trap is real: legacy pricing cannot be reactivated, so model multi-year cost at current rates. - The plugin tax is the real cost: a production stack pays for each add-on and for hosting on top of the plugin; BuddyBoss Launch alone is $199 the first year, then $399 a year (checked September 30, 2026). - All-in changes the math: Cubite at $2,900/yr billed annually ($290/mo monthly) bundles hosting, support, SCORM/xAPI, SSO with Google, GitHub or Facebook sign-in, white-label, certificates, and analytics, with 0% fees, and Cubite runs the move off LearnDash for you from a database export. ## Ready to get started? If your stack is creeping toward four figures and you are tired of being the integrator, price your real LearnDash TCO against one all-in bill. Start with the free LearnDash migration assessment, or book a 30-minute call if you would rather talk it through. [Get the free assessment](https://cubite.io/learndash-migration) LearnDash, BuddyBoss and add-on prices checked on each vendor's own page on September 30, 2026; the tables above link each source. Verify current figures before purchase, as vendor pricing changes. --- # LearnDash Alternatives in 2026, Priced: What Happened to LearnDash and 5 Paths Forward https://cubite.io/blogs/learndash-alternatives-2026-migration-guide **By:** Amir Tadrisi **Updated:** 2026-09-30 What changed at LearnDash in 2026, what staying costs, and the main alternatives, each priced at the vendor on September 30, 2026. # What Happened to LearnDash And the 5 Migration Paths Off It in 2026 Cubite is one of these options and publishes this guide. Cubite LMS costs $290 a month or $2,900 a year per site, with unlimited learners and courses. Short answer (updated September 30, 2026): LearnDash is still sold and updated, so staying is a real option. If you leave, the paths are another WordPress plugin, a hosted course platform, Moodle or Open edX, or Cubite LMS. Starting prices, checked on each vendor's own site on September 30, 2026: - Stay on LearnDash: Essentials $259, Pro $399 or Elite $599 a year, plus WordPress hosting and any add-ons. Liquid Web still updates it: LearnDash 5.2.1 shipped on September 30, 2026. - Another WordPress plugin: each has a free core; paid plans start at $199 a year for Tutor LMS, $199 for the first year of LifterLMS (then $398 a year) and $149 for the LearnPress Semi-Pro Bundle (single add-ons from $19). - A hosted course platform: entry plans billed annually start at $24 a month for LearnWorlds, $29 for Teachable, $40 for Thinkific, $42 for Podia and $143 for Kajabi; on those entry plans LearnWorlds, Teachable and Podia also take a fee per sale, and Thinkific adds a gateway fee if you take payments through Stripe or PayPal instead of Thinkific Payments. - Moodle or Open edX: free, open-source software that you host yourself or pay someone to run (see our [Moodle hosting](https://cubite.io/blogs/moodle-hosting) and [Open edX hosting](https://cubite.io/blogs/open-edx-hosting) guides). Cubite runs managed Moodle from $690 a month for up to 500 concurrent learners and managed Open edX from $1,260 a month for up to 1,000. - Cubite LMS: [$290 a month or $2,900 a year per site](https://cubite.io/pricing), fully hosted, with unlimited learners and courses and native SCORM, xAPI and a built-in LRS. SSO with Google, GitHub or Facebook sign-in is included at $290; SAML SSO and SCIM are Enterprise. Updated September 30, 2026: vendor prices re-checked on each vendor's own site, LearnWorlds added, a dated timeline built from Liquid Web's own announcement, and the April 2027 date corrected (it applies to tools Liquid Web is retiring, not to LearnDash). The June 23, 2026 update added the login-portal change and our May 2026 scan of 174 live LearnDash sites. On April 22, 2026, Liquid Web, which has owned LearnDash since 2021, announced that it was concentrating its WordPress software into four core products: Kadence, LearnDash, The Events Calendar and Give. The StellarWP brand that sat above them is gone, learndash.com now redirects to Liquid Web, and MemberDash's membership tools now ship inside LearnDash. LearnDash itself is still sold and updated: version 5.2.1 shipped on September 30, 2026. The April 2027 date in the announcement is when critical security patches end for the older tools Liquid Web is retiring, and it lists no LearnDash tools among them. If you run a LearnDash site, this is a good moment to review your options, not an emergency. LearnDash is not shutting down, and Liquid Web says existing customers keep their plan and pricing while the subscription stays active. What changed is the company structure around it and how it is sold. Whether that matters depends on what your LMS does for your business. The dissolution is not actually the news. The news is what's already running. In May 2026 we scanned 174 production LearnDash sites visible on the open web. 75 of them (43%) were carrying at least one critical (CVSS ≥ 9) CVE the day we checked. Half (50%) were running an outdated WordPress core. Three out of four of the sites that disclosed a PHP version were running a PHP release the PHP team itself stopped patching. Zero of the 174 sites published a security.txt. So the question is not whether Liquid Web keeps shipping LearnDash updates; it does. It is whether your site installs them, along with WordPress core, PHP and every add-on. The median site in our scan was not keeping up, and no vendor announcement changes that. This guide does three things: 1. Lays out what actually happened with dated sources 2. Compares all five realistic LearnDash alternative 2026 paths honestly - including the WordPress plugins, the SaaS platforms, and open-source self-hosting 3. Gives you the migration mechanics for moving courses, learners and progress off LearnDash without losing data. **The all-in alternative:** Cubite is a fully hosted LMS at a flat $290/mo ($2,900/yr billed annually) - courses, quizzes, certificates and hosting in one price, with no plugin stack to patch or secure. Before you weigh the five paths below, get a free [LearnDash migration assessment](https://cubite.io/learndash-migration) that scopes the real effort and cost for your specific site. --- ## What Actually Happened to LearnDash in April 2026 Here is the dated record, from Liquid Web's and LearnDash's own pages where they exist, each checked on September 30, 2026. | Date | What happened | Source | | --- | --- | --- | | September 20, 2021 | Liquid Web announces it has acquired LearnDash, which joins its StellarWP group of WordPress products | Liquid Web press release | | November 2025 | Liquid Web and StellarWP go through a round of internal restructuring | WisdmLabs, May 19, 2026 | | April 22, 2026 | Liquid Web announces four core WordPress products (Kadence, LearnDash, The Events Calendar and Give), and the StellarWP brand is wound down. MemberDash stops being sold on its own and its membership tools move into LearnDash; existing customers keep their plans and pricing | Liquid Web announcement; date and StellarWP: WisdmLabs | | April 22, 2026 | LearnDash is sold in three yearly tiers, Essentials, Pro and Elite; on September 30, 2026 they cost $259, $399 and $599 | Liquid Web announcement; learndash.com/pricing; date: WisdmLabs | | May 12, 2026 | learndash.com, kadencewp.com and givewp.com begin redirecting to Liquid Web's main domain; learndash.com still redirects on September 30, 2026 | WisdmLabs, May 19, 2026; Cubite's own check | | September 16, 2026 | LearnDash 5.2.0 merges the Notifications and WooCommerce add-ons into the core plugin | LearnDash changelog | | September 30, 2026 | LearnDash 5.2.1 ships, the latest release that day | LearnDash changelog | | April 2027 | Critical security patches end for the older tools Liquid Web is retiring (listed under Kadence, The Events Calendar and Give); the announcement lists no LearnDash tools among them | Liquid Web announcement | Within a month of the rollout, a fleet-wide scan of 174 live LearnDash sites found 96 of them (55%) carrying at least one publicly-reported CVE - averaging 62 CVEs per affected host. These are not new findings caused by the dissolution. They are pre-existing exposure that the dissolution makes harder to fix. GiveWP co-founder Devin Walker summarized the mood publicly > Private equity often takes a hard edge, putting profits over people and disregarding morale. The May 2026 rollout itself went badly. Independent reporting from [The Repository](https://www.therepository.email/liquid-web-retires-stellarwp-in-botched-rollout-drawing-backlash-from-customers-and-community) and [Search Engine Journal](https://www.searchenginejournal.com/liquid-web-wordpress-plugin-rebrand-triggers-backlash/574828/) documented login failures, missing invoices, and lifetime-deal customers unable to confirm what they still owned. A Nexcess product lead (Nexcess is Liquid Web's hosting brand) acknowledged the login issues and missing invoices, and confirmed that lifetime customers keep what they already had. ### Is LearnDash shutting down? No. On April 22, 2026, Liquid Web wound down the StellarWP brand and made LearnDash one of its four core WordPress products. LearnDash is still sold and updated (version 5.2.1 shipped on September 30, 2026). The April 2027 date in Liquid Web's announcement is when critical security patches end for the older tools it is retiring, and it lists no LearnDash tools among them. ### What happened to LearnDash? Liquid Web, which has owned LearnDash since 2021, wound down its StellarWP brand on April 22, 2026 and reorganized its WordPress software into four core products, LearnDash among them. MemberDash's membership tools moved into LearnDash, learndash.com now redirects to Liquid Web, and LearnDash is sold in three yearly tiers: Essentials $259, Pro $399 and Elite $599 (checked September 30, 2026). The plugin still ships updates; the April 2027 security-patch date covers only the tools Liquid Web is retiring. ### Confirmed facts vs open questions about the LearnDash wind-down Most coverage of the dissolution blurs what is documented with what is feared. Here is the clean split, with sources, because your decision should rest on the left column, not the right one. | Confirmed (sources in the timeline above) | Still open, do not assume | | --- | --- | | The StellarWP brand was wound down on April 22, 2026; LearnDash is one of four Liquid Web core products (Kadence, LearnDash, The Events Calendar, Give). | Whether LearnDash gets meaningful new features under Liquid Web, or only maintenance. | | Liquid Web and StellarWP went through a round of internal restructuring in November 2025. | The long-term roadmap. | | learndash.com now redirects to Liquid Web, and account management moved to Liquid Web's software portal (LearnDash Cloud customers keep account.learndash.com). | How long Liquid Web keeps investing in LearnDash; its announcement gives no end date. | | Critical security patches continue through April 2027 for the older tools Liquid Web is retiring; the announcement lists no LearnDash tools among them. | Whether legacy or grandfathered pricing survives long term. | | A lapsed subscription means buying one of the new plans to reinstate access; existing plans keep their pricing while the subscription stays active. | | Sources: Liquid Web's announcement and its 2021 press release, LearnDash's pricing page and changelog, and WisdmLabs' dated summary, each read on September 30, 2026. LearnDash is not shut down or discontinued; what changed is the company structure around it and how it is sold. --- ## How Do I Log In to LearnDash Now That It Redirects to Liquid Web? If you typed learndash.com and landed on Liquid Web, nothing is broken and nothing was stolen. Since May 2026, learndash.com redirects to liquidweb.com. To manage your LearnDash license, invoices and downloads, log in to Liquid Web's software portal at software.liquidweb.com, where older portal links now redirect; LearnDash Cloud customers keep using account.learndash.com. A few things worth knowing while you are in there: your installed LearnDash plugin keeps working, because the redirect changed where you manage your account, not whether your site runs. As of LearnDash 4.18, licensing is built into the core plugin, so the separate licensing plugin is no longer required. On your first login to the new portal, Liquid Web emails a password reset link to your account address; if it does not arrive, choose Request a new password on the portal's login page. Record your license keys and invoices in your own files now, so you are not dependent on the portal being perfect. If the redirect has you wondering whether to stay on LearnDash at all, that is the right question. The migration paths above lay out your options, and the next sections cover exactly what each path costs and what data comes with you. --- --- ## Why This Hits Some LearnDash Users Harder Than Others LearnDash is not one market. It's two and they need very different responses to the dissolution. A [2026 study of 240,000 WordPress LMS websites](https://sellcoursesonline.com/wordpress-lms-websites-tech-study) found LearnDash held 34.8% market share overall, powering 83,415 sites. But among sites with high tech spend - the premium segment - LearnDash's share jumps to 60.3%. Customers in that segment include the University of Florida, Yoast, and DigitalMarketer. "About 70% of LearnDash sites belong to teams of 1–10 people, and the conventional advice for them is 'be patient and plan over 12 months.' Our scan of 174 live LearnDash sites complicates that advice. Among the small-operator segment we sampled: - 50% were running a WordPress core that's already out of support - 77% of those exposing a PHP version were running an end-of-life PHP release - 90% had no HSTS, 87% had no Content-Security-Policy, 81% had no X-Frame-Options - Average 7.5 third-party plugins detected per site - each one its own patch-cadence problem The 'wait and see' position assumes someone is keeping the stack patched. For most of the fleet, nobody was patching even before the 2026 consolidation. Patience is a viable strategy if your LearnDash site is genuinely a hobby project; it is not a viable strategy if it processes payments, stores learner PII, or carries a credential." --- ## Should You Migrate Off LearnDash Now, or Wait? Whether to move now or hold depends almost entirely on your license state. Panic and complacency are both wrong defaults. Here is the honest segmentation. If you are weighing the plugin against the hosted option, see [LearnDash self-hosted vs SaaS](https://cubite.io/blogs/learndash-self-hosted-vs-saas). ### If you have an active LearnDash subscription You are not on a clock. LearnDash is still maintained, and Liquid Web says your plan and pricing stay the same while the subscription stays active, so plan calmly rather than reacting. Use the time to evaluate alternatives, run a real migration test on staging, and move deliberately if you move at all. ### If your renewal is coming up Decide before auto-renew fires. A lapsed LearnDash subscription forces you to buy a new plan at current pricing ($259 Essentials / $399 Pro / $599 Elite per year) to regain access, so an accidental lapse is the expensive outcome. If you are even considering a move, this is the moment to choose: renew intentionally for another planned year, or migrate before the renewal and redirect that spend into the new platform. ### If you are on a lifetime or legacy license You are grandfathered and your install keeps working, but adopt an exit-ready posture so you move on your timeline, not theirs: keep tested backups, record your license keys and invoices in your own files (account management moved to Liquid Web during the 2026 rollout), and document every integration and add-on. Grandfathered pricing holds while auto-renew stays active; whether it survives indefinitely is not guaranteed in writing. --- ## What We Found When We Scanned 174 Live LearnDash Sites in May 2026 ### The patch debt is fleet-wide, not edge-case - WP outdated 50% - EOL PHP 77% - Apache/nginx versions with known CVEs. **These numbers describe the median LearnDash site, not the worst one.** Read the full [174-site security scan and methodology](https://cubite.io/blogs/learndash-security-scan-2026). ### The 'LearnDash stack' is actually a dozen vendors - Uncanny Owl Toolkit 25% - LD Visual Customizer 24% - Uncanny Pro 11% - Wisdm 3% - course-grid 11% **Liquid Web consolidated its own products in April 2026, but the dozen add-on vendors around LearnDash did not consolidate too. Every one of them is a separate roadmap risk.** ### Self-check checklist - Your WordPress core isn't on the current release. Half the sites we scanned were running an outdated core. - Your PHP is 8.0 or older. Of the sites that disclosed a version, 77% were on PHP that no longer gets security fixes. - Your LearnDash plugin hasn't been updated since April 2026. LearnDash has shipped releases since then, including security fixes (5.2.1 on September 30, 2026), so an install that stopped updating is missing them. - You depend on at least one paid add-on (Uncanny Toolkit or Pro, LD Visual Customizer, WISDM, course-grid, and the like). Each is a separate vendor whose roadmap is now its own question mark. - You're on a lifetime or legacy license. It still runs, but nothing about it obligates anyone to ship you a security patch. - You can't name who patches this site, or when. No WAF, no managed security, no schedule you could point to. - You run your own server. The OS, web server, and PHP are yours to keep current, and server-level CVEs showed up across the fleet. - You don't have a recent, tested export of your courses and learners. If you had to move tomorrow, you're not sure what would actually come with you. "Tick three or more boxes? You're in the 43%." --- ## Every LearnDash Alternative in 2026, at a Glance Before the five paths in detail, here is the whole field on one screen: type, real 2026 starting price, whether it taxes your sales, whether it speaks SCORM natively, whether it drags WordPress along with it, and who it is actually for. Prices were checked on each vendor's own site on September 30, 2026. | Alternative | Type | Starting price (checked September 30, 2026) | Transaction fee | Native SCORM | WordPress required | Best for | | --- | --- | --- | --- | --- | --- | --- | | LearnDash (incumbent) | WordPress plugin | $259/yr (Essentials) | None listed | No (add-on + LRS) | Yes | Existing WordPress course sites with someone keeping WordPress patched | | LifterLMS | WordPress plugin (freemium) | Free core; $199 the first year, then $398/yr (Earth) | None listed | No (GrassBlade) | Yes | All-in-one WP courses + memberships + community | | Tutor LMS | WordPress plugin (freemium) | Free core; $199/yr (Individual, 1 site) | None listed | No (GrassBlade) | Yes | Budget/beginner WP creators wanting a free start and a free LearnDash migration tool | | LearnPress | WordPress plugin (freemium) | Free core; add-ons from $19; Semi-Pro Bundle $149, Pro Bundle $299 (one site, 12 months of updates) | None listed | Listed in the free core | Yes | Zero-budget solo creators comfortable assembling add-ons | | Sensei LMS | WordPress plugin (freemium) | Free core; $179/yr (Pro) | None listed | No (player plugin) | Yes | Automattic/WooCommerce-native sellers | | Moodle | Open-source platform | Free self-host; MoodleCloud varies | 0% | Yes | No | Universities and schools with IT resources | | Open edX | Open-source platform | Free core; Cubite's managed Open edX from $1,260/mo | 0% | Yes (XBlock) | No | Enterprise, certification, proctored exams, cohorts, headless/API | | Cubite LMS | Managed SaaS | $290/mo or $2,900/yr, unlimited learners + courses | 0% | Yes (SCORM 1.2, SCORM 2004, xAPI, built-in LRS) | No | Nonprofits and mid-market teams wanting a fully-managed, plugin-free LMS | | Thinkific | Hosted SaaS | $40/mo billed annually ($54 monthly) | 0% on Thinkific Payments (a gateway fee applies with Stripe or PayPal) | Plus plan only | No | Creators leaving WP who want 0% fees | | Teachable | Hosted SaaS | $29/mo billed annually ($39 monthly) | 7.5% (Starter) | No | No | Budget creators selling a few courses fast | | Kajabi | Hosted SaaS | $143/mo billed annually ($179 monthly) | 0% platform | No | No | Creators bundling courses with marketing automation | | LearnWorlds | Hosted SaaS | $24/mo billed annually ($29 monthly) | $5 per paid enrollment (Starter); none from Pro Trainer | From Pro Trainer ($79/mo billed annually), 20 packages; unlimited on higher plans | No | Trainers and branded academies that want SCORM without WordPress | | Podia | Hosted SaaS | $42/mo billed annually ($504/yr) | 5% (Mover) | No | No | All-in-one creators (courses + digital products + community) | Three things this table makes obvious that a license-only comparison hides. First, "free" plugins are not free the moment you monetize or need certificates and drip: their paid plans start at $149 to $199 for the first year, not far below LearnDash Essentials at $259. Second, SCORM is a hard wall: most WordPress plugins and hosted SaaS need a paid add-on or skip it, while open-source platforms and Cubite LMS support it natively (on the hosted side, Thinkific on its Plus plan and LearnWorlds from its Pro Trainer plan; among the plugins, LearnPress lists SCORM in its free core). If you run compliance or certification training, that one column eliminates most of the field. Third, the transaction-fee column quietly decides the math at scale: a 7.5% cut on six figures of course revenue dwarfs any license-price saving. Want the head-to-head detail? See our 2026 comparisons of [Moodle](https://cubite.io/blogs/moodle-vs-learndash), [LifterLMS](https://cubite.io/blogs/lifterlms-vs-learndash), [Tutor LMS](https://cubite.io/blogs/tutor-lms-vs-learndash), [LearnPress](https://cubite.io/blogs/learnpress-vs-learndash), and [Thinkific](https://cubite.io/blogs/thinkific-vs-learndash) vs LearnDash, plus guides to [free LearnDash alternatives](https://cubite.io/blogs/free-learndash-alternatives), [LearnDash and SCORM](https://cubite.io/blogs/learndash-scorm), and the best [LearnDash alternative for universities and enterprise](https://cubite.io/blogs/learndash-alternative-for-universities). --- ## The Five Migration Paths Off LearnDash in 2026 Every honest learndash alternative 2026 decision lands on one of five paths. The right path depends on your scale, your team, and how much WordPress is helping you versus getting in the way. | Path | Best For | Cost Profile (prices checked September 30, 2026) | Tradeoffs | | --- | --- | --- | --- | | Stay on LearnDash | Working sites with someone keeping WordPress patched | $259 to $599/yr license | Still sold and updated by Liquid Web; the plugins, theme and hosting around it (see the fleet scan above) are still yours to patch | | Another WordPress plugin (Tutor LMS, LearnPress, LifterLMS) | Small WP-based course sites that want to stay in WP | Free core; paid plans $149 to $199 in year one + WP overhead | Same WP fragility; different vendor but same architecture | | Hosted SaaS (Kajabi, LearnWorlds, Podia, Teachable, Thinkific) | Course creators leaving WordPress entirely | $24 to $143/mo for entry plans billed annually | Lose WP, lose customization; great for solo creators | | Self-hosted open-source LMS (e.g. Moodle) | Engineering-led teams that need real scale and full control | $0 license + significant devops | Free software, real ops cost (see TCO section) | | Cubite LMS (managed) | Nonprofits, course businesses, universities, and enterprise training teams that want institutional features without devops | $290/mo or $2,900/yr, unlimited learners + courses (hosting + maintenance included) | Higher sticker price than a plugin license, lower total cost of ownership | ### What is the best LearnDash replacement in 2026? It depends on what you sell and to whom. To stay in WordPress, Tutor LMS (its free migration tool imports LearnDash users and course data) or LifterLMS. For a creator business built on funnels and email marketing, a hosted platform such as Kajabi. For compliance or certification training without WordPress, LearnWorlds (SCORM from its Pro Trainer plan) or Cubite LMS, which costs $290 a month or $2,900 a year per site with native SCORM, xAPI and a built-in LRS. For universities with their own IT team, Moodle or Open edX. --- ## What Student Data Actually Transfers When You Leave LearnDash The number one reason people stall on a LearnDash migration is fear of losing learner data. Here is the honest, cross-platform answer, because "your data is safe" is only true if you know exactly which data and to where. LearnDash stores course structure as WordPress custom post types, quizzes in post meta, and the fragile part, completion, in serialized user meta tied to specific post IDs. What survives the move depends heavily on the destination. | Data type | WP plugin (Tutor / Lifter / LearnPress) | Hosted SaaS (Thinkific / Teachable / Kajabi / Podia) | Open-source / Cubite | | --- | --- | --- | --- | | Courses, lessons, topics | Yes (official tools) | Usually (content only) | Yes (content remapped) | | Quizzes and questions | Yes (advanced types may need rework) | Rebuild natively | Yes (rebuilt natively) | | Enrollments | Yes (with Transfer / Tutor / ThimPress tools) | Limited | Via CSV / API | | User accounts | Yes | Accounts yes, passwords reset | Via CSV / API | | Progress / completion | Yes with the right tool (the fragile part) | Generally not | Scripted via API | | Quiz attempt history | Validate per tool | Generally not | Scripted, validate | | Certificates issued | Validate (often not guaranteed) | Generally not | Rebuild templates | | Payment / transaction records | Often not | No | No | Step 0 is to export from LearnDash itself. Use the built-in Import/Export tool (wp-admin under LearnDash LMS, Settings, Advanced) for site-to-site transfer, and note that WordPress’s own export does not carry quizzes, course-to-lesson links, or progress. For users plus progress plus certificates, a serialization-aware tool (such as Transfer by Honors WP) handles the zipped data that the native export drops. Back up the full database before any of this. For the complete step-by-step, see [how to export your LearnDash courses](https://cubite.io/blogs/export-learndash-courses). The pattern is clear. WordPress-to-WordPress moves preserve the most, because they share a database and post-type model, and free first-party migration tools exist (Tutor LMS ships a one-click LearnDash importer; ThimPress ships a free LearnPress one). Moving to a hosted SaaS preserves the least: content and accounts usually move, but in-progress completion, quiz attempts, and certificates generally do not. Moving to a managed platform like Cubite is content-portable: structure maps cleanly, while enrollments and progress are scripted through the API. Three rules hold regardless of destination: progress is the fragile object (LearnDash embeds post IDs in serialized completion data, so any ID change on import silently breaks it); always stage and back up first (Tutor’s importer deletes the original LearnDash courses after migrating, so a backup is not optional); and preserve your SEO by mapping every old course and lesson URL to its new equivalent with 301 redirects rather than blanket-redirecting to the homepage. --- ## Worried about losing data? LearnDash's WordPress export carries course content only, so learner data moves from a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. Your live site is not touched, and you review the record counts and sign off before launch. [Book a free 30-minute migration assessment](https://cubite.io/go/book?src=learndash-alternatives) --- ## How to Migrate Off LearnDash Cubite runs the migration for you from a copy of your LearnDash database, so you do not rebuild your courses by hand. Here is how it works. ### How a migration to Cubite LMS works [LearnDash's WordPress export (WXR)](https://cubite.io/blogs/export-learndash-courses) carries course content only; learners, enrollments, progress, quiz scores and certificates live in the database, so a move to a hosted LMS needs a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. Cubite works from a copy, your live LearnDash site is not touched, and you review the record counts and sign off before launch. Passwords do not move: migrated learners sign in from an invite or an emailed sign-in link. Start with [the free LearnDash migration assessment](https://cubite.io/learndash-migration). Because Cubite is fully managed, that is the end of the work: no devops and no plugin stack to maintain, at $290 a month or $2,900 a year with unlimited learners and courses. The free migration assessment maps exactly what carries over before anything moves. --- ## What LearnDash Costs in 2026 (the New Liquid Web Pricing) LearnDash moved to three feature-based annual tiers in 2026: Essentials $259, Pro $399, and Elite $599 per year. All three include unlimited courses and learners with no per-student fees, and MemberDash is built in. Billing is annual, and there is no monthly option on the self-hosted plugin. The previous model was $199, $399, and $799 by site count, so the structure changed from site-count licenses to feature tiers. | Tier | Price (annual) | What it adds | | --- | --- | --- | | Essentials | $259/yr | Course and quiz builder, memberships and subscriptions, Stripe/PayPal, certificates, focus mode, unlimited courses and learners | | Pro (most popular) | $399/yr | Everything in Essentials plus the AI course outline and quiz builder, advanced reporting (ProPanel), weighted grading, structured cohorts and group leader communications | | Elite | $599/yr | Everything in Pro plus group course management and seat selling, the instructor role, multi-instructor management, front-end course creation, and ratings and reviews | Checked on learndash.com/pricing, which redirects to liquidweb.com, on September 30, 2026. Note that a lapsed subscription forces buying a new plan at current pricing, so legacy pricing cannot be reactivated. A hosted option (formerly LearnDash Cloud) still exists in some form, but its current tier names and prices were not confirmable on a first-party page at publish time. And as the next sections show, the license is only part of the real cost once you add the plugins a production site needs. For the full breakdown of every tier and the all-in cost, see our complete guide to [LearnDash pricing in 2026](https://cubite.io/blogs/learndash-pricing-2026). --- ## True Cost of Ownership: LearnDash vs the Alternatives Here is Cubite's estimate of the total cost of ownership for a mid-sized course operation (up to 5,000 learners and 200 courses), Year 1 + Year 2 combined. | Path | License | Infrastructure | Ops / Dev time | Migration (one-time) | 2-year total | | --- | --- | --- | --- | --- | --- | | LearnDash today | $400–$1,600 | $300–$1,200 (WP hosting) | $1,000–$4,000 (plugin maintenance) | $0 | $1,700–$6,800 | | Tutor LMS / LearnPress / Lifter | $0–$400 | $300–$1,200 | $1,000–$4,000 | $1,000–$5,000 | $2,300–$10,600 | | Self-hosted open-source LMS | $0 | $300–$1,200 (server + DB + storage) | $1,000–$4,000 (devops engineer time) | $1,000–$5,000 | $2,300–$10,600 | | Cubite LMS SaaS | $290/mo or $2,900/yr | Included | Included | Included | Two years at $2,900 a year, or at $290 a month | A few honest observations from this table: - Cubite LMS SaaS is competitive with - and often cheaper than - a WP plugin alternative once you count developer time. - Self-hosting an open-source LMS is rarely the cheapest path. The license is free; the engineer is not. - Cubite LMS folds hosting, maintenance, support, and migration into one fixed monthly price, so the 2-year total is predictable with no plugin renewals and no devops hire. ### What LearnDash Really Costs Once You Add the Plugins LearnDash’s license looks cheap until you price the plugins required to build a real course site. Here are the published prices, checked on each vendor's own site on September 30, 2026, for an organization running cohort courses, community, external/xAPI content, future payments, and a global audience. Several of these add-ons use intro pricing that rises or doubles at renewal, so year-two costs are typically higher. | Capability | LearnDash add-on (published price, checked September 30, 2026) | Cubite | | --- | --- | --- | | LMS license (cohort + groups + reporting tier) | LearnDash Pro $399/yr or Elite $599/yr (group course management and seat selling are Elite) | Bundled | | SCORM/xAPI + external-content analytics | GrassBlade xAPI Companion $99/yr plus GrassBlade Cloud LRS from $144/yr, or Tin Canny Reporting $199 the first year, then $249/yr | Bundled | | Discussion / community forum | BuddyBoss Launch, the lowest plan with the LearnDash integration: $199 the first year, then $399/yr | Bundled | | Advanced reporting dashboard | ProPanel: included in LearnDash Pro and Elite | Bundled | | Memberships / payments / donations | Memberships: MemberDash, built into every LearnDash plan. MemberPress, if you use it: Launch $199.50 the first year, then $399/yr, plus a 4.9% transaction fee | Bundled | | Multilingual | WPML Multilingual CMS: EUR 99/yr, excluding VAT | Bundled | | Live sessions (Zoom + calendar) | Video Conferencing with Zoom Pro: $39.99/yr for one site | Bundled | | Managed LMS-grade hosting | Not included in the plugin; LearnDash recommends managed WordPress hosting, priced by your host | Bundled | | Security / maintenance / update management | Agency or maintenance retainer: varies | Bundled | Hosting and maintenance have no single vendor price, so this guide does not add up a total; the dated line items above are the published numbers. The same multi-plugin, multi-vendor stack is also what produces the update breakage, plugin conflicts, and fragmented ownership operators complain about in the first place, none of which shows up in the dollar total. Cubite LMS, at $290 a month or $2,900 a year, is a single bundled price that already includes managed hosting, xAPI external-content analytics, a native discussion forum (or Discourse), reporting, multilingual support, maintenance, security, and patching, plus unlimited learners and courses, with no per-plugin renewals and no transaction-fee surprises. --- ## The license is the small number Once you add the plugins and hosting a real LearnDash stack needs, the license is only one line of the bill. Cubite LMS is $290 a month or $2,900 a year, all-in: unlimited learners and courses, hosting and maintenance included, no plugin renewals, no per-seat fees, and 0% transaction fees [Get a fixed-scope migration quote](https://cubite.io/go/book?src=learndash-alternatives) ### Will LearnDash still work after 2027? Yes. The April 2027 date in Liquid Web's announcement is when critical security patches end for the older tools it is retiring, and it lists no LearnDash tools among them; LearnDash itself is still updated (version 5.2.1 shipped on September 30, 2026). What needs a plan is the rest of your stack: WordPress core, PHP, your theme and every add-on, each on its own update schedule. --- ## Why Real LearnDash Users Are Leaving, and What Replaces Each Pain In conversations with LearnDash users weighing a move, one pattern keeps surfacing. Take a UK-based nonprofit that trains frontline practitioners in the safeguarding space. They run a mix of self-paced and facilitated cohort courses, with some interactive microlearning authored in an external tool. On paper, LearnDash should fit. In practice, the cracks show up everywhere the platform stops being a single product and becomes a pile of plugins. The discussion board was the first wall they hit. It was hard to navigate between threads, and it kept breaking when it collided with other plugins, so the team fell back to a separate tool just to keep community conversation alive. That is the recurring story: to build the site they actually wanted, they had to stack plugin on plugin, and every routine update risked breaking something else. More on that failure mode: [why the LearnDash and BuddyBoss community stack breaks](https://cubite.io/blogs/learndash-buddyboss-community-alternative). Then the analytics gap. Their microlearning lives on the LearnDash site, but the learner data from that embedded content never flows back in, so they cannot report on it in one place. For a nonprofit that has to show outcomes to funders, invisible data is not a minor annoyance. We go deeper on closing that data gap in [xAPI tracking for LearnDash content](https://cubite.io/blogs/xapi-integration-learndash-alternative). On top of that, ownership was fragmented across multiple tech providers, with no single accountable party, and confidence in LearnDash’s long-term direction had eroded after a round of internal restructuring at Liquid Web and StellarWP in November 2025 and the wind-down of the StellarWP brand in April 2026. Add a global, low-bandwidth audience to the mix, and the question stops being "how do we patch this?" and becomes "who owns all of this, end to end?" ### Pain by pain: what replaces each LearnDash gap | LearnDash pain | Why it happens (root cause) | How Cubite solves it | | --- | --- | --- | | Discussion board is hard to navigate and breaks under plugin conflicts, pushing teams to a second tool | LearnDash has no native, first-class forum. Community is delivered through WordPress plugins (bbPress/BuddyBoss-style) that share the same plugin stack, so reliability is an afterthought | A discussion forum is built in, with the option to embed Discourse, so community lives inside the LMS instead of a bolted-on plugin | | Building the site you want means stacking many plugins, and updating one breaks another | LearnDash is a single, intentionally minimal WordPress plugin; everything beyond basic delivery is a separate add-on, and independently-versioned plugins share one runtime | Managed, no-plugin architecture: Cubite hosts, patches, and updates the platform itself, so the breakage that comes from a self-managed plugin stack is off your plate | | Doubt about LearnDash's future after the acquisition and the 2026 consolidation | LearnDash is owned by Liquid Web; the StellarWP brand was wound down in April 2026 after a round of internal restructuring in November 2025 | A single managed vendor owns hosting, maintenance, and support, with a human-reviewed support model so requests do not dead-end in an automated loop | | Cannot embed externally-built content or pull its analytics (the Genially-style gap) | LearnDash has no native SCORM/xAPI runtime; tracking external content needs a paid add-on plus a separate Learning Record Store, and an embedded iframe stays opaque to the LMS | Native xAPI: build content in an external tool, embed it, and capture progress and learner actions back into one dashboard (confirm your specific tool in a demo) | | Cohort/facilitated programs force a sprawl of external tools (Zoom, Calendar, Classroom, a separate board) | LearnDash is built around self-paced delivery and lacks first-class scheduling, assignment, and community surfaces, so cohort workflows get assembled from separate SaaS | Discussion, interactive content, and reporting are native, consolidating much of the cohort duct-tape stack under one roof | | Multiple tech providers, confusion over who owns what | Self-hosted LearnDash makes the customer assemble hosting, a WordPress maintainer, and an LMS configurator, so accountability fragments by default | One managed vendor for hosting, maintenance, security, and features: a single accountable party instead of an integrator role you have to play | | Heavy WordPress/plugin front end degrades on low-bandwidth connections | Each plugin loads its own CSS/JS and dynamic rendering adds weight; there is no guaranteed pre-rendered delivery | Server-side and static rendering ship pre-rendered HTML and minimize client-side payload, reducing page weight on low-bandwidth connections, with no extra downloads for learners | | Migrating progress, certificates, and group assignments off LearnDash feels risky | LearnDash stores progress, certificates, and group memberships across WordPress tables and plugin schemas with no clean standard export | Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from a LearnDash database export | | Admin means living in the WordPress wp-admin sprawl | LearnDash administration is bolted onto a general-purpose CMS, exposing plugins, themes, and settings on top of its own screens | A purpose-built LMS back office focused on learning operations rather than full CMS internals (best confirmed live in a demo) | ## Why Cubite Is the Path We Recommend (And Who Should Pick What) Cubite has been building and operating LMS platforms since 2013, supporting enterprise, higher education, and commercial training organizations worldwide. This is the segment most affected by the StellarWP wind-down: organizations whose LMS platforms generate revenue, deliver compliance training, or issue credentials. It is also the segment least able to tolerate risk, especially when 43% of live LearnDash sites were already exposed to a critical CVE at the time of our scan. For almost everyone in this segment, our recommendation is one platform: Cubite LMS. Cubite LMS is a fully managed SaaS LMS with unlimited users and courses, AI course generation, SCORM and xAPI, SSO with Google, GitHub or Facebook sign-in and white-labeling, certificates, analytics, and modern checkout and enrollment automation. It is built for nonprofits, course businesses, higher education, and mid-market training teams that want a real, fully-managed LMS without running one. Hosting, maintenance, security, and migration are included, and we build custom features and branding for you without a per-change fee. At $290/mo, Cubite bundles what LearnDash sells as separate paid plugins, with unlimited users and unlimited courses: - Native discussion forum (or embedded Discourse), no BuddyBoss/bbPress add-on - xAPI tracking and analytics for embedded external content, no GrassBlade/Tin Canny add-on plus a separate Learning Record Store - Advanced reporting dashboard, no ProPanel add-on - Multilingual support (English, Spanish, Portuguese), no WPML add-on - Managed, LMS-grade hosting, no separate Kinsta or WP Engine plan - Security, patching, updates, and maintenance handled for you, no agency retainer - Zero transaction fees, versus add-ons that layer a 4.9% fee on payments and donations Cubite also offers discounted terms for nonprofits and NGOs. Ask during a migration assessment. ### A simple decision matrix | Your situation | Recommended path | | --- | --- | | Hobby site or small course business on a LearnDash site that works | Stay on LearnDash; keep WordPress, PHP and add-ons patched and a tested export ready | | Course business that must stay in WordPress | Tutor LMS (its free migration tool imports LearnDash data) or LifterLMS | | Creator business that sells with funnels, email marketing and a community | Kajabi (funnels and marketing emails are built in), or Podia on a smaller budget | | Course business, 100 to 5,000 learners, leaving WordPress | Teachable, Thinkific or LearnWorlds for a creator storefront; Cubite LMS for a white-label academy with SCORM, xAPI and certificates | | Mid-market training company, regulated content | Cubite LMS, or LearnWorlds from its Pro Trainer plan | | University, hybrid programs, 5,000+ learners | Moodle or Open edX with your own IT team or a managed host; Cubite LMS if you want it fully hosted | | Multi-tenant platform (you resell LMS to others) | Cubite LMS (white-label) | ## Not sure which path is yours? A free 30-minute migration assessment tells you the lowest-cost path for your specific LearnDash setup, with no deck and no upsell, and ends with a fixed-scope quote, even when the answer is to stay where you are for now. [Book a free migration assessment](https://cubite.io/go/book?src=learndash-alternatives) --- ## Frequently Asked Questions More questions that come up in every LearnDash migration consultation: ### What are the best LearnDash alternatives in 2026? It depends on what you sell. To stay in WordPress, Tutor LMS (from $199 a year) or LifterLMS ($199 the first year, then $398). For a creator business with funnels and email marketing, a hosted platform such as Kajabi (from $143 a month, billed annually); Teachable, Thinkific, Podia and LearnWorlds start lower. For universities with their own IT team, Moodle or Open edX. For fully hosted compliance or certification training, LearnWorlds (SCORM from its Pro Trainer plan) or Cubite LMS, which costs $290 a month or $2,900 a year per site with unlimited learners and courses and native SCORM, xAPI and a built-in LRS. Prices were checked on each vendor's site on September 30, 2026; Cubite publishes this guide. ### Will LearnDash still work after 2027? Yes. The April 2027 date in Liquid Web's announcement is when critical security patches end for the older tools it is retiring, and it lists no LearnDash tools among them; LearnDash itself is still updated (version 5.2.1 shipped on September 30, 2026). The bigger risk is the rest of the stack: in our May 2026 scan of 174 live LearnDash sites, half ran an outdated WordPress core, 77% of those disclosing a PHP version ran end-of-life PHP, and 75 sites carried at least one critical CVE. ### Can I migrate from LearnDash without losing learner progress? Yes, but progress is the hardest part. LearnDash stores completion at the user, lesson, and topic level in custom WordPress tables, and any new platform records it differently, so progress has to be mapped or rebuilt. For non-credentialed courses, most operators reset progress and re-enroll learners; for credentialed or paid courses where progress is part of the value, it is worth migrating deliberately. LearnDash's WordPress export (WXR) carries course content only, so progress moves from a database export. Cubite moves the whole LearnDash site, including learners, enrollments, progress, quiz attempts and groups, with earned certificates re-issued, as a migration it runs for you from that database export. ### Do I have to leave WordPress to leave LearnDash? No. Tutor LMS, LearnPress, and LifterLMS are all WordPress plugins that can replace LearnDash on the same WordPress site. The migration path is shorter (same database, same hosting, same admin) and these plugins are actively maintained. The reason to leave WordPress entirely (for Cubite LMS or a hosted SaaS like Kajabi) is usually that WordPress itself is the friction: you need multi-tenancy, native cohorts, xAPI/SCORM, programmatic certificates, or institutional features most WordPress plugins lack. ### Is LearnDash dead, or being discontinued in 2026? No. LearnDash is not dead or discontinued. On April 22, 2026, Liquid Web wound down its StellarWP brand and kept LearnDash as one of four core products, and the plugin still ships updates (version 5.2.1 on September 30, 2026). The April 2027 date in the announcement covers only the older tools Liquid Web is retiring. What changed is the company structure around LearnDash and how it is sold, not the software itself. ### What is the new LearnDash pricing in 2026? LearnDash sells three annual tiers: Essentials $259, Pro $399 and Elite $599 a year (checked on learndash.com on September 30, 2026). All include unlimited courses and learners with no per-student fees, and MemberDash is built in. Pro adds the AI course outline and quiz builder, advanced reporting (ProPanel), weighted grading and structured cohorts; Elite adds group course management and seat selling, multi-instructor management and front-end course creation. ### What is the best LearnDash alternative for WordPress? For staying inside WordPress, Tutor LMS is the easiest migration target (free start, one-click LearnDash importer), LifterLMS is best for all-in-one memberships and coaching, and LearnPress is the most budget-friendly. All three are actively maintained independent plugins. ### What is the best LearnDash alternative for beginners? For beginners, Tutor LMS (free tier, frontend drag-and-drop builder) and the hosted Teachable or Podia are the gentlest starts. Tutor keeps you in WordPress with a free start; Teachable and Podia remove WordPress entirely so you can publish a course the same day without managing hosting, themes, or plugins. ### Which LearnDash alternative is best for enterprise or corporate training? For enterprise, certification, and compliance training, Cubite LMS is our recommended managed option: fully hosted, with SCORM and xAPI, SSO with Google, GitHub or Facebook sign-in (SAML SSO and SCIM are on its Enterprise plan), white-labeling, certificates, and analytics, and no plugin stack to maintain. Among self-hosted open-source options, Moodle is the established choice for institutions with their own IT resources. Most WordPress plugins and most hosted SaaS lack native SCORM and proctoring. ### What happens to MemberDash if I used it as a standalone plugin? MemberDash is no longer sold as a standalone product. It was folded directly into LearnDash and is now bundled across the 2026 tiers. Existing installs continue to work, but new membership functionality comes through LearnDash rather than a separate MemberDash purchase. ### Should I migrate away from LearnDash now, or wait? It depends on what your LMS does. LearnDash is still maintained, so no vendor deadline forces a move. If it is a hobby site or a small course business, staying is reasonable while you keep an exit-ready posture: tested backups, recorded license keys, documented integrations. If your LMS earns revenue, trains compliance, or grants credentials, review the options on your own timeline, starting with who patches WordPress, PHP and every add-on on your site. ### Can I build a headless LMS with any of these alternatives? WordPress plugins are not built for headless or API-first delivery. For an API-driven or headless build you want a platform with documented APIs, multi-tenant organizations, and white-label support, which is where a managed platform like Cubite LMS or a custom LMS build fits rather than a WordPress plugin. ### Do any LearnDash alternatives offer proctoring to prevent cheating? LearnDash and most WordPress plugins do not offer native proctoring. Moodle supports it through plugins, and managed platforms can add proctoring integrations. If anti-cheating matters for high-stakes exams, raise it during a migration assessment so it is scoped into the build from the start. ### Is LearnDash worth it in 2026? For an existing WordPress course site with someone keeping WordPress patched, LearnDash is still a capable, maintained plugin at $259 to $599 a year (checked September 30, 2026). For anyone starting fresh without WordPress skills, or running credentialing, compliance, or enterprise training, a hosted platform removes the plugin and hosting upkeep. Match the decision to your stakes, not the brand history. --- ## What to Do Next The 90-second version of this guide: - What happened: Liquid Web wound down its StellarWP brand on April 22, 2026 and kept LearnDash as one of its four core products; LearnDash is still sold and updated. - What was already true: 174 production LearnDash sites scanned in May 2026 - 43% on a critical CVE, 50% on outdated WordPress, 77% (of disclosed) on EOL PHP. Most of the fleet was not keeping up before April. A vendor announcement does not change that. - No deadline: April 2027 is when patches end for the tools Liquid Web is retiring, not for LearnDash, so you can move on your own timeline. - For most readers: if your LMS earns revenue, trains compliance, or grants credentials, review your options this quarter. If it's a hobby site, at minimum run the self-check above this week. LearnDash is still a working, maintained plugin. The consolidation is a good moment to check whether it still fits what your LMS is doing in 2026, and to move if it does not. --- ## Not sure LearnDash still fits? Tell us about your LearnDash site and we will map exactly what carries over, from courses and quizzes to learner accounts, enrollments and certificates. [Get the free assessment](https://cubite.io/learndash-migration) --- # Moodle Hosting Cost 2026: MoodleCloud vs Managed vs Self-Hosted https://cubite.io/blogs/moodle-hosting **By:** Amir Tadrisi **Updated:** 2026-09-30 Compare Moodle hosting options — MoodleCloud, managed, self-hosted, and cloud — with real pricing, installation methods, and a decision framework. Cubite sells managed Moodle and publishes this guide; competitor prices marked with a check date are copied from each provider's own page on that date. Quick answer (September 30, 2026): Cubite runs managed Moodle from $690 a month for up to 500 concurrent learners, with version upgrades and same-day CVE patching included. - Moodle Official Hosting (Moodle HQ, US): no published price; its page asks you to talk to a hosting expert (checked September 30, 2026). - MoodleCloud (Moodle HQ's SaaS): $160 to $2,100 a year for 50 to 750 users in its US-dollar view, billed annually in Australian dollars (checked September 30, 2026); no plugins or integrations can be added. - Moodle Certified Partners: some quote each project and some publish plan prices, listed with their check dates in the provider table below. - Cubite managed Moodle: $690 a month (Standard, up to 500 concurrent learners), $1,190 a month (Growth, up to 1,500) or from $2,200 a month (Scale, elastic, with cloud billed at cost); every tier includes SSO (SAML / OIDC) implementation and daily backups with a rehearsed restore. - Self-hosting: no license fee, but you pay for the server and for the sysadmin time that upgrades, patches and cron take. ## Moodle Installation & Hosting: The Complete Guide to Self-Hosted, Managed & Cloud Options (2026) Moodle powers [146,000+ sites](https://stats.moodle.org/) and serves [506 million users](https://stats.moodle.org/) across 233 countries and territories — making it the world's most widely used learning management system. The software is free. Hosting it is where the real decisions begin. Moodle hosting determines how fast your platform loads, how smoothly upgrades go, whether your plugins work after each release, and how many 2 AM server emergencies you'll face. And with Moodle 5.1 [moving web-accessible files into a public directory](https://moodledev.io/general/releases/5.1), a change many shared-hosting auto-installers have not caught up with, the hosting landscape has shifted significantly in 2025-2026. Managed option: Cubite offers managed Moodle hosting from $690/mo, all-in, including version upgrades, same-day CVE patching, SSO, branding and daily backups with a rehearsed restore. See [managed Moodle hosting and support](https://cubite.io/services/moodle-hosting-and-support), check your current site with the [free Moodle security audit](https://cubite.io/services/moodle-security-audit), or [book a call](https://cubite.io/go/book?src=moodle-hosting). This guide covers both hosting options AND installation methods in one place, with real pricing, honest tradeoffs, and a framework to help you decide. Here's what you'll find: - Four hosting paths compared side-by-side (MoodleCloud, managed, self-hosted, cloud platform) - Five installation methods from manual LAMP to Kubernetes - Real pricing from MoodleCloud through enterprise managed hosting - A decision framework matched to your org type, budget, and team --- ## What Is Moodle — And Why Does Hosting Matter? Moodle is the open-source LMS originally created by Martin Dougiamas in 2002. Today it's backed by Moodle HQ (an Australian B Corporation), maintained by [82+ Certified Partners](https://moodle.com/services/certified-service-providers/) worldwide, and used by organizations from small schools to Shell and the Open University (UK). The numbers tell the story of scale: | Metric | Value | | --- | --- | | Registered sites | 146,856 | | Total users | 506+ million | | Courses created | 55+ million | | Course enrollments | 3.5+ billion | | Plugins available | 2,390+ | | Countries and Territories | 233 | Moodle is free under the GPL license — but "free" describes the software, not the operation. Running Moodle requires a web server, PHP 8.3+ for Moodle 5.2 (8.2 for 5.0 and 5.1), a database, and someone to keep it all running. The hosting decision shapes your cost, performance, and how painful every upgrade will be. And upgrades just got more demanding. Moodle 5.0 [dropped Oracle database support and the Atto editor](https://moodledev.io/general/releases/5.0). Moodle 5.1 [introduced a public directory requirement](https://moodledev.io/general/releases/5.1) that breaks shared hosting setups whose auto-installers have not been updated for it. --- ## Moodle Server Requirements (2026) ### Hosting requirements for Moodle 5.x Moodle 5.x needs 64-bit PHP: 8.2 or later for Moodle 5.0 and 5.1, and 8.3 or later for 5.2 and for the 5.3 LTS due on October 5, 2026. PHP also needs the sodium extension and max_input_vars of at least 5000. Supported databases start at MySQL 8.4, MariaDB 10.11 and PostgreSQL 14 (15 for Moodle 5.1, 16 for 5.2 and 5.3). From Moodle 5.1 on, the web server's document root must point at Moodle's public directory. Keep the moodledata directory outside the web root, and run cron every minute, as Moodle's documentation recommends. | Moodle release | Released | Minimum PHP (64-bit) | Minimum database versions | Web server document root | | --- | --- | --- | --- | --- | | 5.0 | April 14, 2025 | 8.2.0 | MySQL 8.4, MariaDB 10.11.0, PostgreSQL 14 | Moodle's main folder | | 5.1 | October 6, 2025 | 8.2.0 | MySQL 8.4, MariaDB 10.11.0, PostgreSQL 15 | Moodle's public directory | | 5.2 | April 20, 2026 | 8.3.0 | MySQL 8.4, MariaDB 10.11.0, PostgreSQL 16 | Moodle's public directory | | 5.3 LTS | Due October 5, 2026 | 8.3.0 | MySQL 8.4, MariaDB 10.11.0, PostgreSQL 16 | Moodle's public directory | Sources, checked September 30, 2026: Moodle's release notes for [5.0](https://moodledev.io/general/releases/5.0), [5.1](https://moodledev.io/general/releases/5.1), [5.2](https://moodledev.io/general/releases/5.2) and [5.3](https://moodledev.io/general/releases/5.3), which also list the Microsoft SQL Server and Aurora MySQL minimums, and the [Installing Moodle](https://docs.moodle.org/502/en/Installing_Moodle) and [Cron](https://docs.moodle.org/502/en/Cron) pages on docs.moodle.org. The tables below add hardware sizing and a software checklist. The software table is for [Moodle 5.0 and 5.1](https://moodledev.io/general/releases/5.0); 5.2 and the 5.3 LTS need PHP 8.3 and PostgreSQL 16, as above: ### Hardware | Resource | Minimum | Production Recommended | | --- | --- | --- | | CPU | 1 GHz | 2+ GHz dual-core | | RAM | 512 MB | 1 GB (8 GB+ for large sites) | | Disk | 200 MB (code) + content | SSD with RAID for production | ### Software | Component | Requirement | | --- | --- | | PHP | 8.2.0 minimum; 8.3.x and 8.4.x supported; 64-bit only | | MySQL | 8.4+ | | MariaDB | 10.11.0+ | | PostgreSQL | 14+ (15+ for Moodle 5.1) | | Oracle | No longer supported (dropped in Moodle 5.0) | | Web server | Apache, Nginx, OpenLiteSpeed, or IIS | | PHP extensions | sodium (required), max_input_vars >= 5000 | ### Critical Changes in Moodle 5.x Moodle 5.1 requires a public directory for serving web-accessible files. This architectural change improves security but [breaks shared hosting setups](https://moodledev.io/general/releases/5.1) whose auto-installers still drop Moodle into public_html. On cPanel hosts that let you set a document root, pointing a subdomain at Moodle's public folder is the documented fix. The [official performance FAQ](https://docs.moodle.org/501/en/Performance_FAQ) warns that cheap shared hosting "may not provide sufficient resources to run Moodle properly" and that, very roughly and in the worst case, a Moodle site may only handle as few as 10-20 concurrent users per GB of memory. Combined with the public directory requirement, shared hosting works for Moodle 5.1+ only where the host handles the public document root and cron at setup, and even then for a single class at a time. [Flashcloud's Moodle requirements guide](https://flashcloud.com/blog/moodle-hosting-requirements-what-schools-and-course-creators-actually-need) is the one host-written piece we have found that documents the 5.1 change. ### Key PHP Settings for Performance Per the [official performance recommendations](https://docs.moodle.org/501/en/Performance_recommendations): - OPcache: Enable it — it's the single easiest performance win - PHP-FPM: Use instead of mod_php for better concurrency - memory_limit: 128M default; increase for large sites and backups - max_input_vars: Must be >= 5000 --- ## Moodle Hosting Options: MoodleCloud vs Managed vs Self-Hosted vs Cloud Platform Every Moodle deployment falls into one of four categories. Here's the operational reality of each: | | MoodleCloud | Managed Hosting | Self-Hosted (VPS) | Cloud Platform (AWS/Azure) | | --- | --- | --- | --- | --- | | You control | Course content, basic settings | Content, branding, plugin choices | Everything | Everything | | Provider handles | Everything including platform | Infrastructure, upgrades, plugins, security | Nothing | Infrastructure only (you manage Moodle) | | Custom plugins | No | Yes | Yes | Yes | | Custom themes | No | Yes | Yes | Yes | | User limit | 750 max | Unlimited | Unlimited | Unlimited | | Technical team needed | None | None | Sysadmin | Cloud engineer + sysadmin | | Time to launch | Minutes | Days to weeks | Hours to days | Days to weeks | | Typical cost | $160-2,100/yr (USD view, billed in AUD; checked September 30, 2026) | Quote-based or published plans; see the dated tables below | $50-300+/mo + staff | $100-500+/mo + staff | | Best for | Small orgs, pilots, < 750 users | Most organizations | Tech-savvy orgs with sysadmin | Orgs with existing cloud teams | The short version: MoodleCloud is fast and cheap but limited. Self-hosted gives you control but demands expertise. Moodle cloud hosting on AWS, Azure, or GCP adds scalability but requires cloud skills. Managed hosting through a Moodle Certified Partner is the middle ground — and where most organizations land. --- ## MoodleCloud: What You Get (And What You Don't) [MoodleCloud](https://www.moodlecloud.com/standard-plans/) is Moodle's official SaaS (software as a service) hosting. It's the fastest way to get a Moodle site running — but it comes with significant limitations that many organizations hit within their first year. ### Pricing Cubite runs managed Moodle from $690 a month for up to 500 concurrent learners, with version upgrades and same-day CVE patching included. The table lists MoodleCloud's five plans as moodlecloud.com showed them on September 30, 2026, with Cubite's Standard tier added for comparison and labeled as such. | Plan | Users | Storage | Price (USD) | Billing | | --- | --- | --- | --- | --- | | Starter | 50 | 1 GB | $160 a year | Annual, charged in AUD (AUD 230) | | Mini | 100 | 2.5 GB | $270 a year | Annual, charged in AUD (AUD 380) | | Small | 200 | 5 GB | $490 a year | Annual, charged in AUD (AUD 700) | | Medium | 500 | 20 GB | $1,190 a year | Annual, charged in AUD (AUD 1,700) | | Standard | 750 | 50 GB | $2,100 a year | Annual, charged in AUD (AUD 3,000) | | Cubite managed Moodle, Standard tier (not a MoodleCloud plan) | Up to 500 concurrent learners | Not listed | $690 a month | Monthly, priced by concurrent learners, not per user | Source: [MoodleCloud Standard Plans](https://www.moodlecloud.com/standard-plans/), checked September 30, 2026. MoodleCloud shows prices in several currencies, but all plans are billed annually in Australian dollars and country-specific taxes may apply. The Cubite row comes from [Cubite's managed Moodle plans](https://cubite.io/services/moodle-hosting-and-support). Users vs concurrent learners: MoodleCloud caps each plan by number of users, while Cubite prices managed Moodle by concurrent learners, the most people using the site at the same moment. There is no fixed ratio between the two, so check MoodleCloud's plans against your number of users and Cubite's against your peak concurrency, such as your busiest exam window. ### What's Included - Unlimited courses and activities - Premium Moodle Mobile App (normally EUR 499/year) - Video conferencing (up to 100 concurrent participants) - PayPal integration (Stripe on Small+ plans) - Automatic updates and security patches - 28-day free trial, no credit card required ### What's NOT Included (The Deal-Breakers) | Limitation | Impact | | --- | --- | | No custom plugins | Can't install third-party plugins — only what MoodleCloud includes | | No custom themes | Limited to available theme options — no branding control | | No API access | Can't integrate with external systems (HR, SIS, analytics) | | No white-labeling | MoodleCloud branding remains | | 750 user maximum | Forces migration once you grow beyond this | | Storage caps | 1-50 GB depending on plan — video-heavy courses hit this fast | ### When You've Outgrown MoodleCloud You need to move beyond MoodleCloud when any of these are true: - You have (or expect) more than 750 users - You need custom plugins (H5P advanced, plagiarism detection, custom grading) - You need API integrations with your HR system, SIS, or analytics platform - You need Moodle Workplace features (multi-tenancy, certifications, compliance workflows) - You need your own branding and custom domain without add-on fees The next step is either a Moodle Certified Partner (managed hosting) or self-hosting on a VPS or cloud platform. ### Quiz: Do You Actually Need More Than MoodleCloud? --- ## How to Install Moodle (5 Methods Compared) If you're going the self-hosted route, here are the five ways to get Moodle installed — from traditional to modern. | Method | Difficulty | Time | Scalability | Best For | | --- | --- | --- | --- | --- | | Manual LAMP/LEMP | Hard | 2-4 hours | Medium | Sysadmins who want full control | | Docker | Medium | 30-60 min | High | Developers, staging environments | | Kubernetes/Helm | Hard | 4-6 hours | Very High | Enterprise, auto-scaling | | Cloud marketplace (AWS/Azure) | Easy | 15-30 min | High | Quick production deployment | | One-click (Softaculous) | Easy | 5 min | Low | Small sites; 5.1+ needs a public document root | ### Method 1: Manual LAMP/LEMP Installation The traditional approach — install PHP, a database, and a web server, then download and configure Moodle. If you want to know how to install Moodle on Ubuntu, here are the core commands: ```bash # Install dependencies sudo apt update sudo apt install apache2 mysql-server php8.3 php8.3-{curl,gd,intl,mbstring,mysql,soap,xml,xmlrpc,zip,sodium} # Download Moodle 5.1 cd /var/www sudo git clone -b MOODLE_501_STABLE https://github.com/moodle/moodle.git # Create data directory (MUST be outside web root) sudo mkdir /var/moodledata sudo chown www-data:www-data /var/moodledata # Create database sudo mysql -e "CREATE DATABASE moodle DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" sudo mysql -e "CREATE USER 'moodleuser'@'localhost' IDENTIFIED BY 'your-secure-password';" sudo mysql -e "GRANT ALL ON moodle.* TO 'moodleuser'@'localhost';" # Run the web installer at http://your-server/moodle ``` This is a simplified overview. Production deployment requires SSL configuration, firewall rules, cron setup (/usr/bin/php /var/www/moodle/admin/cli/cron.php), and the Moodle 5.1 public directory configuration. See the [full MoodleDocs guide](https://docs.moodle.org/501/en/Step-by-step_Installation_Guide_for_Ubuntu). ### Method 2: Docker For development, use Moodle HQ's official [moodle-docker](https://github.com/moodlehq/moodle-docker). For production, use the [Bitnami Moodle image](https://hub.docker.com/r/bitnami/moodle): [Code Example: Moodle with Docker Compose (Bitnami) — production-ready] ```yaml # docker-compose.yml version: '3' services: moodle: image: bitnami/moodle:latest ports: - '80:8080' - '443:8443' environment: - MOODLE_DATABASE_HOST=mariadb - MOODLE_DATABASE_NAME=moodle - MOODLE_DATABASE_USER=moodle - MOODLE_DATABASE_PASSWORD=your-secure-password volumes: - moodle_data:/bitnami/moodle - moodledata:/bitnami/moodledata mariadb: image: bitnami/mariadb:latest environment: - MARIADB_DATABASE=moodle - MARIADB_USER=moodle - MARIADB_PASSWORD=your-secure-password volumes: - mariadb_data:/bitnami/mariadb volumes: moodle_data: moodledata: mariadb_data: ``` Run docker compose up -d and access Moodle at http://localhost. The Bitnami image bundles MariaDB and handles initial configuration automatically. ### Method 3: Kubernetes/Helm For auto-scaling production deployments, use the [Bitnami Helm chart](https://bitnami.com/stack/moodle/helm): helm install my-moodle oci://registry-1.docker.io/bitnamicharts/moodle This works on EKS (AWS), GKE (Google), AKS (Azure), and any standard Kubernetes cluster. ### Method 4: Cloud Marketplace AWS offers an [official Moodle reference architecture](https://aws.amazon.com/solutions/guidance/deploying-moodle-learning-management-system-on-aws/) with CloudFormation templates including Auto Scaling, Aurora database, and EFS storage. Bitnami AMIs are also available on AWS, Azure, and GCP marketplaces. ### Method 5: One-Click (Softaculous/cPanel) The easiest option — but Moodle 5.1's public directory requirement may break Softaculous installations on shared hosting. On shared hosting, use it for Moodle 4.5 LTS or earlier, or for 5.1+ only where the host lets you point the document root at Moodle's public folder; otherwise it is for quick testing. --- ## Self-Hosting Moodle: The Real Challenges Installing Moodle is the easy part. Keeping it running, secure, and performant is where self-hosting gets expensive — in time, expertise, and stress. ### 1. Performance Tuning Is Not Optional Redis caching is the single biggest performance improvement according to the [official docs](https://docs.moodle.org/501/en/Performance_recommendations). Without it, every page load hits the database. You also need to configure OPcache, tune innodb_buffer_pool_size (80% of RAM on dedicated DB servers), and use PHP-FPM instead of mod_php. Community members report [8.5 million SELECT queries per hour](https://moodle.org/mod/forum/discuss.php?d=462233) even with minimal users when caching isn't configured properly. ### 2. Upgrade Anxiety Is Real Moodle releases major versions every 6 months (April and October). Each upgrade can require PHP version bumps, database version upgrades, and plugin compatibility testing. Users report [significant performance degradation after upgrades](https://moodle.org/mod/forum/discuss.php?d=462891) when server environments aren't updated to match. ### 3. Cron Jobs Are Critical (And Easy to Get Wrong) Moodle's cron is described as ["a very important part of overall performance"](https://docs.moodle.org/501/en/Performance_recommendations). It must run via PHP CLI (not HTTP) to reduce memory consumption. Misconfigured cron causes email queues to back up, grades to not calculate, and the site to slowly degrade — often without obvious error messages. ### 4. Scaling Requires Architecture Changes Beyond a few hundred concurrent users, you need to separate web and database servers, configure load balancing, set up shared file storage (GlusterFS or similar), and implement Redis for distributed caching. This is real systems architecture work. ### 5. Security Is Your Problem SSL certificates, PHP patching, database security, moodledata directory permissions (must be writable but outside web root), and monitoring for vulnerabilities: all your responsibility. Moodle releases security patches with each minor release (every 2 months), and you need to apply them promptly. For the CVEs to patch and what to do if you cannot upgrade yet, see [Moodle CVEs 2026](https://cubite.io/blogs/moodle-security-2026-cves). ### 6. The Knowledge Gap As [TheEduAssist notes](https://theeduassist.com/blog/free-moodle-installation-the-realities-of-self-hosting-your-lms/): "You become the Moodle administrator AND server administrator." When the person who set up the server leaves, you inherit an undocumented system — and the next upgrade becomes a gamble. --- ## Moodle Hosting Providers Compared (2026) Whether you search for hosted Moodle, Moodle SaaS or Moodle hosting services, you land on the same five-tier market. The Moodle hosting market has five tiers. Most affiliate articles only cover Tier 4 (generic VPS), making a real Moodle hosting comparison nearly impossible. Here's the full landscape — from official SaaS to enterprise managed: ### Tier 1: MoodleCloud (Official SaaS) | Provider | MoodleCloud | | --- | --- | | Price | $160-2,100/year in the USD view, billed annually in AUD (checked September 30, 2026) | | Best for | Small orgs, pilots, < 750 users, no custom plugins needed | | Limitation | No custom plugins, no API access, 750 user cap | ### Tier 2: Managed Moodle Hosting Providers This tier covers Moodle HQ's own managed service, Moodle Partners and other Moodle-based hosts. Each price below is copied from the provider's own page on September 30, 2026, and each partner status is as the provider states it on its own site: | Provider | Type | Published price | Capacity basis | Source and date | | --- | --- | --- | --- | --- | | Moodle Official Hosting (Moodle HQ, US) | Moodle HQ's own fully managed hosting, AWS-based, with US and global regions | Quote-based: no price published | Not stated; the page says infrastructure is adjusted as user numbers grow | services.moodle.com/us-hosting, September 30, 2026 | | Catalyst IT | Premium Moodle Certified Partner, per its own site; hosting and development | Moodle as a Service (New Zealand): NZ$275, NZ$375 or NZ$500 a month (Moodle 250, 500 or 1000); larger sites quoted | Active users: up to 250, 500 or 1,000, with 10, 15 or 40 GB of storage | Catalyst's Moodle as a Service sign-up form and catalyst-au.net/solutions/moodle, September 30, 2026 | | Hubken Group | Moodle Partner and part of the Titus Group, per its own site | HubkenCore GBP 2,950/year; Moodle LMS GBP 8,730/year; Enterprise GBP 10,320/year | Users: 150 (HubkenCore), 500 (Moodle LMS), more than 500 (Enterprise) | hubkengroup.com/pricing, September 30, 2026 | | Lambda Learning | Managed Moodle and Totara hosting with Zoola analytics | Custom quote: no price published | Quoted to scale, products and integrations, not per-seat tiers | lambdalearn.io/pricing (lambdasolutions.net redirects there), September 30, 2026 | | Open LMS | Moodle-based SaaS; its own 2021 post says it ceased to be a Moodle Partner | Quote-based: no price published | Active users (pay per active user), with seat-based pricing as an add-on | openlms.net/lms-pricing and openlms.net status post (2021), September 30, 2026 | | Titus Learning | Certified Premium Moodle Partner, per its own site; hosting, development and Moodle Workplace | Quote-based: no price published | Priced on concurrent users, content and security needs | tituslearning.com/moodle-hosting, September 30, 2026 | The quote-based providers price each project on factors such as user numbers, content and integrations, so ask each one for a written quote for the same peak concurrency. For the managed options above, here is how published pricing and scale compare at a glance: | Managed Moodle option | Published price | Best-fit scale | | --- | --- | --- | | MoodleCloud (official SaaS) | $160-2,100/year in the USD view, billed in AUD (checked September 30, 2026) | Up to 750 users; no custom plugins or API | | Moodle Official Hosting (Moodle HQ, US) | Quote-based (no price published) | Organizations that need greater scale, plugins, integrations and dedicated support, per its FAQ | | Moodle Certified Partners | Quote-based or published plans (see the table above) | Enterprise, custom SLAs and development | | Cubite (managed, independent) | $690/mo, all-in | Up to 500 concurrent learners; version upgrades, same-day CVE patching and plugin maintenance included; plugin development in the Growth tier ($1,190/mo) | Independent engineering teams also run managed Moodle without being Certified Partners, and you generally get direct access to the person who actually fixes the problem rather than a support queue. Disclosure: we are one of these, so read this as an option we have a stake in rather than a neutral recommendation. Details: [managed Moodle hosting and support](https://cubite.io/services/moodle-hosting-and-support). ### Tier 3: Moodle-Specific Hosting | Provider | Price | Key Feature | | --- | --- | --- | | Moclusters | $4-24/mo | Kubernetes-based cloud built specifically for Moodle; supports versions 3.11-5.0; 7-day free trial | ### Tier 4: Generic VPS/Cloud Hosting These hosts run the server; installing and running Moodle is mostly up to you, though some offer a one-click installer or help with setup: | Provider | Starting Price | Key Feature | | --- | --- | --- | | Hostinger | $4.99/mo | LiteSpeed, NVMe SSD, 1-click Moodle install | | ScalaHosting | $19.95/mo | Managed cloud VPS, SPanel, free migration | | IONOS | $2/mo | Budget option, NVMe SSD | | Kamatera | $4/mo | 30-day free trial, 24 global data centers | | Flashcloud | $2.79/mo first year (billed annually), then $9.99/mo | Shared hosting, LiteSpeed, NVMe SSD, free domain while you host with Flashcloud | About the Flashcloud row: We list Flashcloud here as part of a link exchange: Flashcloud agreed to link to this guide, and no money changed hands. We wrote the row from Flashcloud's own pages, checked October 6, 2026. ### Tier 5: Cloud Platform (DIY) For Moodle AWS hosting, Amazon offers an [official Moodle reference architecture](https://aws.amazon.com/solutions/guidance/deploying-moodle-learning-management-system-on-aws/) with CloudFormation templates, Auto Scaling, Aurora, and EFS. This is the strongest cloud option for organizations with existing AWS teams — but you still manage the Moodle application layer yourself. ### What to Look For in a Moodle Hosting Provider Must-haves: - Moodle-specific experience: production Moodle sites they already run, whether or not they are a Moodle Certified Partner. Partners are officially vetted by Moodle HQ and fund platform development through a revenue tithe; partner status matters most if you need Moodle Workplace or a partner contract - Upgrade management: Ask how they handle biannual major releases and plugin compatibility testing - Plugin management: Do they test, install, and maintain plugins? Or is that your problem? - Performance configuration: Redis, OPcache, PHP-FPM (do they optimize for Moodle specifically?) - Backup and disaster recovery: Automated daily backups with tested recovery procedures Red flags: - No Moodle certification or specific Moodle expertise - No plugin management or compatibility testing - "Unlimited" plans on shared hosting (Moodle will crush shared hosting at scale) - No cron job management (a Moodle-specific requirement many generic hosts miss) ## Managed Moodle from $690 a month Up to 500 concurrent learners, with version upgrades, same-day CVE patching, SSO (SAML / OIDC) implementation, plugin maintenance and daily backups with a rehearsed restore included. Not sure where your current site stands? [Run the free Moodle security audit](https://cubite.io/services/moodle-security-audit) first. [See managed Moodle plans](https://cubite.io/services/moodle-hosting-and-support) --- ## Frequently Asked Questions ### How much does managed Moodle hosting from Cubite cost? Cubite offers managed Moodle hosting from $690/mo, all-in, including version upgrades, same-day CVE patching, SSO, branding and daily backups with a rehearsed restore. Higher tiers add redundancy, plugin development, SCORM, xAPI and LTI, and a commerce storefront. See the plans on [managed Moodle hosting and support](https://cubite.io/services/moodle-hosting-and-support), run the [free Moodle security audit](https://cubite.io/services/moodle-security-audit), or [book a call](https://cubite.io/go/book?src=moodle-hosting). ### How much does Moodle hosting cost? MoodleCloud, Moodle HQ's SaaS, costs $160 to $2,100 a year for 50 to 750 users in its US-dollar view, billed annually in Australian dollars (checked September 30, 2026). Moodle Official Hosting publishes no price, and Moodle Certified Partners either quote each project or publish plan prices, shown with their check dates in the provider table above. Self-hosting has no license fee, but you pay for the server and for the sysadmin time to run it. Cubite runs managed Moodle from $690 a month for up to 500 concurrent learners, with version upgrades and same-day CVE patching included. The total cost depends on your user count, plugin requirements, and whether you self-host or use a managed provider. A $2/month VPS seems cheap until you factor in the sysadmin time for upgrades, security patches, caching configuration, and plugin compatibility testing. For most organizations, managed hosting through a Moodle Certified Partner is cheaper than dedicating even 10 hours/month of internal IT time to Moodle operations. See our [full cost breakdown](#moodle-hosting-providers-compared-2026) above. ### Is Moodle free to use? Moodle LMS software is free and open-source under the GPL license. However, running it requires server hosting, a domain, SSL, and ongoing maintenance. MoodleCloud starts at $160/year for 50 users in its US-dollar view (checked September 30, 2026). Self-hosting costs $20-200/month in infrastructure. "Free" refers to the software license, not the total cost of ownership. Think of it like WordPress: the software costs nothing, but you still need hosting, a domain, themes, plugins, and someone to maintain it all. Moodle's infrastructure requirements are higher than WordPress — you need PHP 8.3+ for Moodle 5.2 (8.2 for 5.0 and 5.1), a database server, Redis for caching, and properly configured cron jobs. The "free" label is accurate for the license but misleading for the total cost of running a production Moodle site. ### What are the server requirements for Moodle? Moodle 5.2 requires PHP 8.3+ (64-bit; 5.0 and 5.1 accept 8.2), MySQL 8.4+ or MariaDB 10.11+ or PostgreSQL 16+ (5.0 accepts 14 and 5.1 needs 15), and Apache or Nginx. Minimum hardware: 1 GHz CPU, 512 MB RAM, 200 MB disk. For production, use 2+ GHz dual-core, 8 GB+ RAM, and SSD storage. Moodle 5.1+ also requires a public directory structure. The [official Moodle documentation](https://docs.moodle.org/501/en/Installing_Moodle) lists 512 MB RAM as the absolute minimum, but production sites need significantly more. Key PHP settings include OPcache (enabled), max_input_vars >= 5000, and the sodium extension. Oracle database support was [dropped entirely in Moodle 5.0](https://moodledev.io/general/releases/5.0). Starting with Moodle 5.1, web-accessible files must be served from a public directory, a change that [breaks shared hosting setups whose auto-installers have not been updated](https://moodledev.io/general/releases/5.1). ### Can I install Moodle on shared hosting? Moodle technically runs on shared hosting, but Moodle's Performance FAQ warns that cheap shared hosting may not provide sufficient resources to run Moodle properly, and that, very roughly and in the worst case, a site may only handle as few as 10-20 concurrent users per GB of memory. Starting with Moodle 5.1, the public directory requirement breaks shared hosting setups whose auto-installers have not been updated for it. For reliable performance, use a VPS ($4-20/month minimum), managed hosting, or MoodleCloud. The [Moodle Performance FAQ](https://docs.moodle.org/501/en/Performance_FAQ) explicitly states that shared hosting is inadequate for anything beyond very small deployments. Shared hosting can't provide the Redis caching, dedicated database resources, or cron CLI access that Moodle needs for good performance. With Moodle 5.1's public directory requirement, Softaculous and cPanel auto-installs that still drop Moodle into public_html will break; check whether your host has updated its installer and lets you set the document root. If a whole cohort ever logs in at once, plan the move to a VPS or managed hosting now. ### What is MoodleCloud? MoodleCloud is Moodle's official SaaS hosting service. Plans range from $160/year (50 users, 1 GB storage) to $2,100/year (750 users, 50 GB) in its US-dollar view, billed annually in Australian dollars (checked September 30, 2026). It includes automatic updates, mobile app, and video conferencing but does NOT support custom plugins, custom themes, or API access. For those needs, use a Moodle Partner. MoodleCloud is the fastest way to launch a Moodle site — you can be up and running in minutes with no technical skills. It includes a [28-day free trial](https://www.moodlecloud.com/standard-plans/) with no credit card required. However, its limitations (no custom plugins, 750 user cap, no API access) mean most growing organizations eventually outgrow it. When that happens, the path forward is either a Moodle Certified Partner for managed hosting or self-hosting on a VPS. ### What is a Moodle Certified Partner? Moodle Certified Partners are companies officially vetted by Moodle HQ to provide hosting, implementation, training, and support. There are [82+ partners globally](https://moodle.com/services/certified-service-providers/) — 36+ Premium Partners (who can offer Moodle Workplace) and 46+ Standard Partners. They pay a ~10% revenue tithe to Moodle HQ, which funds platform development. Certification matters because it signals deep Moodle expertise and a direct relationship with Moodle HQ. Premium Partners such as Titus Learning and Catalyst IT, each of which states that status on its own site, have years of experience managing production Moodle deployments. When evaluating providers, check Moodle-specific experience (upgrades, plugin maintenance, cron and tested restores) whether or not the provider is a partner; partner status matters most if you need Moodle Workplace or a partner contract. The counterweight is worth stating plainly: certification is a commercial relationship as much as a technical one (official vetting plus roughly a 10% revenue tithe), not an engineering exam. Plenty of capable Moodle teams are not partners, and partners themselves subcontract specialist work. The honest split is by problem type. Choose a Certified Partner if you need Moodle Workplace, a partner-tier contract your procurement process requires, or accredited local-language support. Choose an independent if the problem is engineering: a stalled upgrade, a plugin nobody maintains, an SSO integration that has to match your directory, or selling courses Moodle alone will not sell. Disclosure: we do the latter and are not a Certified Partner ([managed Moodle hosting and support](https://cubite.io/services/moodle-hosting-and-support)). ### Do I need a Moodle Certified Partner? Not to host Moodle LMS. It is open source under the GPL, and MoodleCloud, Moodle Official Hosting and independent hosts all run it. For Moodle Workplace, the commercial product Moodle Partners sell, go to a partner or to Moodle Official Hosting, which also runs Workplace; a partner also helps if your procurement process requires a partner contract. Cubite is not a Moodle Certified Partner; it runs managed Moodle from $690 a month and publishes its prices. ### How do I upgrade Moodle? Upgrading Moodle involves backing up your database and files, replacing the Moodle code directory with the new version, and running the upgrade script via browser or CLI. Major version jumps require PHP and database upgrades too. Test on a staging server first. Managed hosting providers handle upgrades automatically. Moodle releases [major versions every 6 months](https://moodledev.io/general/releases) (April and October) and minor releases every 2 months. Each major upgrade can break plugins, require PHP version bumps, and need database schema changes. The safest approach: clone your production environment, apply the upgrade, test all plugins and integrations, then apply to production during a maintenance window. This process takes hours of skilled sysadmin time — which is why upgrade management is one of the top reasons organizations choose managed hosting. --- ## Your Moodle Hosting Decision, Simplified Moodle is the world's most widely used LMS for good reason — [146,000+ sites](https://stats.moodle.org/), [2,390+ plugins](https://moodle.org/plugins/), and an active global community. But choosing the right hosting is what turns Moodle from "free software" into a reliable learning platform. Before you commit, see our [Moodle LMS review](/blogs/moodle-lms-review) and the honest guide to [Moodle limitations](/blogs/moodle-limitations); if you are still comparing platforms, the [Open edX hosting guide](/blogs/open-edx-hosting) covers the main alternative. Here's what to remember: - MoodleCloud works for small orgs ($160-2,100/year in its US-dollar view, billed in AUD, as of September 30, 2026) but caps at 750 users with no custom plugins - Managed hosting (Moodle HQ's own service, a Certified Partner or an independent host; quote-based or published plans) hands the infrastructure, upgrades and security to the provider; weigh its price against the sysadmin time self-hosting takes - Self-hosting gives you control but costs $6,000-29,000/year in total when you factor in staff time - Moodle 5.1 changed shared hosting: it works only where the host handles the public document root and cron, and only for a class at a time; plan the move up before a whole cohort logs in at once - Ask for Moodle-specific experience: upgrades, plugin maintenance, cron and tested restores; Certified Partner status matters most for Moodle Workplace or a partner contract The question isn't whether Moodle is the right LMS. It's whether you want to spend your time managing servers — or building courses. ## Want Moodle without the server work? Cubite's managed Moodle hosting covers version upgrades, performance tuning, security patching, and backups. Plans start at $690/month for up to 500 concurrent learners. Book a 30-minute call to talk through your site, or [see every plan](https://cubite.io/services/moodle-hosting-and-support) first. [Book a free consultation](https://cubite.io/go/book?src=moodle-hosting) --- # Open edX Hosting: The Complete Guide (2026) https://cubite.io/blogs/open-edx-hosting **By:** Amir Tadrisi **Updated:** 2026-09-30 Cubite runs managed Open edX from $1,260 a month for up to 1,000 concurrent learners. Compare it with the published prices of other Open edX hosting providers and the real cost of self-hosting with Tutor. ## Open edX Hosting: The Complete Guide to Self-Hosted, Managed & SaaS Options (2026) Cubite sells managed Open edX; competitor prices below are copied from each provider's public page on September 30, 2026. Short answer (September 30, 2026): Cubite runs managed Open edX from $1,260 a month for up to 1,000 concurrent learners, with cloud resources included; its Resilient tier costs $1,850 a month for up to 2,000, and its Scale tier runs on Kubernetes from $3,400 a month, with cloud billed at cost. The table below shows the other providers' prices where we could read them on their own sites on September 30, 2026: OpenCraft, Raccoon Gang and Abstract Technology, each with its source. Self-hosting with Tutor has no license fee, but you pay for the cloud and for the engineer who runs every upgrade. Open edX powers [2,283+ live sites](https://openedx.org/blog/the-2024-open-edx-impact-report-is-here/) and serves [over 100 million learners](https://openedx.org/blog/open-edx-community-reaching-100-million-learners-and-driving-global-impact/) — from Harvard and MIT to NVIDIA and NASA. The software is free. Running it is not. Open edX hosting is the single decision that determines your platform's cost, uptime, security, and how painful every upgrade will be for years to come. Get it right and you have a scalable learning platform that grows with your organization. Get it wrong and you're burning $50,000+/year on infrastructure and DevOps salaries before a single learner logs in. Managed option: Cubite runs managed self-hosted Open edX from $1,260/mo, all-in, load-tested to 1,000 concurrent learners, including SSO, SCORM, xAPI and LTI, branding, and cloud resources. See [managed Open edX](https://cubite.io/services/managed-open-edx) or [book a call](https://cubite.io/go/book?src=open-edx-hosting). This guide is the comparison we wished existed when we started hosting Open edX platforms: published prices with their sources, honest tradeoffs, and a framework to help you decide. Here's what you'll find: - Three hosting paths compared side-by-side (self-hosted, managed, SaaS) - Published prices with sources and dates, not "contact us" black boxes - A total cost of ownership breakdown updated for 2026 - A decision framework matched to your org type, budget, and team ## Managed Open edX from $1,260 a month Up to 1,000 concurrent learners, with SSO, SCORM, xAPI and LTI, branding, analytics, cloud resources and daily backups included. [Book a free consultation](https://cubite.io/go/book?src=open-edx-hosting) --- ## What Is Open edX — And Why Does Hosting Matter? Open edX is the open-source learning management system originally built by Harvard and MIT to power edX. Today it's maintained by [Axim Collaborative](https://axim.org/) and a community of [1,334 contributors](https://openedx.org/blog/open-edx-community-reaching-100-million-learners-and-driving-global-impact/). The platform grows at [18% year-over-year](https://openedx.org/blog/the-2024-open-edx-impact-report-is-here/), with [207+ million course enrollments](https://openedx.org/blog/the-2024-open-edx-impact-report-is-here/) worldwide. New to the platform? Our [What Is Open edX?](/blogs/what-is-open-edx) overview and [Open edX review (42 verified users)](/blogs/open-edx-review) are good starting points. **Free** is the reason organizations choose Open edX. **Hosting** complexity is the reason many of them struggle. Unlike Moodle's single-server LAMP stack, Open edX runs a distributed microservices architecture. A production deployment requires seven coordinated services running simultaneously: | Component | Role | | --- | --- | | Django (Python) | Core LMS and CMS/Studio application | | MySQL | Relational data — users, courses, grades | | MongoDB | Course content storage | | Elasticsearch | Search across courses and content | | Redis | Caching and session management | | Celery | Async task processing (grading, emails, certificates) | | Memcached | Additional caching layer | That's seven services to deploy, monitor, patch, back up, and scale. Every one is a potential point of failure. This is why the hosting decision matters more for Open edX than for almost any other LMS. --- ## Open edX Hosting Options: Self-Hosted vs Managed vs SaaS Every Open edX deployment falls into one of three categories. Here's what each actually means — not the marketing version, but the operational realit | | Self-Hosted | Managed Hosting | SaaS | | --- | --- | --- | --- | | You control | Everything — servers, code, config, upgrades | Course content, branding, user management | Course content, basic branding | | Provider handles | Nothing | Infrastructure, upgrades, security, monitoring, scaling | Everything including infrastructure and platform | | Technical team needed | DevOps engineer(s) + sysadmin | None — provider is your ops team | None | | Customization | Unlimited (you own the code) | High (themes, XBlocks, integrations, SSO) | Limited to platform options | | Time to launch | Weeks to months | Days to weeks | Hours to days | | Scaling | You architect it | Provider handles it | Automatic (within plan limits) | | Upgrade path | You manage every release | Provider migrates you | Automatic | | Typical cost | $50K-200K+/yr (infra + staff) | Varies by provider; see the dated price table below | Varies by provider | | Best for | Orgs with 20K+ users and existing DevOps | Most organizations | Simple use cases, fast launches | The short version: Self-hosting gives you maximum control at maximum cost and complexity. Open edX cloud hosting through a managed provider gives you the scalability of AWS or GCP without the ops burden. SaaS gives you speed at the expense of flexibility. Managed hosting is the middle ground — and where most organizations land. Let's look at what each path really involves. Before reading further, take 30 seconds to assess where your organization stands: Evaluate your team and situation against these criteria: - We have a DevOps engineer (or team) with Docker and Kubernetes experience - We have budget for minimum $50,000+/year in dedicated LMS infrastructure and staff - We need deep customization beyond branding — custom XBlocks, modified platform code, or unique integrations - We have 2,000+ active learners (or expect to within 12 months) - We have data sovereignty requirements that mandate specific cloud regions or on-premises hosting If 4-5 checked: Self-hosting may actually make sense for you. Read the next section carefully to confirm your team can handle the 9 operational challenges. If 2-3 checked: Managed hosting with a BYOC (bring your own cloud) option is likely your sweet spot. You get control where it matters without the full ops burden. If 0-1 checked: Managed hosting or SaaS is your path. Skip the self-hosting section if you want — or read it to understand what you're paying your provider to handle. --- ## Self-Hosting Open edX: What It Really Takes Self-hosting means you own everything: the servers, the deployment, the upgrades, the 3 AM alerts when MongoDB runs out of disk space. Here's the unvarnished picture. ### Server Requirements [Tutor](https://docs.tutor.edly.io/), the only officially supported deployment tool since the Maple release, lists these [minimum requirements](https://docs.tutor.edly.io/gettingstarted/requirements.html): | Resource | Minimum | Production Recommended | | --- | --- | --- | | CPU | 2 cores | 4+ cores | | RAM | 4 GB | 8-16 GB | | Disk | 8 GB | 25+ GB | | OS | Any 64-bit UNIX (WSL 2 on Windows) | Ubuntu 20.04/22.04 | | Docker | v24.0.5+ with BuildKit 0.11+ | Latest stable | | Docker Compose | v2.0.0+ | Latest stable | | Ports | 80, 443 open | 80, 443 open | Those minimums are deceptive. For a production deployment serving ~300 active users, community members [report needing](https://discuss.openedx.org/t/hardware-requirements-to-run-open-edx-and-databases/1180) 16 GB RAM for the application server plus separate VMs for MySQL (8 GB), MongoDB (8 GB), and a reverse proxy (8 GB). That's 40 GB of RAM across four servers — for 300 users. A single Tutor instance tops out at roughly 1,500 active users. Beyond that, you need to separate MySQL, MongoDB, Redis, and Elasticsearch onto dedicated services and [scale the application tier horizontally, with more application nodes behind a load balancer or with Kubernetes](https://docs.tutor.edly.io/sysadmin/scale.html). For Open edX AWS hosting, most self-hosted deployments use EC2 instances for compute, RDS for MySQL, DocumentDB or self-managed MongoDB, and ElastiCache for Redis, and you pay that cloud bill on top of the engineer who manages it. Cubite's Lean ($1,260) and Resilient ($1,850) prices include cloud resources; its Scale tier bills cloud at cost. ### Deployment: Tutor Is Your Only Option The legacy Ansible-based installer (edx-configuration) was [officially archived in May 2024](https://github.com/openedx/public-engineering/issues/51). If you're still running it, you're on unsupported infrastructure. [Tutor](https://docs.tutor.edly.io/) (maintained by Edly) provides two deployment modes: - tutor local: Docker Compose on a single server. Good for small deployments and development. - tutor k8s: Kubernetes deployment, for horizontal scaling across nodes. Cubite's Resilient tier serves up to 2,000 concurrent learners on two application nodes behind a load balancer for $1,850 a month; Kubernetes is only in its Scale tier, from $3,400 a month. ```bash # Install Tutor pip install "tutor[full]" # Launch Open edX with Docker Compose tutor local launch # Access your platform at http://local.edly.io # Studio (course authoring) at http://studio.local.edly.io ``` This gets you a local development instance. Production deployment requires DNS configuration, SSL certificates, SMTP setup, and significantly more infrastructure planning. See the [Tutor docs](https://docs.tutor.edly.io/) for the full production checklist. ### The 9 Self-Hosting Challenges Based on eduNEXT's analysis and community forum discussions: 1. Complex multi-service architecture — Not a single app, but seven coordinated services 2. Incomplete documentation — Official docs assume significant prior expertise and aren't always current 3. Infrastructure design decisions — AWS vs GCP vs Azure, instance sizing, networking, storage architecture 4. Customization complexity — Theming, branding, and XBlock configuration require deep platform knowledge 5. Upgrade pain — The recommended approach is backup, destroy the server, and rebuild. Skipping versions creates complex migration paths with deprecated dependencies 6. Scaling architecture — Each service (MySQL, MongoDB, Redis, Elasticsearch) needs its own HA configuration as you grow 7. Security responsibility — Continuous audits, credential management, encryption, data privacy compliance 8. Monitoring and alerting — You need New Relic, Datadog, or equivalent — plus someone watching the dashboards 9. Ongoing maintenance: biannual named releases (currently [Verawood](https://docs.openedx.org/en/latest/community/release_notes/verawood.html), released on July 30, 2026; [Ulmo](https://docs.openedx.org/en/latest/community/release_notes/ulmo.html) is no longer supported) each require migration work Most organizations find that managed hosting costs less than a single DevOps engineer's salary — while delivering better uptime, faster upgrades, and zero 3 AM pages. ### Quiz: Self-Hosting Reality Check --- ## Open edX Hosting Providers Compared (2026) Cubite is one of the providers in this Open edX hosting comparison and publishes it, so every provider price in the table below comes from the provider's own page, with the date it was checked. openedx.org's [installation and hosting directory](https://openedx.org/partner-category/open-edx-installation-and-hosting/) lists 44 providers (checked September 30, 2026); the table below covers the ones in this guide. ### Published Open edX hosting prices (checked September 30, 2026) | Provider | Published price | What the price includes | Capacity basis | Source and date | | --- | --- | --- | --- | --- | | Abstract Technology | Standalone Server EUR 599/mo, Standard EUR 1,199/mo, Enterprise individual plan (ex VAT; the site calls them average estimates) | Standalone: one EU environment, 30 GB, support, daily backups, patches, LTI, Zoom and SCORM, custom domain; Standard adds a cluster per tenant, 100 GB, a mobile app, branding and an AI assistant | Number of users: up to 1,000 (Standalone), 10,000 (Standard), 100,000+ (Enterprise) | abstract-technology.de/pricing, September 30, 2026 | | Appsembler (Tahoe) | None published | - | - | As of September 30, 2026, appsembler.com shows a holding page and appsembler.com/tahoe returns 404. | | Cubite | Lean $1,260/mo, Resilient $1,850/mo, Scale from $3,400/mo; no setup fee | Every tier: self-hosted Open edX with managed TLS and your domain; SSO (SAML / OIDC); branding and small-to-medium customization; SCORM, xAPI, LTI and API integration; learner and course analytics; daily backups and a quarterly restore rehearsal. Lean and Resilient include cloud resources; Resilient adds a second application node behind a load balancer; Scale runs on Kubernetes and bills cloud at cost | Concurrent learners: up to 1,000 (Lean, load-tested), up to 2,000 (Resilient), elastic (Scale) | cubite.io/pricing, September 30, 2026 | | eduNEXT | Not re-checked for this update | - | - | edunext.co (not re-checked) | | Edly | Not re-checked for this update | - | - | edly.io (not re-checked) | | OpenCraft | Maintenance EUR 1,435-2,255/mo, plus hosting at EUR 200-300/mo per 1,000 active users and a one-off setup of EUR 4,100-6,150 | Maintenance covers upgrades, security patches and platform stability; hosting is billed by usage; SSO, mobile apps and other add-ons are scoped separately | Active users (hosting); none stated for maintenance | opencraft.com/pricing, September 30, 2026 | | Raccoon Gang | Hosting from $800/mo for smaller platforms and $1,000/mo for growing platforms, larger ones custom; support plans from $450/mo ex VAT, sold separately; Tanuki SaaS from EUR 50/mo | Hosting: setup, cloud configuration, monitoring and SLA support, scaling, upgrades, patching, backups and disaster recovery, migration | Priced on "learner load, registered users, courses, cloud provider, storage, traffic, integrations, and support level" | raccoongang.com/open-edx-services/platform-deployment, raccoongang.com/technical-support and raccoongang.com/open-edx-services/tanuki, September 30, 2026 | Cubite prices managed Open edX by capacity tier, not per learner: $1,260 a month covers up to 1,000 concurrent learners. See every tier on [Cubite pricing](https://cubite.io/pricing), the service on [managed Open edX](https://cubite.io/services/managed-open-edx), and the side-by-side [Open edX provider comparison](https://cubite.io/compare/best-open-edx-providers). ### What to Look For in a Provider Not all providers are equal. openedx.org's [installation and hosting directory](https://openedx.org/partner-category/open-edx-installation-and-hosting/) shows provider experience ranging up to 10+ years. Here's what matters: Must-haves: - Named release upgrade track record — Ask how many upgrades they've completed and what their process looks like - Core contributor status — Providers who contribute to the Open edX codebase understand it at a deeper level - SLA with specific uptime numbers — "High availability" is marketing. "99.9% with 30-second health checks" is an SLA - Data ownership terms — Your data should be fully yours, exportable at any time, in standard formats - Transparent pricing — If a provider won't show pricing, ask yourself why Red flags: - No public pricing and no ballpark range on request - No clear upgrade path or release cadence - Vendor lock-in terms that make migration difficult - Less than 4 years of Open edX-specific experience - No references or case studies from similar organizations --- ## What Managed Hosting Providers Actually Handle If you've read the self-hosting section and thought "I don't want to deal with any of that" — this is what you're paying for with managed hosting. A good managed Open edX hosting provider handles: - Automatic upgrades: named releases arrive twice a year (Verawood is current; Willow is scheduled for December 2026). Your provider migrates you, tests compatibility, and handles rollbacks if needed - 24/7 monitoring — Services checked every 30 seconds with automatic escalation. - Automated backups — Daily snapshots with point-in-time recovery and disaster recovery testing - Custom theming — Your brand's colors, logos, and layouts applied without touching code. - XBlock management — Installing, configuring, and testing plugins (SCORM, LTI, drag-and-drop, peer assessment) for compatibility with each release - SSO integration — SAML 2.0, OAuth, LDAP, and Shibboleth configured and maintained. - Auto-scaling infrastructure — Traffic spikes from enrollment periods, exam windows, or course launches handled automatically - Security and compliance — Encryption at rest and in transit, regional data hosting options, regular security patches applied within hours of release - Full data ownership — Your data stays yours. Export it anytime in standard formats What you focus on instead: Course content, learner engagement, instructional design, and organizational strategy. The stuff that actually moves the needle. --- ## How to Choose the Right Open edX Hosting for Your Organization Stop asking "which provider is best?" and start asking "which hosting path fits my organization?" Here's a decision framework based on org type: | Organization Type | Recommended Path | Why | | --- | --- | --- | | University (1,000-10,000 students) | Self Hosted | You need SSO (SAML/Shibboleth), custom branding, LTI integration, and reliable uptime during exam periods. Your IT team should focus on teaching and research infrastructure, not LMS ops | | Enterprise L&D (500-5,000 users) | Managed hosting or Self Hosted | Depends on customization needs. If you need deep integration with HR systems and custom reporting, go managed. If standard features suffice, SaaS gets you live faster | | EdTech startup (scaling rapidly) | Managed with Kubernetes | You need a platform that scales without re-architecting. Self-hosting distracts from product development. Choose a provider that supports BYOC so you can migrate later if needed | | Government / large institution (10,000+) | Managed BYOC or self-hosted | Data sovereignty requirements may mandate specific cloud regions. BYOC (bring your own cloud) gives you data control with managed operations. Self-hosted only if you have an existing DevOps team | | Small org / pilot (<500 learners) | SaaS or consider alternatives | Open edX may be overkill.. For very simple needs, Moodle or Canvas might be more appropriate | ### 5 Questions to Ask Every Provider Before signing a contract, ask these: 1. "How many Open edX upgrades have you managed, and what's your rollback process?" — This separates experienced providers from newcomers 2. "Do you contribute to the Open edX codebase?" — Core contributors understand the platform at a deeper level and can fix issues upstream 3. "What's your SLA, and what happens when you miss it?" — Get specific numbers: uptime percentage, response time guarantees, and financial penalties for breaches 4. "Can I export all my data at any time in standard formats?" — The answer should be an immediate yes with no conditions 5. "What happens if I want to switch providers or go self-hosted?" — A confident provider will help you migrate. A lock-in-dependent provider will make it difficult --- ## Open edX vs Moodle: Hosting Compared If you're still deciding between Open edX and Moodle, this LMS hosting comparison covers the differences that actually matter — architecture, resource requirements, and cost For the full Moodle side of the decision, see the [Moodle hosting guide](/blogs/moodle-hosting). | | Open edX | Moodle | | --- | --- | --- | | Architecture | Microservices (Django, MySQL, MongoDB, Elasticsearch, Redis, Celery) | Monolith (PHP + MySQL/PostgreSQL on LAMP/LEMP stack) | | Minimum RAM | 8 GB (production) | 512 MB (basic) to 4 GB (production) | | Self-hosting complexity | High — 7 coordinated services | Moderate — single application server | | Deployment tool | Tutor (Docker-based, official) | Standard LAMP stack or Moodle Cloud | | Scaling approach | Kubernetes horizontal scaling | Load balancer + read replicas | | Built for | Massive scale (Harvard/MIT origin, 100M+ learners) | Traditional education, smaller-to-medium deployments | | Multimedia/interactive | Rich XBlock ecosystem, native video, interactive assessments | Plugin-based, less native interactivity | | Managed hosting cost | Varies by provider; see the dated price table above | $1,000-15,000/yr | | Self-hosting cost | $50K-200K+/yr | $20K-60K/yr | Choose Open edX if: You need to scale to thousands of concurrent learners, require rich multimedia and interactive content (XBlocks), want a modern microservices architecture, or are building an EdTech product on top of the platform. Choose Moodle if: You need a simpler setup, have a smaller deployment (<5,000 users), want lower hosting costs, or your use case is traditional course-based education without heavy multimedia. Either way: Managed hosting makes more sense than self-hosting for most organizations in both ecosystems. ### Quiz: Are You Ready to Choose? --- ## Frequently Asked Questions ### How much does managed Open edX hosting from Cubite cost? Cubite offers managed self-hosted Open edX from $1,260/mo, all-in, load-tested to 1,000 concurrent learners, with SSO, SCORM, xAPI, LTI, branding and cloud resources included. Resilient ($1,850 a month) adds a second application node behind a load balancer for up to 2,000 concurrent learners, and Scale (from $3,400 a month) runs on Kubernetes with cloud billed at cost. ### How much does it cost to host Open edX? The total cost depends on three factors: your number of active learners, required features (SSO, custom theming, analytics), and whether you self-host or use a managed provider. Self-hosted TCO (total cost of ownership) reaches $50,000-200,000+/year when you factor in infrastructure, a DevOps engineer, monitoring tools, and the opportunity cost of maintenance. Most organizations under 2,000 active users find managed hosting significantly cheaper. ### Can Open edX be self-hosted? Yes, Open edX is open-source and can be self-hosted using Tutor, the official Docker-based deployment tool. You'll need at minimum 8 GB RAM and 4 CPU cores. However, self-hosting requires DevOps expertise in Docker, Kubernetes, MySQL, MongoDB, and Linux — making managed hosting more practical for most organizations. Self-hosting gives you complete control over your infrastructure, data, and customization. The tradeoff is significant operational responsibility: you handle upgrades (twice yearly), security patches, backups, scaling, and monitoring. The [legacy Ansible-based installer was archived in May 2024](https://github.com/openedx/public-engineering/issues/51), so Tutor is your only supported path. For organizations with an existing DevOps team and 20,000+ active users, self-hosting can be cost-effective. For everyone else, the math favors managed hosting. ### What are the server requirements for Open edX? Open edX requires minimum 4 GB RAM and 2 CPU cores for development, but production deployments need 8-16 GB RAM, 4+ CPU cores, and 25+ GB storage. The stack includes Django, MySQL, MongoDB, Elasticsearch, Redis, and Celery. Beyond 1,500 active users, you'll need to separate database layers onto dedicated servers. The [official Tutor documentation](https://docs.tutor.edly.io/gettingstarted/requirements.html) lists 4 GB/2 CPU as the absolute minimum — but that's for development only. Community reports suggest production deployments serving 300+ active users need 16 GB RAM for the application server, plus separate instances for MySQL (8 GB), MongoDB (8 GB), and a reverse proxy. A single-server deployment caps at roughly 1,500 active users; beyond that you scale the application tier horizontally, with more application nodes behind a load balancer or with Kubernetes. ### Is Open edX free to use? Open edX software is free and open-source under the AGPL license. However, running it requires server infrastructure, DevOps expertise, and ongoing maintenance. Think of it like WordPress: the software is free, but you still need hosting, a domain, themes, plugins, and someone to maintain it all. Open edX's infrastructure requirements are significantly higher than WordPress, which is why the "free" label can be misleading. You're not paying for a software license — you're paying for the expertise and infrastructure to run a complex distributed system reliably. ### What is Tutor for Open edX? Tutor is the official, community-supported deployment tool for Open edX. It uses Docker containers to package and run all Open edX components. Since the Maple release, Tutor replaced the legacy Ansible-based installer as the sole supported deployment method. It supports both single-server (Docker Compose) and Kubernetes deployments. Tutor is maintained by [Edly](https://edly.io/) and adopted as the official Open edX deployment method via [OEP-45](https://open-edx-proposals.readthedocs.io/en/latest/architectural-decisions/oep-0045/decisions/0001-tutor-as-replacement-for-edx-configuration.html). It simplifies deployment by containerizing all services, but "simplified" is relative — you still need Docker, DNS, SSL, and SMTP expertise for production. Tutor's plugin system allows extensions (SCORM, Kubernetes, MFE customization), and it's how managed hosting providers deploy their instances too. ### How do I upgrade Open edX? Upgrading Open edX with Tutor involves pulling the latest images and running migration commands. However, skipping versions creates complex migration paths with deprecated dependencies and database changes. Managed hosting providers handle upgrades automatically, which is one of their strongest value propositions — eliminating downtime risk and migration headaches. Open edX releases two named versions a year. The current release is [Verawood](https://docs.openedx.org/en/latest/community/release_notes/verawood.html): Verawood.1 shipped on July 30, 2026, later than its date on the release schedule, and [Ulmo](https://docs.openedx.org/en/latest/community/release_notes/ulmo.html) (January 2026) is now listed as unsupported. Each upgrade requires database migrations, plugin compatibility checks, and potentially theme updates. The recommended upgrade approach for self-hosted instances is to back up all data, tear down the old environment, and deploy fresh — then restore data. This carries real downtime and failure risk, which is why upgrade management is one of the top reasons organizations choose managed hosting. ### Who uses Open edX? Open edX powers [2,283+ live sites](https://openedx.org/blog/the-2024-open-edx-impact-report-is-here/) serving [100+ million learners](https://openedx.org/blog/open-edx-community-reaching-100-million-learners-and-driving-global-impact/). Users include Harvard, MIT, and Western Governors University in education; NVIDIA, Tesla, Cisco, and McKinsey in enterprise training; and NASA, the US DoD, and UK Cabinet Office in government. The platform grows [18% year-over-year](https://openedx.org/blog/the-2024-open-edx-impact-report-is-here/). The platform spans every sector: higher education, corporate training, government, and NGOs. Recent developments include a [partnership with India's National Skill Development Corporation (NSDC)](https://openedx.org/blog/axim-collaborative-and-open-edx-project-announce-new-partnership-with-the-national-skill-development-corporation/) and growing AI integration — [Axim's 2025 Impact Report](https://impactreport2025.axim.org/) notes that over 50% of new partnerships feature AI as a central component. The next [Open edX Conference (2026)](https://con.openedx.org/) is hosted by Western Governors University in Salt Lake City. ### Open edX vs Moodle: which is better for hosting? Open edX excels at scale (built for millions of learners) with modern microservices architecture, but requires significantly more hosting resources (8+ GB RAM vs Moodle's basic LAMP stack). Moodle is simpler to self-host. For large-scale deployments with rich multimedia content, Open edX's architecture is superior. For smaller deployments, Moodle hosting is simpler and cheaper. The right choice depends on your scale and needs. Open edX's distributed architecture (Django, MySQL, MongoDB, Elasticsearch, Redis, Celery) is heavier to host but built for massive concurrency. Moodle's monolithic PHP stack is easier and cheaper to run but hits scaling limits sooner. Both have healthy managed hosting ecosystems. If you're serving under 5,000 users with traditional course-based content, Moodle is simpler. If you need rich interactive content, XBlock extensibility, and enterprise-grade scaling, Open edX is worth the additional hosting investment. --- ## The Bottom Line Open edX is a world-class LMS trusted by the most demanding organizations on the planet. But it's also a complex distributed system that requires serious infrastructure commitment. Here's what to remember: - Self-hosting costs add up once you account for infrastructure AND staff. - Cubite's managed Open edX starts at $1,260 a month; the lowest published price for a managed instance in the table is EUR 599 a month (Abstract Technology's Standalone Server, ex VAT). - SaaS options trade customization and control for a faster launch - The provider you choose matters — look for core contributor status, transparent pricing, named release upgrade track records, and clear data ownership terms - Tutor is the only supported deployment method — any provider or article recommending Ansible-based deployment is outdated The question isn't whether you can afford managed hosting. It's whether you can afford not to. ## Ready for managed Open edX hosting? Cubite handles deployment, upgrades, scaling, and security for you. Managed Open edX plans start at $1,260/month, proven at 1,000 concurrent learners. [See managed Open edX plans](https://cubite.io/services/managed-open-edx) --- # Open edX Verawood: What's New + Why Ulmo Is Now EOL https://cubite.io/blogs/open-edx-verawood-features **By:** Amir Tadrisi **Updated:** 2026-09-24 Open edX Verawood shipped July 30, 2026 with an MFE Instructor Dashboard, the AI Extension Framework, and frontend-base support. Ulmo lost support that day. # Open edX Verawood: What's New and What Breaks If you're still running Ulmo, your release-support clock has already run out. Open edX Verawood, the 22nd community release, shipped on July 30, 2026, and with it every release before it fell out of community support. That includes Ulmo, which many production sites had only finished upgrading to a few months earlier. This article is the operator-side briefing on Verawood: the verified feature list, the deprecations you need to audit for, and a realistic 4–8 week upgrade timeline. We've shipped Open edX deployments at [Cubite](https://cubite.io/) since 2013, across Sumac, Teak, and Ulmo. This is the same brief we'd hand our own engineering team. --- ## The 30-Second Brief on Verawood Open edX Verawood is the 22nd community release of the Open edX platform, released on July 30, 2026 per the [official Verawood release notes](https://docs.openedx.org/en/latest/community/release_notes/verawood.html). It was originally scheduled for June 9 on the [Open edX release schedule](https://openedx.atlassian.net/wiki/spaces/COMM/pages/3613392957/Open+edX+release+schedule), then moved to June 23 by the [Build-Test-Release working group](https://discuss.openedx.org/t/proposal-shift-verawood-timeline-to-23-04-2026-cut-23-06-2026-release/18605). The release branch was cut at the end of April 2026, and the release notes cover changes from October 30, 2025 to April 9, 2026. In our reading, Verawood is about platform maturity and operational stability: fewer flashy features, more long-term groundwork. Headline items: - AI Extension Framework: a standardized plugin for AI features (it also runs on Teak and Ulmo; Verawood is the first release whose release notes cover it) - Instructor Dashboard overhaul: the new React/Paragon dashboard replaces the Django-template version and is on by default - Granular team management: an opt-in, role-based permission system for Studio course authoring (stackable program pathways are planned for Willow) - LTI + Content Library hardening for reliable block-level reusability - Frontend foundation: first release to support frontend-base (OEP-65), alongside the Paragon design-token theming (tutor-contrib-paragon) available since Teak - Tutor v22 support (released August 2026), which moves edx-platform to Python 3.12 and requires a Meilisearch reindex --- ## The Open edX Release Calendar, Quickly Reframed Open edX runs a six-month release cycle. Named versions are scheduled for June 9 and December 9, though recent releases have slipped: Ulmo shipped in January 2026 and Verawood on July 30, 2026. Per the [Open edX release schedule wiki](https://openedx.atlassian.net/wiki/spaces/COMM/pages/3613392957/Open+edX+release+schedule): | Release | Shipped | Support status (as of September 2026) | | --- | --- | --- | | Sumac | December 2024 | Unsupported since June 2025 | | Teak | June 2025 | Unsupported since Ulmo shipped (Jan 2026) | | Ulmo | January 2026 | Unsupported since July 30, 2026 | | **Verawood** | **July 30, 2026** | The only supported release | | Willow | Mid-to-late February 2027 (target) | Not yet released | Practical read: if you're on Teak or earlier, you're not just behind on features: you're running code with no upstream CVE coverage. If you are on Ulmo, its official support ended on July 30, 2026. The August and September 2026 openedx-platform security fixes were still added to Ulmo, but don't plan around that continuing. (Still weighing the platform itself rather than the upgrade? See our [Open edX vs Moodle comparison](https://cubite.io/compare/open-edx-vs-moodle) before going further.) --- ## What's Actually in Verawood — The Feature Deep Dive Below are the Open edX Verawood features worth knowing as an operator. Claims link to a primary source where one exists: [docs.openedx.org](https://docs.openedx.org), the [openedx-ai-extensions](https://github.com/openedx/openedx-ai-extensions) repo, or the relevant GitHub deprecation issue. ### The AI Extension Framework A notable strategic shift around Verawood is the [Open edX AI Extension Framework](https://docs.openedx.org/projects/openedx-ai-extensions/en/latest/concepts/framework_concepts.html). It's a platform plugin (openedx-ai-extensions) that introduces a standardized integration path for AI tools instead of one-off bolt-ons. The plugin also runs on Teak and Ulmo; Verawood is the first release whose official release notes cover it. Concretely, the framework provides: - A LiteLLM-backed provider layer: supports OpenAI, Anthropic, and local models out of the box - Tool primitives already shipped in the demo fixtures: content summarization, flashcard generation, chat with function calling, streaming chat, and an educator assistant - MFE plugin slots in both the Learning MFE and the Authoring MFE for surfacing AI experiences to learners and authors - Aspects event analytics so every AI workflow is observable - Configuration-driven behavior: most setup happens in Django admin at /admin/openedx_ai_extensions/, not in code The caveat that matters: per the [project README](https://github.com/openedx/openedx-ai-extensions), the framework is currently experimental and not yet recommended for production. The Verawood release notes do describe working features, including an in-unit AI assistant for learners and AI-drafted multiple-choice questions in Studio, but the README warning still applies. Operators who set up the plugin pipeline now will be ready when first-party AI tools mature in subsequent releases — that's the win for early adopters. ### The Instructor Dashboard MFE Migration The Instructor Dashboard has been a server-rendered Django-template island in an otherwise MFE-first platform for years. Per [GitHub issue #37214](https://github.com/openedx/edx-platform/issues/37214), that was the plan, and in Verawood it landed: the new Instructor Dashboard is the default experience. That ticket has since been closed as a duplicate; the open deprecation ticket, [issue #38432](https://github.com/openedx/openedx-platform/issues/38432), lists Xylon as the earliest named release with breaking changes. The new dashboard lives in frontend-app-instructor-dashboard (originally frontend-app-instruct) and is built on React, TypeScript, React Query, and Paragon. Ten Django template files are slated for eventual removal, covering: course info, membership, cohort management, student administration, data downloads, special exams, certificates, and more. If your deployment includes custom instructor flows or template overrides (and many multi-tenant or higher-ed deployments do), this is one of the highest-impact deprecations in Verawood. Plan for a port, not a copy-paste. In Verawood the new dashboard is on by default, and sections injected through the legacy InstructorDashboardRenderStarted filter no longer appear. The instructor.legacy_instructor_dashboard waffle flag brings the old dashboard back, but only as a stopgap: the legacy dashboard is deprecated and expected to be removed in a future release (the open [deprecation ticket](https://github.com/openedx/openedx-platform/issues/38432) lists Xylon as the earliest named release with breaking changes). Verawood is where the migration starts, not where it ends. ### Stackable Program Pathways (Planned for Willow) An earlier version of this article listed stackable pathways for programs (micro-credentials feeding into degrees, prerequisite chains, sequenced certifications) as a Verawood feature. They did not ship in Verawood: the [official Verawood overview](https://docs.openedx.org/en/latest/community/release_notes/verawood/verawood_marketing_notes.html) lists Modular Pathway Support under "Upcoming in Willow" and says that for Willow the platform will support stackable pathways for programs. Until then, expressing real curriculum architecture in Open edX usually still means external workflow tools or custom XBlocks. For higher-ed and workforce-credential operators, this is the feature to watch in Willow. For pure self-paced course catalogs, it's mostly invisible, and that's fine. ### LTI + Content Library Hardening Verawood builds on Ulmo's LTI Advantage Complete certification and reusable LTI configurations with two operator-grade improvements: reliable LTI block duplication (which has been historically brittle) and a simpler, tabbed LTI setup in Studio. If you've ever lost a day debugging an LTI tool that worked in the source course but not in the duplicate, this is for you. ### Frontend and Tutor Verawood is the first release that supports [frontend-base](https://github.com/openedx/frontend-base), the unified modern frontend foundation specified in OEP-65. It ships four frontend-base apps: the new Instructor Dashboard and notifications are on by default, while the Authn and Learner Dashboard apps are opt-in. Separately, the tutor-contrib-paragon plugin (available since Teak) compiles [Paragon](https://github.com/openedx/paragon) design tokens into MFE themes through Tutor; frontend-base apps follow their own theming docs, so existing MFE branding will likely need porting. On the operations side, Tutor users move to Tutor v22 (released August 2026), which requires Python 3.10+, moves edx-platform to Python 3.12, and needs a Meilisearch reindex during the upgrade. The longer-term payoff is frontend-base: the community expects all MFEs to be converted to frontend-base apps by Xylon (June 2027). Translation: this release pays you back at next upgrade, not this one. | Capability | Ulmo (Jan 2026) | Verawood (July 2026) | | --- | --- | --- | | AI integration | One-off bolt-ons (the plugin also runs on Ulmo) | AI Extension Framework (experimental) | | Instructor Dashboard | Django templates | New MFE dashboard on by default (`frontend-app-instructor-dashboard`) | | Program pathways | Linear | No change (stackable pathways planned for Willow) | | LTI duplication | Fragile | Hardened | | Theming | Design Tokens introduced | Design tokens, plus frontend-base theming for new apps | | Frontend foundation | MFE per app | First release to support `frontend-base` (OEP-65) | | Tutor | Tutor pip→uv, Tutor Deck | Tutor v22 (Python 3.12, Meilisearch reindex) | | Support status (September 2026) | Ended July 30, 2026 | Only supported release since July 30, 2026 | --- ## What Breaks, Deprecates, and Disappears The full Verawood breaking-change list is in the [Developer & Operator Release Notes](https://docs.openedx.org/en/latest/community/release_notes/verawood/dev_op_release_notes.html), which are the source of truth. The items we'd audit first: - Legacy Instructor Dashboard: the new frontend-app-instructor-dashboard is the default, the Django-template dashboard is deprecated ([issue #38432](https://github.com/openedx/openedx-platform/issues/38432)), and sections injected through the legacy InstructorDashboardRenderStarted filter no longer appear. Audit any template overrides or instructor-tool customizations. - Legacy frontend patterns predating frontend-base/OEP-65 — anything still hooking the pre-frontend-base scaffolding is on borrowed time. - Paragon v22 patterns — if your theme code predates v23 design tokens, plan a port. - Plugins not validated against the Ulmo-cycle Tutor changes: pip → uv and the Tutor Deck transition can break community plugins that were never updated for them. Anything you haven't smoke-tested under Tutor v22 is suspect. - Aspects Analytics v4.0.0: a breaking upgrade that moves Aspects to Python 3.12 and Superset 6.0. Review it before touching any analytics-pipeline customizations. A plain Ulmo deployment with no forks and standard plugins will see a fairly mild Verawood. A heavily forked, multi-tenant, custom-instructor-dashboard deployment will not. Both deserve the audit; only one can safely skip the phased plan in the FAQ below. --- ## Why You Can't Just Wait The cleanest argument for prioritizing your Open edX upgrade in 2026 is the support model itself. Per the [Open edX named release docs](https://docs.openedx.org/en/latest/community/release_notes/named_release_branches_and_tags.html), the latest release is the only supported release, and the community states it does not currently have the ability to support more than one release at a time. | Your current release | Risk level | What's actually true | Recommended action | | --- | --- | --- | --- | | Verawood | Low | Patched | Stay current; monitor patch releases | | Ulmo | High | Unsupported since July 30, 2026; recent security fixes still backported | Audit now, upgrade in Q4 2026 | | Teak (June 2025) | High | Unsupported since January 2026 | Upgrade as priority; you're 2 releases behind | | Sumac (Dec 2024) | Critical | Unsupported since June 2025 | This is a quarterly board-deck item | | Redwood or older | Critical + compounding | Multiple release jumps required | Engage a migration partner; do not attempt sequentially in-house | Two compounding factors most operators underweight: Operational debt compounds non-linearly. Each release you skip multiplies migration squashes, plugin breakages, and theme rewrites. The Open edX team periodically squashes Django migrations across versions, and selecting the right migration entry point is the difference between a clean upgrade and a corrupted database — as [Raccoon Gang's upgrade guide](https://raccoongang.com/blog/open-edx-upgrades-what-you-should-know-before-updating/) puts it bluntly. Three skipped releases isn't 3× harder. It's closer to 6×. EOL software is becoming a documented legal liability in the EU. The Cyber Resilience Act (CRA), whose reporting obligations have applied since 11 September 2026 and whose main obligations apply from 11 December 2027, makes vendors accountable for vulnerability handling in every component they ship — including end-of-life upstream open source. Per [HeroDevs' analysis of the CRA](https://www.herodevs.com/blog-posts/your-eol-open-source-is-an-eu-cyber-resilience-act-problem-heres-how-to-fix-it), the regulation makes EOL software in your product stack a documented legal liability: you own the vulnerability-handling obligations for every component you ship, regardless of whether that component still has an upstream maintainer. If you ship software products to EU customers, check your CRA obligations now. The defensible "wait for .1" position has expired: Verawood.1 has been out since July 30, 2026. From Teak or earlier, every month of delay buys you more debt, not safety. --- ## Why Most Teams Bring in a Partner (And What "Reliable" Looks Like) Doing the Open edX upgrade in-house is viable. We've worked alongside teams who do it well. The shared traits are predictable: they upgrade more than once every 18 months, they have full-time staff fluent in Tutor / Django / MFEs, and their fork is small or vanilla. If even one of those isn't true, the math usually tips toward a partner. A short DIY-vs-partner checklist: - We've shipped at least one Open edX major upgrade in the last 18 months - We have at least one engineer fluent in Tutor + Django migrations + MFE builds - Our platform fork is vanilla or shallow (less than 6 months of drift) - We can dedicate 4–8 weeks of focused engineering attention - We have no near-term compliance or audit deadline - We have a tested rollback path from prior upgrades What to look for in a partner: - Verifiable Open edX credentials: a listing in the [Open edX provider directory](https://openedx.org/partner-category/open-edx-installation-and-hosting/), public code contributions, or client references - A multi-release track record: ask specifically whether they shipped Teak → Ulmo and Ulmo → Verawood upgrades and what broke - Transparent methodology and rollback policy — not just "we'll handle it" - Real engineering depth — Tutor plugins, custom XBlocks, MFE work, not just managed hosting [Cubite](https://cubite.io/) has been engineering Open edX deployments since 2013. We offer [dedicated Open edX hosting from $1,260/month](https://cubite.io/services/managed-open-edx), custom platform builds, and Verawood upgrade assessments. The upgrade plan in this article is the same one our engineering team runs. --- ## FAQ ### What is Open edX Verawood? Open edX Verawood is the 22nd community release of the Open edX platform, released on July 30, 2026. It focuses on platform maturity and modernization: a new MFE-based Instructor Dashboard (on by default), the AI Extension Framework, first support for frontend-base, Content Library and LTI improvements, and opt-in role-based permissions for Studio. Its release also ended community support for Ulmo. Verawood's release notes cover changes from October 30, 2025 to April 9, 2026, and the release branch was cut at the end of April 2026. In our reading the release favors operational stability over flashy features: much of the work is groundwork that pays back at the next upgrade, such as first-release frontend-base support, the new Instructor Dashboard, and LTI blocks that can now be duplicated. See the [official Verawood release notes](https://docs.openedx.org/en/latest/community/release_notes/verawood.html) for the canonical feature list. ### When is Open edX Verawood released? Open edX Verawood was released on July 30, 2026, after its release branch was cut at the end of April 2026. It was originally scheduled for June 9, moved to June 23, and then shipped in late July. It succeeds Ulmo (January 2026) on Open edX's six-month release cadence. With Verawood's release, Ulmo lost community support, so if you're still on Ulmo, now is the time to plan and stage your upgrade. The cadence targets June 9 and December 9, but dates slip: Verawood shipped about seven weeks late. Willow, the next release after Verawood, has been pushed back too: the Build-Test-Release working group plans to cut it in the first week of January 2027 and is targeting a mid-to-late February 2027 release. ### What's new in Open edX Verawood? Verawood ships a new MFE-based Instructor Dashboard built with React and Paragon (on by default), the AI Extension Framework (LiteLLM-powered, supporting OpenAI, Anthropic, and self-hosted models), first support for frontend-base, duplicable LTI blocks with a simpler LTI setup, Content Library improvements, a new Studio sidebar, in-platform taxonomy tagging, and opt-in role-based permissions for Studio. Stackable program pathways are planned for Willow. The AI framework is the strategic headline; the Instructor Dashboard MFE migration is the practical one. If your deployment customizes the dashboard, that's where most of your Verawood engineering work will live. ### Do I have to upgrade from Ulmo to Verawood? Strictly, no — Open edX is open source. Practically, yes: only the latest release is officially supported. When Verawood shipped on July 30, 2026, Ulmo joined Teak and Sumac in the unsupported tier. The August and September 2026 security fixes were still added to Ulmo, but that is not guaranteed, and any CVE that isn't backported becomes your team's problem. For most operators, planned upgrade beats unplanned incident response. The EU Cyber Resilience Act adds a legal dimension: shipping EOL software to EU users will carry documented vendor obligations from December 2027. Combined with the operational-debt math (each skipped release compounds upgrade complexity), the "wait" position has run out for Ulmo sites now that Verawood.1 is out. ### How long does an Open edX upgrade take? A planned Ulmo to Verawood upgrade typically takes 4–8 weeks for a moderately customized instance: 1 week audit, 1–2 weeks fork reconciliation and plugin compatibility, 1–2 weeks staging build, 1 week dry-run migration with squashed Django migrations, and a weekend cutover with rollback gate. Heavily forked or multi-tenant deployments take longer. Each release you've skipped roughly compounds the timeline. A Teak → Verawood upgrade isn't 2× harder than Ulmo → Verawood — it's more like 3–4× because of migration squashes, plugin compatibility gaps, and theme version drift. ### Should I use a managed provider to upgrade Open edX? If your team upgrades Open edX more often than once every 18 months and has staff fluent in Tutor, Django migrations, MFE builds, and your specific fork, in-house is viable. If not, an Open edX migration service provider almost always ships faster and safer — once you account for opportunity cost of internal engineering time. The clearest signal: if you're more than one release behind (Teak or earlier) and you have any production customization, the risk profile strongly favors a partner. ### Will my plugins break in Verawood? Don't assume a plugin is Verawood-ready: check each one for a release that supports Tutor v22. The breakages cluster in two places: plugins that haven't been updated through the Ulmo-cycle Tutor changes (pip → uv, Tutor Deck) and plugins that hook the legacy Instructor Dashboard templates. Both surface during the plugin-compatibility phase of the upgrade timeline above. The forensic approach: for each plugin, check the latest release date, whether it has a Verawood-tagged version, and whether its issue tracker has open compatibility threads. ### Is Open edX Verawood backward compatible with my current Tutor version? Not always. Each Open edX named release pins to a major Tutor version, and Verawood continues the modernization that started in Ulmo (uv-based builds and Tutor Deck in Tutor v21, plus tutor-contrib-paragon theming since Teak). Tutor added Verawood support in Tutor v22, which requires Python 3.10+ and a Meilisearch reindex. Plan to bump Tutor as part of the upgrade, and validate every Tutor plugin against the new version before staging cutover. The [Tutor releases page](https://github.com/overhangio/tutor/releases) is the canonical source; lock the Tutor version in your deployment manifest rather than tracking latest. --- ## The Bottom Line Open edX Verawood is a consequential platform release. The AI Extension Framework changes how AI integrations are built. The Instructor Dashboard MFE migration changes what every operator with custom instructor flows has to maintain. Frontend-base changes how MFEs will be built and themed from here on. But the most actionable fact about Verawood isn't a feature. It's the date: July 30, 2026. When Verawood shipped, Ulmo lost community support, Teak and Sumac sank deeper into unsupported territory, and the operational + legal cost of staying behind started compounding faster. If you're on Ulmo or earlier, the right move now is the pre-upgrade audit, followed quickly by the upgrade itself. Know your forks. Know your plugins. Know what your instructor dashboard customizations are about to cost you. Then plan the migration window with the phased timeline in the FAQ above. --- # Moodle Security in 2026: The CVEs to Patch and What to Do If You Can't Upgrade https://cubite.io/blogs/moodle-security-2026-cves **By:** Amir Tadrisi **Updated:** 2026-09-23 In 2026, Moodle disclosed a remote code execution flaw, a SQL injection bug, and a mobile-app token leak. Here is which version is exposed, how to check yours, and what to do when upgrading is not an option yet. On 22 July 2026, Moodle published a security advisory (CVE-2026-18025) warning that its mobile app could read the login tokens a user had saved for other Moodle sites. It was the third serious Moodle vulnerability disclosed in 2026, after a remote code execution flaw and a SQL injection bug earlier in the year. If you self-host Moodle, that run of advisories is your prompt to check exactly which version you are on and what still affects it. ## The 2026 Moodle security advisories, in order Moodle discloses vulnerabilities through its security announcements forum and assigns each one a CVE. Three from 2026 matter most for self-hosted sites, and two of them share a single fix. Here is the short version before the detail. | CVE | What it is | Affected versions | Fixed in | | --- | --- | --- | --- | | CVE-2026-7275 | Remote code execution via the Google Drive repository plugin | 5.1 to 5.1.3, 5.0 to 5.0.6, 4.5 to 4.5.10, and earlier unsupported | 5.1.4, 5.0.7, 4.5.11 | | CVE-2026-7274 | SQL injection via the external database authentication plugin (auth_db) | 5.1 to 5.1.3, 5.0 to 5.0.6, 4.5 to 4.5.10, and earlier unsupported | 5.1.4, 5.0.7, 4.5.11 | | CVE-2026-18025 | Moodle mobile app could read web-service tokens saved for other sites | Moodle app 5.2.0 and earlier | Moodle app 5.2.1 | The two May 2026 advisories, CVE-2026-7275 and CVE-2026-7274, were reported through Moodle's tracker (MDL-88423 and MDL-88138) and are fixed in the same three releases. The July advisory affects the Moodle mobile app, not the server, and is fixed in app version 5.2.1. ## What each vulnerability actually lets an attacker do CVE-2026-7275 is a remote code execution flaw in Moodle's Google Drive repository plugin. Remote code execution is the most serious class of web vulnerability, because it can let an attacker run their own code on the server that hosts your site. If you cannot patch immediately, Moodle's advised workaround is to disable the Google Drive repository plugin. CVE-2026-7274 is a SQL injection flaw in the external database authentication plugin (auth_db), which some sites use to authenticate users against an outside database. SQL injection can let an attacker manipulate the queries your site runs, putting the confidentiality and integrity of your database at risk. It is fixed in the same 5.1.4, 5.0.7 and 4.5.11 releases. CVE-2026-18025 is different, because it lives in the Moodle mobile app rather than on your server. A site logged into the app could read the secure-storage tokens for other Moodle sites the same user had configured, which could expose those sites' web-service tokens. Updating the app to version 5.2.1 closes it, so tell your mobile users to update. > **WARNING:** The thread connecting all three is version currency. Every server-side fix here lands in a supported branch (5.1, 5.0 or 4.5). If you are running an older, unsupported release, you do not get these patches at all through a normal update, and the exposure simply stays open. ## Why this is harder than 'just update Moodle' "Patch promptly" is the right advice and the hardest to follow. Moodle ships a new major version about every six months, and pushes security releases for supported branches whenever vulnerabilities are found. Keeping pace sounds simple until you try it on a production site that people depend on every day. - PHP and database requirements: a newer Moodle needs newer PHP, which can force a server upgrade first. - Plugin compatibility: a third-party plugin that has not been updated can break on the new version. - Custom themes and code: bespoke work often needs re-testing or porting before you dare upgrade. - Downtime and change windows: institutions can only take the site offline at certain times of year. - Unsupported versions: if you are on 4.4, 4.3 or older, there is no security release to apply at all. None of this is unique to security. It is the same operational drag that shapes the choice between [managed and self-hosted Moodle hosting](/blogs/moodle-hosting), and it runs through the [broader trade-offs of running Moodle](/blogs/moodle-limitations). The difference is that a security advisory puts a clock on it. ## How to check whether your site is affected You cannot decide what to do until you know your exact version and which entry points are live. This takes about five minutes inside your own admin area. ## Harden every Moodle site, patched or not Patching closes the specific holes. These controls shrink the damage of the next one, and most take an afternoon. Work through them regardless of which version you are on. - Confirm your Moodle version and compare it to 5.1.4, 5.0.7 or 4.5.11. - Apply the latest security release for your branch, or back-port the fixes if you cannot upgrade. - Disable the Google Drive repository plugin if you do not use it. - Review external database (auth_db) authentication and restrict its inputs. - Update the Moodle mobile app to 5.2.1 or later and ask your users to do the same. - Enforce multi-factor authentication for every admin account. - Serve every page over HTTPS and test a full backup restore, not just the backup. - Register your site with Moodle to receive advisories before public disclosure. ## What to do if you cannot upgrade right now Plenty of sites are stuck on an older release for a reason that is not going away this week. That is the same lesson as the [2026 Canvas data breach](/blogs/canvas-data-breach-2026): your learners' data is only as safe as your least-patched system. The move is to reduce exposure now, not to wait for the perfect upgrade window. Start by turning off the entry point: for CVE-2026-7275, disable the Google Drive repository plugin. Then get the specific security patches back-ported to your current release, so you close the hole without a full version jump. [Cubite's Moodle security audit](/services/moodle-security-audit) does exactly this, back-porting critical fixes to older branches such as 3.9, 4.1, 4.3 and 4.4 for teams that cannot upgrade normally yet, and its free tool shows which advisories still affect your exact version. ## Where a managed audit helps, and where it does not Be honest about this. If you run a supported version and apply security releases within days, you are already doing the most important thing, and an audit will mostly confirm it. A well-maintained self-hosted Moodle is a secure Moodle, and you do not need anyone for that. An audit earns its place in the harder cases: you are several versions behind, an upgrade is blocked by PHP or plugin compatibility, or nobody on the team has time to track advisories. In those situations, knowing precisely which of the 2026 CVEs still reach your install, and getting the fixes without a risky full upgrade, is the difference between a clock that is ticking and a hole that is closed. ## Frequently asked questions about Moodle security in 2026 ## Frequently asked questions about Moodle security in 2026 ### Is Moodle secure? Moodle is secure when you keep it patched. It is open source and actively maintained, but running an unsupported or unpatched version is the main risk. In 2026 alone, Moodle disclosed a remote code execution flaw and a SQL injection bug, both fixed in current releases you should apply promptly. ### What is CVE-2026-7275? CVE-2026-7275 is a remote code execution vulnerability in Moodle's Google Drive repository plugin, disclosed in 2026. It affects Moodle 5.1 to 5.1.3, 5.0 to 5.0.6, and 4.5 to 4.5.10. Update to 5.1.4, 5.0.7 or 4.5.11, or disable the plugin until you can patch. ### What are the latest Moodle vulnerabilities in 2026? The 2026 Moodle advisories include CVE-2026-7275 (remote code execution via the Google Drive repository), CVE-2026-7274 (SQL injection in external database authentication), and CVE-2026-18025 (the mobile app reading tokens saved for other sites). All three are fixed in current releases. ### How do I secure a Moodle site? Secure a Moodle site by applying security releases quickly, enforcing multi-factor authentication for admins, serving every page over HTTPS, disabling repository plugins you do not use, and keeping tested backups. Register your site with Moodle so you receive advisories before they are made public. ### How often does Moodle release security updates? Moodle ships a new major version about every six months and releases security fixes for supported branches as vulnerabilities are found, sometimes several times a year. Older Long Term Support branches receive back-ported security updates, which is why staying on a supported version matters. ### What if I cannot upgrade Moodle right now? If you cannot upgrade, reduce exposure first: disable the vulnerable plugin (for CVE-2026-7275, the Google Drive repository) and tighten access. Then have the specific security patches back-ported to your current release, so you close the hole without a full version jump. ## Stuck on an older Moodle version you cannot easily upgrade? Run Cubite's free Moodle security audit to see exactly which advisories still affect your version, then book a 30-minute call to scope back-porting the critical patches to your release. [Book a 30-minute Moodle security review](https://calendly.com/cubite/30min) --- # Instalar Moodle 5.2 en Hetzner Cloud https://cubite.io/blogs/instalar-moodle-hetzner **By:** Amir Tadrisi **Updated:** 2026-09-23 Guía paso a paso para hacer self-hosting de Moodle 5.2 en Hetzner Cloud. Requisitos, comandos, costos reales y qué necesitas saber sobre el mantenimiento. # Instalar Moodle 5.2 en Hetzner Cloud Moodle 5.2 salió el 20 de abril de 2026. En menos de una hora puedes tenerlo corriendo en un servidor Hetzner Cloud por €6.49 al mes. Esa es la parte fácil. La parte que la mayoría de guías no te cuentan — y la razón por la que muchos proyectos de self-hosting terminan migrando a soluciones managed después de 6 meses — es todo lo que viene después de la instalación. Esta guía cubre ambas cosas. Primero, los comandos exactos para instalar Moodle 5.2 en tu servidor propio con Hetzner Cloud. Después, una visión honesta de lo que implica mantenerlo en producción. Tú decides qué camino tomar. ## Por qué hacer self-hosting de Moodle 5.2 Moodle es el LMS más usado del mundo: más de [500 millones de usuarios registrados](https://research.com/education/lms-statistics) en 2026 (más datos en nuestro [análisis del LMS market share 2026](https://cubite.io/blogs/lms-market-share-2026)). En Latinoamérica domina con un [73% de market share](https://6sense.com/tech/learning-management-systems/moodle-market-share), y en Europa mantiene el 25%. El self-hosting tiene sentido cuando quieres: - Control total: sobre datos, plugins, personalización y uptime - Costos predecibles: sin sorpresas de pricing por usuario - Compliance: datos en servidores europeos (GDPR, regulaciones locales) - Rendimiento a medida: optimizar para tu caso de uso específico Con la versión 5.2 recién lanzada, es buen momento para arrancar una instalación nueva o planificar el upgrade. Los requisitos de servidor cambiaron (PHP 8.3+ ahora es obligatorio), así que muchas guías existentes quedaron desactualizadas. ## Qué hay de nuevo en Moodle 5.2 [Moodle 5.2](https://moodledev.io/general/releases/5.2) es la release más significativa desde el salto a la versión 5.0. Estas son las novedades que importan para una instalación nueva: IA integrada en core. AWS Bedrock y Google Gemini ahora son providers nativos. No necesitas plugins externos para funcionalidades de IA, vienen incluidos y se configuran desde el panel de administración. Dashboard rediseñado. El nuevo dashboard incluye Course Overview block por defecto y un calendario reposicionado. Las páginas de login y MFA también fueron rediseñadas con mejor UX. React en core. Moodle 5.2 introduce React como librería externa bundled, junto con la fase 1 del Moodle Design System. Esto marca la dirección del frontend de Moodle para los próximos años. Instalación via Composer. Las dependencias de terceros ahora pueden gestionarse con Composer, simplificando el deployment y las actualizaciones de librerías. Quiz bank renovado. Categorías colapsables, edición in-place, movimiento de preguntas entre bancos con subcategorías. El Report builder también recibió mejoras en filtros y notificaciones. Requisitos actualizados y este es el punto clave para el self-hosting: | Componente | Moodle 5.1 | Moodle 5.2 | | --- | --- | --- | | PHP | 8.2+ | 8.3.0 (64-bit) | | MariaDB | 10.6.7+ | 10.11.0+ | | MySQL | 8.0+ | 8.4+ | | PostgreSQL | 14+ | 16+ | Si vienes de una versión anterior, necesitas actualizar tu stack antes de instalar 5.2. El upgrade path requiere Moodle 4.4 o posterior como punto de partida. ## Requisitos de servidor para Moodle 5.2 Antes de elegir un plan en Hetzner, necesitas saber exactamente qué pide Moodle 5.2. Requisitos mínimos de software: - PHP 8.3.0+ (64-bit obligatorio). PHP 8.4.x también está soportado - Extensión sodium (requerida) - max_input_vars ≥ 5000 - Extensiones PHP: fpm, curl, gd, intl, mysql, xml, xmlrpc, ldap, zip, soap, mbstring, pspell - Base de datos: MariaDB 10.11+ o MySQL 8.4+ o PostgreSQL 16+ - Servidor web: Apache 2.4+ con mod_rewrite o Nginx Requisitos mínimos de hardware (Para una instalación real con cursos, plugins y tráfico) : | Recurso | Mínimo | Recomendado producción | | --- | --- | --- | | vCPUs | 2 | 4+ | | RAM | 4 GB | 8 GB+ | | Storage | 40 GB | 80 GB+ (depende del contenido) | | Ancho de banda | 1 TB/mes | 5+ TB/mes | Con estos números claros, veamos qué ofrece Hetzner. ## Por qué Hetzner para Moodle - comparativa de precios Hetzner es la opción de moodle hosting más barata con rendimiento serio en Europa. Punto. Si todavía estás decidiendo entre self-hosting, hosting gestionado y MoodleCloud, nuestra [guía de Moodle hosting](https://cubite.io/blogs/moodle-hosting) compara las tres opciones con precios. Estos son los [precios actualizados a abril de 2026](https://www.hetzner.com/cloud) (post-ajuste de precios): ### Planes recomendados para Moodle | Plan | vCPUs | RAM | Storage | €/mes | Usuarios concurrentes | | --- | --- | --- | --- | --- | --- | | CX23 | 2 shared | 4 GB | 40 GB | €3.99 | Solo testing/desarrollo | | **CX33** | **4 shared** | **8 GB** | **80 GB** | **€6.49** | **Hasta ~100** | | CPX32 | 4 AMD | 8 GB | 160 GB | €13.99 | 100–500 | | CPX42 | 8 AMD | 16 GB | 320 GB | €25.49 | 500–2,000 | | CCX13 | 2 dedicated | 8 GB | 80 GB | €15.99 | Carga predecible | | CCX23 | 4 dedicated | 16 GB | 160 GB | €31.49 | Enterprise / SLA | Todos los planes incluyen 20 TB de tráfico/mes, IPv4/IPv6, protección DDoS y firewalls. Los data centers están en Alemania y Finlandia (baja latencia para España y buena para LATAM). ### Hetzner vs otras opciones | Proveedor | Plan comparable | €/mes | Tráfico incluido | | --- | --- | --- | --- | | **Hetzner CX33** | 4 vCPU, 8 GB RAM | **€6.49** | 20 TB | | DigitalOcean | 4 vCPU, 8 GB RAM | ~€46 | 5 TB | | AWS Lightsail | 4 vCPU, 8 GB RAM | ~€58 | 5 TB | | MoodleCloud (Small) | Managed, 200 users | ~€10/mes (€120/año) | N/A | Para una instalación pequeña-mediana, el CX33 a €6.49/mes es difícil de superar. Si necesitas rendimiento garantizado sin "noisy neighbors" (otros usuarios en el mismo servidor físico), el CCX13 dedicado a €15.99/mes es la opción. ## Guía paso a paso - Instalar Moodle 5.2 en Hetzner Cloud Vamos al grano. Estos son los comandos exactos para tener Moodle 5.2 funcionando en un VPS de Hetzner Cloud con Ubuntu 24.04. Lo que necesitas antes de empezar: - Una cuenta en [Hetzner Cloud](https://www.hetzner.com/cloud) - Un dominio apuntando a la IP de tu servidor (registro A en tu DNS) - Acceso SSH a tu servidor - ~60 minutos ### Paso 1 — Crear el servidor en Hetzner 1. En el [panel de Hetzner Cloud](https://console.hetzner.cloud/), crea un nuevo proyecto 2. Haz click en "Add Server" 3. Selecciona: - Location: Falkenstein o Nuremberg (más baratos) - Image: Ubuntu 24.04 - Type: CX33 (4 vCPU, 8 GB RAM, €6.49/mes) — o mayor si lo necesitas - Networking: IPv4 + IPv6 - SSH Key: Agrega tu clave pública (no uses contraseña) Click "Create & Buy Now" En 30 segundos tendrás un servidor corriendo. Anota la IP. ### Paso 2 — Preparar el entorno (LAMP stack) Conéctate por SSH y ejecuta estos comandos: ```bash # Actualizar sistema sudo apt update && sudo apt upgrade -y # Instalar Apache sudo apt install apache2 -y sudo systemctl enable apache2 # Agregar repositorio de PHP (para 8.3) sudo apt install software-properties-common -y sudo add-apt-repository ppa:ondrej/php -y sudo apt update # Instalar PHP 8.3 con todas las extensiones que Moodle necesita sudo apt install php8.3 php8.3-fpm php8.3-curl php8.3-gd \ php8.3-intl php8.3-mysql php8.3-xml php8.3-xmlrpc \ php8.3-ldap php8.3-zip php8.3-soap php8.3-mbstring \ php8.3-pspell php8.3-sodium php8.3-apcu -y # Habilitar PHP-FPM con Apache sudo a2enconf php8.3-fpm sudo a2enmod proxy_fcgi rewrite sudo systemctl restart apache2 ``` Instala Apache como servidor web y PHP 8.3 con FPM (FastCGI Process Manager) para mejor rendimiento. Todas las extensiones listadas son requeridas por Moodle 5.2. Ahora configura PHP para Moodle: ```bash # Crear archivo de configuración personalizada sudo tee /etc/php/8.3/fpm/conf.d/99-moodle.ini << 'EOF' post_max_size = 128M upload_max_filesize = 128M max_input_vars = 5000 max_execution_time = 300 memory_limit = 256M EOF # Reiniciar PHP-FPM sudo systemctl restart php8.3-fpm ``` Moodle requiere max_input_vars de al menos 5000 (el default de PHP es 1000). Los límites de upload a 128M permiten subir archivos grandes como videos de cursos. ### Paso 3 — Configurar la base de datos ```bash # Instalar MariaDB sudo apt install mariadb-server mariadb-client -y sudo systemctl enable mariadb # Asegurar la instalación sudo mysql_secure_installation # Responde: Y a todo (set root password, remove anonymous users, etc.) # Crear base de datos y usuario para Moodle sudo mysql -u root -p << 'EOF' CREATE DATABASE moodle DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; CREATE USER 'moodleuser'@'localhost' IDENTIFIED BY 'TU_PASSWORD_SEGURA_AQUI'; GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, CREATE TEMPORARY TABLES, DROP, INDEX, ALTER ON moodle.* TO 'moodleuser'@'localhost'; FLUSH PRIVILEGES; EXIT; EOF ``` Usa utf8mb4 como charset — es obligatorio en Moodle 5.x. Cambia TU_PASSWORD_SEGURA_AQUI por una contraseña fuerte (genera una con openssl rand -base64 32). Ya tienes el servidor con Apache, PHP 8.3 y MariaDB configurados. Eso es la base sobre la que corre todo. Los siguientes 3 pasos son Moodle en sí: descargar el código, configurar SSL, y activar el cron. La parte más técnica ya pasó. > **INFO:** Progreso: Vas por la mitad de la instalaciónYa tienes el servidor con Apache, PHP 8.3 y MariaDB configurados. Eso es la base sobre la que corre todo. Los siguientes 3 pasos son Moodle en sí: descargar el código, configurar SSL, y activar el cron. La parte más técnica ya pasó. ### Paso 4 — Descargar e instalar Moodle 5.2 ```bash # Instalar git sudo apt install git -y # Descargar Moodle 5.2 cd /var/www sudo git clone -b MOODLE_502_STABLE https://github.com/moodle/moodle.git html/moodle # Crear directorio de datos (FUERA del directorio web) sudo mkdir /var/moodledata sudo chown www-data:www-data /var/moodledata sudo chmod 770 /var/moodledata # Ajustar permisos de Moodle sudo chown -R www-data:www-data /var/www/html/moodle ``` El directorio moodledata DEBE estar fuera del directorio web público por seguridad. Aquí Moodle guarda archivos subidos, cache y datos de sesión. Ahora configura el VirtualHost de Apache: ```bash sudo tee /etc/apache2/sites-available/moodle.conf << 'EOF' ServerName tu-dominio.com DocumentRoot /var/www/html/moodle Options FollowSymLinks AllowOverride All Require all granted ErrorLog ${APACHE_LOG_DIR}/moodle-error.log CustomLog ${APACHE_LOG_DIR}/moodle-access.log combined EOF # Activar el sitio y desactivar el default sudo a2ensite moodle.conf sudo a2dissite 000-default.conf sudo systemctl reload apache2 ``` Cambia tu-dominio.com por tu dominio real. Asegúrate de que el registro DNS A ya apunte a la IP de tu servidor Hetzner. Ahora abre http://tu-dominio.com en tu navegador. Verás el instalador de Moodle. Sigue los pasos: 1. Selecciona idioma 2. Confirma las rutas (web, moodledata, etc.) 3. Tipo de base de datos: MariaDB (native/mariadb) 4. Introduce los datos de conexión (host: localhost, db: moodle, user: moodleuser, password: la que elegiste) 5. Acepta los términos 6. El instalador verificará los requisitos — si seguiste los pasos, todo debería estar en verde 7. Configura la cuenta de administrador 8. Configura el nombre del sitio ### Paso 5 — Configurar SSL y seguridad Un sitio Moodle sin HTTPS es inaceptable en 2026. Let's Encrypt lo resuelve gratis: ```bash # Instalar Certbot sudo apt install certbot python3-certbot-apache -y # Obtener certificado SSL (reemplaza con tu dominio) sudo certbot --apache -d tu-dominio.com # Certbot configura la renovación automática. Verifica que funcione: sudo certbot renew --dry-run ``` Certbot modifica automáticamente tu VirtualHost para redirigir HTTP a HTTPS. La renovación automática se ejecuta cada 60 días. Medidas de seguridad adicionales: Hardening básico del servidor ```bash # Configurar firewall UFW sudo ufw allow OpenSSH sudo ufw allow 'Apache Full' sudo ufw enable # Desactivar login con password por SSH (solo claves) sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config sudo systemctl restart sshd # Instalar fail2ban para proteger contra fuerza bruta sudo apt install fail2ban -y sudo systemctl enable fail2ban ``` Estas son las medidas mínimas. Para producción real, considera también: actualizaciones automáticas de seguridad del OS (unattended-upgrades), headers HTTP de seguridad en Apache, y monitorización de logs. ### Paso 6 — Cron jobs y configuración final Moodle necesita un cron job que se ejecute cada minuto. Sin esto, las notificaciones por email no se envían, los backups automáticos no corren, y varias funcionalidades del sistema fallan silenciosamente. Configurar cron para Moodle ```bash # Agregar cron job para el usuario www-data sudo crontab -u www-data -e # Añade esta línea al final del archivo: * * * * * /usr/bin/php /var/www/html/moodle/admin/cli/cron.php > /var/log/moodle-cron.log 2>&1 ``` Verificaciones finales: 1. Abre https://tu-dominio.com — deberías ver tu Moodle funcionando con HTTPS 2. Ve a Site administration > Server > Environment — todos los checks deberían estar en verde 3. Ve a Site administration > Server > Task > Scheduled tasks — verifica que el cron está ejecutándose 4. Crea un curso de prueba, sube un archivo, inscribe un usuario de test Tu Moodle 5.2 está funcionando. Tómate un café. Lo que viene ahora es lo que determina si este proyecto sobrevive más allá de los primeros 3 meses. ### Quiz: Verifica tu instalación Acabas de completar 6 pasos. Estas 3 preguntas verifican que entendiste las decisiones más importantes — las mismas que causan problemas si se hacen mal. ## El verdadero costo — Mantenimiento post-instalación Instalar Moodle tomó ~60 minutos. Mantenerlo funcionando de forma segura y estable es un trabajo continuo que no termina nunca. Según un [análisis de TheEduAssist (2026)](https://theeduassist.com/blog/free-moodle-installation-the-realities-of-self-hosting-your-lms/), el patrón de fracaso más común en self-hosting de Moodle sigue esta secuencia: 1. Mes 1–3: Todo funciona. Entusiasmo por el ahorro de costos 2. Mes 4–6: Llega la primera actualización de seguridad. Tarda más de lo esperado. Un plugin deja de funcionar 3. Mes 7–12: El tráfico crece. El rendimiento baja. Los backups fallan silenciosamente porque nadie revisó los logs 4. Mes 12+: Una actualización rompe algo. Restaurar desde backup requiere conocimientos que el equipo no tiene. Momento de crisis La frase que más se repite entre educadores que intentaron self-hosting: "Solo quería enseñar. No esperaba convertirme en sysadmin." ### Lo que implica mantener Moodle en producción Estas son las tareas que necesitas ejecutar de forma regular. No son opcionales: Semanalmente: - Verificar que los backups automáticos se completaron sin errores - Revisar logs de Moodle y del servidor por errores - Verificar que el cron está ejecutándose correctamente - Comprobar el espacio en disco Mensualmente: - Aplicar actualizaciones de seguridad del OS (apt update && apt upgrade) - Revisar si hay patches de seguridad de Moodle - Verificar compatibilidad de plugins con la versión actual - Optimizar la base de datos - Revisar métricas de rendimiento (tiempo de respuesta, uso de RAM) Cada 3–6 meses: - Actualizar versiones menores de Moodle (5.2.1, 5.2.2...) - Renovar/verificar certificados SSL (automático con Certbot, pero hay que validar) - Probar restauración desde backup (un backup que no puedes restaurar no es un backup) - Evaluar si necesitas escalar el servidor Anualmente: - Evaluar upgrade a la siguiente major version de Moodle - Actualizar PHP cuando Moodle suba los requisitos mínimos - Actualizar MariaDB/MySQL - Auditoría de seguridad completa ### El costo real: tu tiempo vs un partner | Concepto | DIY | Con partner especializado | | --- | --- | --- | | Hosting Hetzner (CX33) | €6.49/mes | €6.49/mes | | Licencia Moodle | €0 | €0 | | Mantenimiento | Tu tiempo | €400–3,500/mes | | **Total año 1** | **~€78 + tu tiempo** | **€78 + €4,800–42,000** | La pregunta real no es "¿cuánto cuesta?" sino "¿cuánto vale tu tiempo?" Si dedicas 5 horas al mes a mantenimiento y tu hora vale €50, son €3,000/año en costo de oportunidad — dinero que no inviertes en mejorar tus cursos, crecer tu plataforma o dormir tranquilo. ## Self-hosting o managed hosting — cuándo elegir cada uno No hay una respuesta universal. Depende de tu equipo, tu presupuesto y tu tolerancia al riesgo. | Escenario | Recomendación | Por qué | | --- | --- | --- | | Tienes equipo DevOps dedicado | **Self-hosting** | Aprovechas el bajo costo y tienes capacidad de mantenerlo | | < 100 usuarios, presupuesto mínimo | **Self-hosting** | CX33 a €6.49/mes es imbatible. El mantenimiento es manejable a esta escala | | 100–500 usuarios, sin equipo técnico | **Managed** o **hybrid** | La complejidad del mantenimiento no justifica el ahorro vs un servicio managed | | > 500 usuarios, necesitas SLA | **Managed** | Un downtime a esta escala tiene costo real. Necesitas garantías | | Requisitos de compliance estrictos | **Self-hosting + partner** | Tú controlas el servidor (datos en tu jurisdicción), un partner lo mantiene | El modelo hybrid es cada vez más común: tú contratas el servidor en Hetzner (controlas dónde están los datos, pagas directo al proveedor), y un partner de LMS engineering se encarga de la gestión técnica. ## Preguntas frecuentes ### ¿Cuánto cuesta instalar Moodle? Moodle es software libre (GPL), por lo que la licencia es gratuita. El hosting en Hetzner Cloud empieza desde €6.49/mes para hasta 100 usuarios. El costo real está en el mantenimiento continuo: actualizaciones, backups, seguridad y optimización, que requiere experiencia técnica o un partner especializado. Si haces la instalación tú mismo, el costo del primer año es de unos €78 en hosting más tu tiempo. Si contratas a un profesional para el setup, espera entre [€2,000 y €25,000 dependiendo de la complejidad](https://raccoongang.com/blog/moodle-pricing/) (plugins custom, integraciones, migración de datos). El mantenimiento profesional mensual oscila entre €400 y €3,500. ### ¿Qué servidor necesito para Moodle 5.2? Para Moodle 5.2 necesitas como mínimo PHP 8.3, MariaDB 10.11 o MySQL 8.4, y un servidor con al menos 4 GB de RAM y 2 vCPUs. En Hetzner, un CX33 (4 vCPU, 8 GB RAM, €6.49/mes) cubre hasta 100 usuarios concurrentes cómodamente. Para más de 100 usuarios simultáneos, sube al CPX32 (€13.99/mes) o CPX42 (€25.49/mes). Si necesitas rendimiento garantizado sin variabilidad, los planes CCX con vCPUs dedicadas empiezan en €15.99/mes. El storage mínimo es 80 GB, pero planifica más si tus cursos incluyen videos y archivos pesados. ### ¿Moodle es difícil de instalar? Instalar Moodle es relativamente sencillo — un desarrollador puede completar la instalación base en 30–60 minutos. La dificultad real no está en la instalación sino en el mantenimiento: actualizaciones de seguridad, backups, optimización de rendimiento y gestión de plugins son tareas continuas que requieren experiencia. Si te sientes cómodo con la terminal de Linux, puedes seguir esta guía sin problemas. Los pasos son lineales y los comandos están probados para Ubuntu 24.04 con Moodle 5.2. Donde la mayoría de personas se atasca es 3–6 meses después, cuando llegan las primeras actualizaciones de seguridad y los plugins empiezan a dar conflictos. ### ¿Hetzner es bueno para Moodle? Hetzner es excelente para Moodle por su relación precio-rendimiento: servidores desde €6.49/mes con 20 TB de tráfico incluido, data centers en Europa con baja latencia para LATAM y España, y opciones de escalar desde shared hasta dedicated vCPUs sin migrar de proveedor. Sus ventajas sobre AWS o DigitalOcean para Moodle: hasta 7x más barato por specs equivalentes, 4x más tráfico incluido, y precios simples sin la complejidad de facturación de los hyperscalers. La desventaja: no hay data centers en América (los más cercanos están en Alemania/Finlandia), así que si tu audiencia está exclusivamente en LATAM, la latencia será 120–180ms en lugar de 20–40ms. Para la mayoría de casos de uso educativos, eso es perfectamente aceptable. ### ¿Qué hay de nuevo en Moodle 5.2? Moodle 5.2 (abril 2026) trae dashboard rediseñado, integración de IA con AWS Bedrock y Google Gemini, navegación lineal mejorada, React en core, instalación via Composer, quiz bank renovado y Moodle Design System phase 1. Requiere PHP 8.3+ y MariaDB 10.11+. El cambio técnico más relevante para sysadmins es el salto a PHP 8.3 como mínimo y MariaDB 10.11. Si vienes de una instalación con PHP 8.2 o MariaDB 10.6, necesitas actualizar ambos antes de migrar a 5.2. El upgrade path oficial requiere estar en [Moodle 4.4 o posterior](https://moodledev.io/general/releases/5.2). ### ¿Puedo migrar de MoodleCloud a self-hosted? Sí. MoodleCloud permite exportar tus cursos como archivos de backup (.mbz) desde Site administration > Courses > Backup. Estos archivos se importan directamente en tu instalación self-hosted. Los usuarios pueden exportarse como CSV. Lo que no migra automáticamente: configuraciones de plugins custom (MoodleCloud tiene un set limitado), temas personalizados, integraciones con terceros (SSO, APIs), y datos de analytics. Planifica una migración gradual — corre ambas instancias en paralelo durante 2–4 semanas antes de hacer el corte. ### ¿Cada cuánto necesita mantenimiento Moodle? Moodle requiere atención semanal mínima: verificar backups, revisar logs, comprobar el cron. Las actualizaciones de seguridad de Moodle se publican mensualmente. Las versiones menores (5.2.1, 5.2.2) salen cada 2 meses. Actualizaciones del OS y PHP son mensuales. Según [Mindfield Consulting (2026)](https://mindfieldconsulting.com/moodle-maintenance-strategy/), la mayoría de problemas graves en instalaciones self-hosted vienen de backups que nunca se probaron, cron jobs que dejaron de funcionar, y actualizaciones de seguridad que se postergaron. El mantenimiento reactivo ("arreglo cuando se rompe") es la causa principal de incidentes en producción. --- --- # Moodle Limitations: The Complete Guide (2026) | Cubite https://cubite.io/blogs/moodle-limitations **By:** Amir Tadrisi **Updated:** 2026-09-08 Every Moodle limitation explained — UX, gradebook, mobile, performance, plugins, hosting, and more. Sourced from real users, with fix-or-switch verdicts. # Every Moodle Limitation You Need to Know (2026): UX, Performance, Gradebook & More [Capterra](https://www.capterra.com/p/80691/Moodle/reviews/) rates Moodle's Ease of Use at 4.1 out of 5 — its lowest sub-score across 3,375 reviews. Canvas scores [80% positive sentiment](https://edwiser.org/blog/moodle-vs-canvas/) in user reviews. Moodle scores 56%. And Moodle's market share is [declining in every region](https://listedtech.com/blog/lms-market-share/) — down 3% in Europe, 5% in Latin America, 7% in Oceania. You're not imagining it. The Moodle limitations are real, well-documented, and in many cases acknowledged by Moodle's own developers. MoodleDocs literally has a page titled "Major usability issues in Moodle" — listing 10 categories of problems. But here's what most "Moodle disadvantages" articles won't tell you: many of these problems are fixable. Not all — some are architectural constraints baked into a 20-year-old PHP codebase. But most of the daily pain points that frustrate administrators, instructors, and learners **can be solved** with the right hosting, configuration, and customization. This guide covers every real limitation — the Moodle cons that review platforms, forums, and official documentation all confirm. Sourced from [Moodle.org forums](https://moodle.org/), [G2](https://www.g2.com/products/moodle/reviews), [Capterra](https://www.capterra.com/p/80691/Moodle/reviews/), [devRant](https://devrant.com/rants/2109036/moodle-is-the-worst-shit-ever), and official documentation. For each problem, we tell you: 1. What's broken — with specific examples 2. Why it's broken — the root cause 3. Fix or switch? — whether it's solvable, partially fixable, or a reason to migrate We manage Moodle platforms daily at Cubite. We see these problems — and fix them. This is the honest assessment we wish someone had given us when we started. --- ## UX & Interface: "Too Many Clicks for Everything" This is the #1 complaint across every review platform, every forum, and every comparison article. It's not subtle — a [professor writing on Medium](https://johnlaudun.medium.com/why-i-hate-moodle-ddaa55a9c61) put it bluntly: "Moodle is ugly, takes too many clicks to do anything meaningful, and it undoes everything that was once semantic about the web." The numbers confirm it. User reviews show [Canvas at 80% positive sentiment vs Moodle at 56%](https://edwiser.org/blog/moodle-vs-canvas/). The [Moodle interface](https://www.scalahosting.com/blog/the-limitations-of-the-moodle-framework/) is described as having "an excessive number of menus, settings, choices, and features" — the result of 20+ years of feature accumulation without simplification. ### Specific UX Problems - Admin interface complexity — unclear defaults, confusing role/permission system that's difficult to understand - Filter persistence bug — searching for a user adds your previous search terms too, returning no results. "I have searched for a user and not get any results, only to realise that my two previous searches were being added too!" - Survey activity — "a potentially powerful activity that can't be edited or adapted," forcing reliance on external plugins - No semantic HTML — the editor lacks H1 headings, code blocks, or meaningful formatting. One professor wrote: "Forget meaningful things like H1 headings or passages of code, because you aren't getting them here" - Course editing — multiple clicks to add a resource, unclear visual hierarchy, Moodle's own docs acknowledge "unintuitive adding-items workflow" IT departments try to fix this with "instructions and seminars," but as [eLearning Industry notes](https://elearningindustry.com/challenges-of-moodle-ux-and-how-to-address-them), "that only deepens the confusion and frustration." Fix or switch? Fixable — but requires investment. Custom themes like Edwiser RemUI and Moove dramatically improve the interface. A [Moodle managed hosting provider](/blogs/moodle-hosting) can customize navigation, simplify the admin panel, and build a modern UX layer. The underlying functionality is powerful — it's the presentation that needs work. --- ## The Gradebook: Moodle's Most Hated Feature If there's one feature that generates more [forum threads](https://moodle.org/mod/forum/discuss.php?d=242554), more help tickets, and more quiet rage than anything else in Moodle, it's the gradebook. Here are the specific moodle gradebook problems that educators face daily: ### The Bug List 1. Category overrides are ["the BANE of millions of users' existence"](https://moodle.org/mod/forum/discuss.php?d=242554) — "Overrides in general are FAR too easy to create and FAR too hard to undo." There's no batch un-override capability; you must undo each student individually. 1. No save warning — "Leaving the grader report without saving DOES NOT GENERATE A WARNING." Navigate away accidentally and your grades are gone. 1. The "scroll of death" — the horizontal scroll bar is at the bottom of the page, so scrolling down to see more students loses the assignment title headers. With more than 20 students or 6+ assignments, it becomes unusable. 1. Silent CSV destruction — the CSV importer fails silently and can overwrite locked grades without notification. 1. Broken SUM aggregation — "doesn't work when you ignore empty grades" and "doesn't work when you exclude items." 1. Extra credit confusion — only works in certain aggregation modes, with no clear documentation of which. 1. Drop highest/lowest incorrect — produces wrong computations when assignment point values aren't equal. 1. Letter grade rounding — limited to 2 decimal places, creating mismatches between displayed and assigned grades. 1. Max grade dropdown — limited to 100 values instead of a text input. Need a max of 150? Good luck. Fix or switch? Partially fixable. Custom CSS can address the scroll of death. Third-party gradebook plugins (like Edwiser's) improve the experience. Configuration guidance prevents common override traps. But some issues — like the missing save warning and the silent CSV behavior — are architectural bugs that require core patches or workarounds. --- ## Mobile Experience: "Just Use Your Browser Instead" When multiple institutions [officially recommend](https://support.lanecc.edu/moodle-student-getting-started/moodle-mobile) using a mobile web browser instead of the native Moodle app, you know there's a problem. ### What's Broken on Mobile - Assignment details missing — the app [fails to display](https://moodle.org/mod/forum/discuss.php?d=448299) assignment instructions, rubrics, and grading feedback - Content rendering failures — tables, images, and embedded files often don't load properly - Laggy and unstable — users describe it as ["very laggy"](https://justuseapp.com/en/app/633359593/moodle/reviews) with frequent forced re-logins "even during active use" - No side navigation — unlike the desktop version, there's no left-side menu. You must navigate through the course catalog to find courses - Push notification limits — the free mobile app caps push notifications at [50 active devices per month](https://docs.moodle.org/501/en/Moodle_app). Beyond that, you need a paid plan - Video playback failures — Kaltura videos and interactive content may not play or function in-app - Accidental course opens — the app is "overly sensitive when scrolling through classes, often opening classes unintentionally" Fix or switch? Partially fixable. A branded Moodle app (available for purchase) provides more control. Progressive web app approaches can improve the mobile experience. But the fundamental moodle mobile app problems — missing content rendering, laggy performance — are architectural limitations of the app framework itself. --- ## Performance & Scalability: The Monolithic Problem Moodle is slow. And for organizations that have experienced the frustration of a site grinding to a halt during exam week, the reason matters: it's architectural. Moodle is a [monolithic PHP application](https://aosabook.org/en/v2/moodle.html) built on a transaction script approach — individual PHP scripts generate specific pages. Unlike modern microservices architectures, you can't independently scale the quiz engine, the messaging system, or the gradebook. **Everything scales together, or it doesn't.** ### Why It's Slow - No database connection pooling — since PHP doesn't support connection pooling, every new request hits the database. At scale, this creates a bottleneck that no amount of caching fully eliminates - Log table bloat — on long-established sites, log tables can consume [90%+ of the database](https://docs.moodle.org/501/en/Performance_recommendations) - Default disk caching — Moodle defaults to disk-based caching, which is slow. Redis or Memcached is required for acceptable performance but isn't configured by default - Backup paralysis — running multiple simultaneous course backups can make a site ["nearly unusable"](https://docs.moodle.org/501/en/Performance_recommendations) — there's no internal mechanism to queue backup requests - Scaling reality — a university with 22,000 students [needed ~15 Linux machines](https://moodle.org/mod/forum/discuss.php?d=422441) in a load-balanced cluster with enterprise MySQL master-slave replication and NFS file storage Open edX's documentation [states](https://openedx.org/blog/moodle-versus-the-open-edx-platform-9-key-differences-in-elearning-platforms/) that Moodle can effectively manage "up to 10,000 users" — though this comes from a competitor source and actual limits depend heavily on hosting configuration. That said, beyond ~10,000 concurrent users, you're fighting the monolithic architecture. Fix or switch? Performance is the most fixable limitation. Redis caching, PHP-FPM, database tuning, CDN configuration, and proper cron management eliminate most performance problems. This is where managed hosting makes the biggest difference — a properly configured Moodle instance is dramatically faster than a default one. For organizations exceeding ~10,000 concurrent users, consider [Open edX](/blogs/open-edx-hosting) for its microservices architecture. --- ## Plugin Ecosystem: Power and Fragility Moodle's [2,390+ plugins](https://moodle.org/plugins/) are simultaneously its greatest strength and its biggest operational risk. The flexibility is unmatched — but the fragility is real. ### The Double-Edged Sword - Compatibility breaks every 6 months — Moodle releases major versions twice a year. Each release can break third-party plugins, and many plugin developers don't update promptly - Abandoned plugins — Moodle has a [plugin adoption programme](https://moodledev.io/general/community/plugincontribution/adoption) specifically because abandoned plugins are a recurring problem. If a maintainer doesn't respond to messages within 30 days, the plugin can be transferred - Security vulnerabilities — plugins have been found [exposing config.php in plain text](https://moodle.org/security/) — a critical vulnerability. The review process is reactive (remove after discovery), not proactive (audit before publishing) - Extensive CVE history — Moodle's [CVE database](https://www.cvedetails.com/product/3590/Moodle-Moodle.html) includes command injection, remote code execution, and denial-of-service vulnerabilities across many versions - 5.1 broke plugin paths — the public directory restructuring in Moodle 5.1 caused plugins to attempt installation to incorrect directories Fix or switch? Fixable with managed hosting. A good Moodle specialist tests every plugin for compatibility before upgrading, audits plugins for security, monitors for abandoned plugins, and maintains a tested plugin stack. This is exactly the kind of operational discipline most self-hosted Moodle installations lack. --- ## Hosting & Upgrades: Where "Free" Gets Expensive "Moodle is free" might be the most expensive misconception in EdTech. The software costs nothing. Running it costs plenty. ### The Upgrade Horror Stories - [Open LMS recommends skipping Moodle 5.0 entirely](https://support.openlms.net/hc/en-us/articles/21405723422876) — the largest Moodle hosting provider tells clients to go directly to 5.1 for stability - Moodle 5.1 [broke shared hosting](https://moodle.org/mod/forum/discuss.php?d=470266) — the new public directory requirement is incompatible with most shared hosting setups - Upgrade from 5.0 to 5.1 [shows PHP source code](https://moodle.org/mod/forum/discuss.php?d=471731) instead of the upgrade page on some configurations - Courses merge during upgrades — content from [different topics merging into single topics](https://moodle.org/mod/forum/discuss.php?d=450973) after version jumps - Sites stuck at "upgrading" — server timeouts during upgrade leave sites permanently displaying "Site is being upgraded, please retry later" - Cron jobs break silently — [after upgrading 4.1 to 4.2](https://moodle.org/mod/forum/discuss.php?d=457989), cron.php "has not been run for several days" with no visible error ### The Hidden Costs - Self-hosting TCO: $6,000-29,000/year when you include infrastructure + sysadmin time ([full breakdown in our Moodle hosting guide](/blogs/moodle-hosting#how-much-does-moodle-hosting-cost)) - Customization cost: One organization reported ["$40K and nearly four months"](https://elearningindustry.com/5-reasons-look-moodle-alternatives) for two Moodle developers to build a customized environment meeting basic needs - Knowledge concentration risk: When your one Moodle-savvy sysadmin leaves, you inherit an undocumented system and the next upgrade becomes a gamble Fix or switch? Definitively fixable — and this is the #1 reason to work with a Moodle specialist. Managed hosting eliminates every hosting and moodle upgrade problem: automatic upgrades with staging environment testing, plugin compatibility validation, automated backups, cron monitoring, and security patching. The "hidden costs" of Moodle are really the costs of managing it without expertise. --- ## Reporting & Analytics: "Difficult to Run, Read, and Understand" Moodle's built-in reporting is, to put it gently, [inadequate](https://edwiser.org/blog/moodle-reporting-expectations-vs-reality/). The reports are described by users as "difficult to run, read, and understand" — with basic functionality that has hard limits. ### What's Missing - No site-level analytics dashboard — only course-level reporting - Predictive analytics require extensive data — Moodle's native analytics models only work with core activities and need significant in-platform data before producing useful predictions - No time-on-page tracking — unless you convert content into SCORM format (which can cost [500-700 EUR per course](https://edwiser.org/blog/reasons-to-choose-a-dedicated-reporting-tool-for-your-moodle/)) - Custom reports require SQL — there's no click-based report builder in standard Moodle - Gradebook "scroll of death" — makes any reporting involving grades unusable at scale What competitors offer that Moodle doesn't: real-time dashboards, automatic engagement scoring, predictive dropout alerts, one-click custom report builders, and revenue analytics. Fix or switch? Fixable with third-party tools. Edwiser Reports, Lambda Analytics, and IntelliBoard all add the reporting capabilities Moodle lacks natively. A managed hosting provider can pre-configure these for you. --- ## Multi-Tenancy, E-commerce & Communication Gaps Three enterprise-grade features that Moodle either doesn't have natively or handles poorly: ### Multi-Tenancy Standard Moodle LMS has no native multi-tenancy (the ability to run separate organizational units on one installation). You need either: - Moodle Workplace — premium paid product, only available through Moodle Premium Partners - IOMAD — free plugin, but requires significant technical expertise Even with multi-tenancy enabled, there's a [fundamental architectural limitation](https://docs.moodle.org/501/en/Multi-tenancy_Tenants): if a user is enrolled in a shared course, they see users from ALL tenants in forums, participant lists, and gradebooks. True tenant isolation doesn't exist. ### E-commerce Moodle was not built to sell courses. Natively, it only supports [PayPal checkout](https://moodle.org/mod/forum/discuss.php?d=316091) — and the PayPal plugin "only allows you to sell by the course, not by the month." No subscriptions, no shopping cart, no storefront, no landing pages, no affiliate system. The [Stripe payment plugin](https://moodle.org/plugins/paygw_stripe) exists but suffers from webhook connectivity errors, no VAT/billing address collection (critical for EU compliance), and broken coupon functionality. ### Communication - No native video conferencing — requires external tools (BigBlueButton, Zoom) linked from within courses - No modern chat — the built-in Chat activity is basic synchronous text, not comparable to Slack or Teams - Messaging system bugs — database connection errors and display failures [reported after Moodle 4.0 upgrades](https://moodle.org/mod/forum/discuss.php?d=433340) - Push notifications unreliable — delayed or never arrive on mobile Fix or switch? Multi-tenancy: fixable with Workplace or IOMAD (with caveats). E-commerce: consider a dedicated platform (WooCommerce + Edwiser Bridge) or custom integration. Communication: BigBlueButton plugin works well for video; for modern messaging, integrate with external tools. --- ## Security & Privacy: What You're Responsible For Moodle's [CVE database](https://www.cvedetails.com/product/3590/Moodle-Moodle.html) is extensive — command injection, remote code execution, denial-of-service, and cross-site scripting vulnerabilities have been found and patched across many versions. This isn't unusual for a large open-source project — but it means moodle security risks are real and require active management. ### The Security Reality - Plugin vulnerabilities — third-party plugins have been found [exposing config.php credentials in plain text](https://moodle.org/security/). The plugin review process is reactive, not proactive - Patching cadence — Moodle releases security patches every 2 months. Self-hosted installations must apply them promptly — but many don't - GDPR compliance requires active work — Moodle provides GDPR tools ([Privacy API](https://moodledev.io/docs/4.5/apis/subsystems/privacy), consent tracking, data erasure), but installing them doesn't make you compliant. Each third-party plugin must separately implement the Privacy API — and many don't - Moodledata directory permissions — must be writable by the web server but outside the web root. Misconfiguration is a common security hole Fix or switch? Fixable with managed hosting. A specialist handles security patching within hours of release, audits plugins for vulnerabilities, configures GDPR correctly, and monitors for threats. This is table-stakes for any production Moodle installation. --- ## What Competitors Do Better (Honest Comparison) It's not fair to list Moodle limitations without acknowledging what alternatives do better — and what Moodle still does better than them. | Category | Moodle | Canvas | Open edX | LearnDash | | --- | --- | --- | --- | --- | | UX/Interface | Cluttered, 56% positive | Clean, 80% positive | Functional, moderate | Modern, drag-and-drop | | Mobile | Poor native app | Strong native app | Adequate | Good (WordPress-based) | | Scalability | ~10K users practical limit | SaaS (Instructure manages) | Built for millions | Small-medium only | | Plugins | 2,390+ (unmatched) | Limited marketplace | XBlocks (smaller) | WordPress plugins | | Self-hosting | Free (GPL) | Not available | Free (AGPL) | $199-369/yr license | | SCORM | 1.2 + 2004 (native) | Limited | Requires XBlock | Good support | | E-commerce | PayPal only (native) | Not applicable | Not native | Built-in (WooCommerce) | | Accessibility | WCAG 2.2 AA certified | WCAG 2.1 AA + Checker tool | Varies | Varies | | Reporting | Basic, needs plugins | Better built-in | Basic | Basic | | Multi-tenancy | Requires Workplace/IOMAD | SaaS handles this | Not native | Not native | | AI features | Built-in (5.0+) | Emerging | Limited | Limited | | Cost | Free + hosting ($3K-29K/yr) | $$$ (SaaS pricing) | Free + hosting ($12K-200K/yr) | $199-369/yr + hosting | | Best for | Education, global, customizable | US higher ed, UX-focused | Large-scale, MOOCs | Course selling | ### What Moodle Still Does Better Moodle's 2,390+ plugins are unmatched. Its GPL license means true ownership — no vendor lock-in. SCORM 1.2 + 2004 support is the best in open-source. The global community (146K+ sites) means finding Moodle experts is easier than for any other open-source LMS. And the built-in AI subsystem (since 5.0) is genuinely impressive — supporting OpenAI, Ollama, DeepSeek, and more. --- ## Frequently Asked Questions ### What are the disadvantages of Moodle? Moodle's main disadvantages are an outdated interface (56% positive sentiment vs Canvas's 80%), steep learning curve for admins and users, poor mobile experience, fragile plugin ecosystem that breaks during upgrades, limited native reporting, no built-in video conferencing, and a monolithic PHP architecture that struggles to scale beyond ~10,000 users. However, many of these are fixable with the right hosting and configuration. The UX improves dramatically with custom themes. Performance transforms with Redis caching and database tuning. Plugin fragility disappears with managed hosting that includes pre-upgrade compatibility testing. The unfixable limitations are architectural: the monolithic design, the gradebook's core bugs, and the lack of native multi-tenancy and e-commerce. See the [full breakdown by category](#ux--interface-too-many-clicks-for-everything) above. ### Is Moodle difficult to use? Yes — Moodle has a steep learning curve for both administrators and end users. [Capterra reviewers](https://www.capterra.com/p/80691/Moodle/reviews/) rate its Ease of Use at 4.1/5 (the lowest sub-score). Moodle's [own documentation lists](https://docs.moodle.org/dev/Major_usability_issues_in_Moodle) "Major usability issues" across 10 categories. The admin interface has excessive menus, unclear defaults, and a confusing role/permission system. The difficulty stems from 20+ years of feature accumulation without interface simplification. Every new feature added more menus, settings, and options — without removing or consolidating old ones. Custom themes (like Edwiser RemUI or Moove) significantly improve the end-user experience, but the admin interface remains complex. For most organizations, having a Moodle specialist handle configuration and training reduces the learning curve substantially. ### What are the limitations of the Moodle app? The Moodle mobile app [fails to display](https://moodle.org/mod/forum/discuss.php?d=448299) assignment rubrics and feedback, doesn't load tables and embedded files properly, is "very laggy," and forces frequent re-logins. Many institutions [recommend using a mobile browser](https://support.lanecc.edu/moodle-student-getting-started/moodle-mobile) instead. The free app limits push notifications to [50 active devices per month](https://docs.moodle.org/501/en/Moodle_app). Videos often don't play in-app. The mobile experience is one of Moodle's weakest areas. The app uses an Ionic/Cordova framework that doesn't render all Moodle content types correctly. A branded Moodle app (paid) gives you more control over the experience, but the fundamental rendering limitations persist. For organizations where mobile is critical, test the app thoroughly with your specific content types before committing. ### Is Moodle outdated? Moodle's core architecture dates to 2002 and uses a [monolithic PHP design](https://aosabook.org/en/v2/moodle.html) with no database connection pooling. Its market share is [declining in every region](https://listedtech.com/blog/lms-market-share/) — down 3% in Europe, 5% in Latin America, 7% in Oceania. However, Moodle 5.x adds AI features and continues active development. It's architecturally dated, not abandoned. The distinction matters. Moodle's PHP/MySQL architecture is a 2002-era design that can't match the scalability of modern microservices platforms like Open edX. But the application itself is actively maintained — with biannual major releases, 2,390+ plugins, WCAG 2.2 AA certification, and a growing AI subsystem. "Outdated" applies to the architecture and UX; the functionality and community are very much alive. ### Why is Moodle so complicated? Moodle's complexity stems from 20+ years of feature accumulation without architectural simplification. The admin interface has ["excessive menus, settings, choices, and features."](https://www.scalahosting.com/blog/the-limitations-of-the-moodle-framework/) Course editing requires multiple clicks. The role/permission system is difficult to understand. Cron jobs, caching, and database tuning require server expertise beyond typical LMS administration. Add to this the plugin ecosystem (2,390+ plugins with varying quality), the biannual upgrade cycle that can break plugins, the gradebook's notoriously unintuitive interface, and the fact that effective operation requires both LMS administration AND server administration skills. As [one forum user put it](https://moodle.org/mod/forum/discuss.php?d=373759): "It's gotten really really difficult to use and understand as an administrator." ### What is better than Moodle? It depends on your needs. Canvas offers better UX and accessibility ([39% US higher ed market share](https://edutechnica.com/2025/05/26/lms-data-spring-2025-updates/) vs Moodle's 16%). [Open edX](/blogs/open-edx-hosting) scales to millions of learners. Totara focuses on corporate compliance. LearnDash has better e-commerce. No single LMS is "better" — but each solves specific Moodle pain points. The right answer depends on your priorities. If your main frustration is UX and mobile experience, Canvas is objectively better — but it's SaaS-only with no self-hosting option and significant cost. If you need massive scale, Open edX's microservices architecture handles what Moodle can't. If you want to sell courses, LearnDash with WooCommerce is purpose-built for that. But if you need 2,390+ plugins, full customizability, SCORM support, and a global community — nothing matches Moodle. See our [full comparison table](#what-competitors-do-better-honest-comparison) above. ### What are the security risks of Moodle? Moodle has an [extensive CVE history](https://www.cvedetails.com/product/3590/Moodle-Moodle.html) including command injection, remote code execution, and denial-of-service vulnerabilities. Third-party plugins pose additional risks — some have been found [exposing config.php credentials](https://moodle.org/security/) in plain text. Self-hosted installations require constant patching (security releases every 2 months). Managed hosting mitigates most of these risks. The security risk is proportional to how well your installation is managed. A Moodle instance with unpatched vulnerabilities, untested plugins, and misconfigured file permissions is a significant liability. A managed instance with prompt patching, plugin auditing, and proper security configuration is as secure as any enterprise application. The difference is expertise and operational discipline — not the platform itself. ### Is Moodle GDPR compliant? Moodle provides GDPR tools ([Privacy API](https://moodledev.io/docs/4.5/apis/subsystems/privacy), consent tracking, data erasure), but installing them doesn't make you compliant — correct configuration and processes are required. Each third-party plugin must separately implement the Privacy API. Organizations bear full responsibility for compliance. Managed hosting providers can handle GDPR configuration correctly. The key risk is third-party plugins. Moodle's core Privacy API is well-implemented, but each plugin developer must separately integrate with it. If you're using 20+ plugins, verifying that each one handles personal data correctly is a significant compliance task. Moodle HQ states they "never have and will not collect, use or monetise any student data" — but this applies to Moodle HQ, not your specific installation. --- ## Your Next Move Moodle is the world's most widely used LMS for good reason — [146,000+ sites](https://stats.moodle.org/), [2,390+ plugins](https://moodle.org/plugins/), and a global community that no competitor matches. But its limitations are real, documented, and in many cases fixable. Here's what to remember: - UX, performance, hosting, and plugins are all fixable with the right Moodle specialist — don't migrate over solvable problems - The gradebook and mobile app are partially fixable with workarounds and third-party tools - Architecture, multi-tenancy, and e-commerce are fundamental constraints — if these are your primary needs, consider switching - Most "Moodle problems" are actually hosting and configuration problems — a properly managed Moodle instance is dramatically different from a default self-hosted one - If you're considering switching, get an audit first — the migration cost may exceed the cost of fixing what's broken The question isn't whether Moodle has limitations. Every platform has Moodle issues of some kind. The question is whether YOUR specific pain points are fixable — and at what cost. --- # SureCart LMS integration: enroll buyers in your Cubite courses automatically https://cubite.io/blogs/surecart-lms-integration **By:** Amir Tadrisi **Updated:** 2026-08-26 Step by step: connect SureCart to a Cubite LMS with Ottokit or Uncanny Automator, no code. Buyers are enrolled and get a one-click sign-in email; refunds revoke access. SureCart handles the sales side of a course business well: checkout, coupons, and receipts. The courses themselves live in a hosted LMS such as Cubite. A SureCart LMS integration is the missing piece between the two: when someone pays, the LMS should create their account, grant course access to what they bought, and send them a way to sign in, with nobody copying names out of an order screen. This tutorial builds that connection for a Cubite site with Ottokit, a WordPress automation plugin, plus an appendix for Uncanny Automator. There is no code to write. At the end, a buyer is enrolled in the matching Cubite course in less than a minute and gets a one-click sign-in email; an optional second workflow removes access after a refund. ## What you need - A WordPress site with SureCart and at least one live course product. - The OttoKit plugin (Ottokit is the automation plugin formerly called SureTriggers; it appears as OttoKit in the WordPress menu), with SureCart connected as an app (OttoKit -> Apps). If not yet: create a token at https://app.surecart.com/api_tokens (New Token, Create, copy), then OttoKit -> Apps -> Create Connection -> Create New, search for SureCart, paste the token, Connect SureCart. - An Ottokit plan with the API app. Ottokit's pricing page includes "API Integration" only on Business and Business Plus; Free and Pro cannot make the outbound call to Cubite. With Uncanny Automator the webhook action is free, but the guest-checkout trigger needs Automator Pro (see the appendix). - Admin access to your Cubite site at https://cubite.io/admin. - A second mailbox that is NOT your Cubite admin email (in Gmail or Google Workspace, name+test1@example.com lands in your normal inbox). Cubite will not issue one-click sign-in links to admin accounts. - About 30 minutes. Conventions used in this guide. Two addresses to keep apart: https://cubite.io/admin is the Cubite admin, where you create keys, find course IDs, and see learners; https://academy.example.com stands in for your Cubite site, where learners go and where every link Cubite sends points (on a Cubite subdomain, use https://your-site.cubite.io instead; nothing else changes). The example course is "Workplace Safety Basics", slug workplace-safety-basics. Replace placeholders in capitals, such as COURSE-ID, with your own values. ## How a SureCart LMS integration works An API is a web address that accepts instructions from another program; the API key is a long password proving the instruction came from your store. With those two words in place, the whole integration is five steps: 1. A buyer pays for a course product on your WordPress site (SureCart). 2. Ottokit sees the purchase and starts a workflow you have built. 3. Ottokit calls Cubite's enrollment API with the buyer's email, name, and the course ID, using a private key that proves the request came from your store. 4. Cubite creates the learner (or finds the existing account), enrolls them with full access, and returns a one-click sign-in link (magicLinkUrl). 5. The buyer gets an email with that link: from Cubite (recommended), or from Ottokit if you want your own wording. Cubite receives the buyer's email, name, and course, plus the SureCart order number (echoed back, not stored). Payment stays in SureCart; Cubite charges nothing and does not record the order. ## Step 1: Create a Cubite API key The key lets Ottokit talk to your site. 1. Sign in at https://cubite.io/auth/signin, then open https://cubite.io/admin. 2. Click Sites, then your site, then the Integrations tab. 3. In the Developer group, click API keys, then Create key. Fill in the form: - Name: something you will recognize later, such as SureCart via Ottokit. - Scopes: check enrollments:write only ("Enroll learners (single or bulk) and revoke enrollments"); it also covers reading enrollments. - Expiration (optional): leave it empty, or set a date with a calendar reminder to rotate the key before then. - IP allowlist (optional): leave it empty; Ottokit calls from changing cloud addresses. - Click Create key. A green Key created / Save this secret now tile appears with a Copy button. Copy the key into your password manager, or paste it straight into Ottokit in Step 4 with this tab kept open. It is ck_ followed by 64 letters and digits. Cubite shows it once; if you lose it, revoke it and create a new one. What you should see: the new key listed under API keys with its name and the enrollments:write scope, and the full ck_ secret saved somewhere private. ## Step 2: Write down your course IDs Cubite identifies courses by an internal ID, not by name or web address. Fill in one row per course you sell: | SureCart product | Cubite course ID | Course slug | redirectTo value | | --- | --- | --- | --- | | Workplace Safety Basics | COURSE-ID | workplace-safety-basics | /course/workplace-safety-basics/courseware | | (your next course) | | | | Course ID. Open Courses in the Cubite admin, then the course. The address bar reads https://cubite.io/admin/courses/COURSE-ID; the last part is the ID, a long string of lowercase letters and digits. It looks like clx1abc2d0000abcd1234efgh. Copy it exactly. Slug and redirectTo. The slug is the last part of the course's public address, https://academy.example.com/course/workplace-safety-basics. It is not the ID; it only builds the redirectTo value, the learning page the buyer lands on after signing in. Join three pieces with no spaces: /course/ + workplace-safety-basics + /courseware = /course/workplace-safety-basics/courseware. Prerequisites. If a course requires other courses first, a paying buyer who has not completed them is refused (a 409 error): money taken, no enrollment. Either add the row skipPrerequisiteCheck = true in Step 4b, remove the prerequisites, or sell the sequence as a learning path (see "Selling a bundle"). What you should see: one row per product, each with a long lowercase ID (about 25 characters) and a redirectTo value starting with /course/. ## Step 3: Make one test purchase with a 100% coupon Ottokit needs an existing purchase of the product to show you its fields, and its test button really enrolls whoever made that purchase. Make it yourself first, so the sample is your test mailbox and not a real customer. 1. SureCart -> Promotions -> Coupons -> Add New. Coupon Name (internal): QA test. Promotion Code (typed at checkout): QA100. Amount: Percentage off, 100. If the coupon screen offers a redemption or usage limit, set a small number. Save. 2. In a private browser window, buy the course product with your test mailbox and the code QA100. If checkout still asks for a card at $0, enter it; nothing is charged. What you should see: SureCart's confirmation page, and its receipt in the test mailbox. Nothing happens in Cubite yet, because the workflow does not exist. ## Step 4: Build the SureCart to Cubite workflow in Ottokit Build one workflow per course product. Build and test the first, then copy it for the others, changing the Product in the trigger and the courseId and redirectTo values in the API step. ### 4a. Trigger: a SureCart purchase of this product 1. OttoKit -> Workflows -> Create Workflow -> Create from Scratch. Name it SureCart to Cubite: Workplace Safety Basics and click Create. 2. Click plus (+), search for SureCart, and choose the trigger Purchase Created. SureCart creates one purchase per product line when a checkout is paid, so this fires once per course bought (test a two-product order once). 3. Under Select Connection, choose your SureCart connection. In the Product selector, choose this course's product so the workflow runs only for it. 4. Click Continue, then Fetch Data. Ottokit pulls in a recent purchase of that product, normally your Step 3 order. If it shows a real customer, fetch again, pick the newest record, or repeat Step 3; do not use the test button in 4b until the sample shows your test address. 5. You now see label and value pairs such as Customer Email, Customer Name, and Order ID; your exact labels may differ slightly. Note which hold the buyer's email, name, and order ID. 6. Click Save. What you should see: a saved trigger whose fetched sample shows your test mailbox as the customer email. ### 4b. Action: call Cubite to enroll the buyer 1. Click plus (+), type API, select the API app. 2. On the Select tab click API Request, then Continue. 3. On the Configure tab choose New API and fill in the fields below. Method: POST. Payload Type: JSON. Endpoint URL: https://academy.example.com/api/v1/enrollments Authentication: API Key. Key name: X-Cubite-Key. Value: the ck_... key from Step 1. The third option asks whether to send the key in the Header or as a Query Parameter: choose Header. Add Headers: check the box and add one row: key Content-Type, value application/json. Add Parameters: check the box. Each row becomes one field Cubite receives. Type keys exactly as shown (capitals matter: courseId, not courseid). For dynamic values, click into Value, type @, and pick the SureCart field from 4a. | Key | Value | | --- | --- | | email | @ and the buyer's email field from the SureCart trigger | | name | @ and the buyer's name field | | courseId | the course ID from your Step 2 table | | redirectTo | the redirectTo value from your Step 2 table, for example /course/workplace-safety-basics/courseware | | externalReference | type surecart-, then @ and pick the order ID field (echoed back for matching runs to orders; not stored) | | sendInvite | true | sendInvite makes Cubite email the buyer the sign-in link itself, so the whole workflow is two steps. Type true as the value and nothing else (Cubite also accepts 1 or yes, and ignores capitals and spaces around it). To write the email in Ottokit instead, leave the row out and see 4c. For a course with prerequisites, add the row skipPrerequisiteCheck = true. Send Entire Payload: unchecked. Wrap Request in Array: No. Behind the form, Ottokit sends Cubite a request like this (it sends each parameter as text, so true arrives in quotes; Cubite accepts it either way): ```json { "email": "learner@example.com", "name": "Jane Learner", "courseId": "clx1abc2d0000abcd1234efgh", "redirectTo": "/course/workplace-safety-basics/courseware", "externalReference": "surecart-ORDER-ID", "sendInvite": "true" } ``` Test and save. Click Continue to reach the Test tab. Test Action sends a real request using the purchase fetched in 4a: it enrolls that buyer and, with sendInvite, emails them a link, which is why the sample must be your test mailbox. Click it, compare the response with this example, then Save. ```json { "enrollment": { "courseId": "clx1abc2d0000abcd1234efgh", "userId": "clx7usr9e0000wxyz5678ijkl", "siteId": "clx2site4f0000mnop9012qrst", "status": "completed", "enrolledAt": "2026-08-25T14:52:52.962Z", "expiresAt": null }, "user": { "id": "clx7usr9e0000wxyz5678ijkl", "email": "learner@example.com", "name": "Jane Learner" }, "magicLinkUrl": "https://academy.example.com/auth/magic-link?token=TOKEN", "created": true, "emailSent": true, "externalReference": "surecart-ORDER-ID" } ``` "status": "completed" refers to the enrollment, not the course: it means full, paid access with no Cubite checkout step. "emailSent": true means Cubite handed the sign-in email to the mail provider; check the test mailbox now. "magicLinkUrl" is the link in the email. "created": true means this call created the enrollment (false: already enrolled, re-confirmed), and "expiresAt" shows a date only when the course has an access period set in the admin. If "emailSent" is false with the sendInvite row present, check that the value is true and test again; if it still is, check that Member sign-in invite is switched on under Sites -> your site -> Emails. The enrollment worked either way. An "error": line is explained in Troubleshooting. What you should see: a response with "emailSent": true, and within a minute the sign-in email in your test mailbox. ### 4c. Choose who sends the welcome email Path A (recommended): Cubite sends it. With sendInvite set to true there is no email step to build. - What the learner receives: your site's Member sign-in invite email: subject "You've been added to Example Academy" (your site's name), one line saying an account was created for them, and a Sign in button. - Link lifetime: 7 days. It signs them in with no password and lands on your redirectTo page. - Sender: your site's configured sender under Sites -> your site -> Emails. Unless your site is on a paid plan with a verified sending domain, it is sent from noreply@cubite.io with your site's name as the sender name. - Wording: fixed, because it carries a sign-in link. Switching it off under Emails -> Member sign-in invite means nothing is sent and emailSent is false; use Path B then. - Not everyone gets the one-click link. A site administrator, an account with a password, or an account that also exists on another Cubite site gets the editable Course enrollment email instead ("You're enrolled in Workplace Safety Basics", with a Go to my courses button) and signs in the normal way. Path B: Ottokit sends it. For your own wording, remove the sendInvite row (Cubite then sends nothing and returns a magicLinkUrl valid for 24 hours) and add an email step after the API step: 1. Click plus (+), search for Gmail, choose Send Email. Select Connection -> Create Connection, sign in to the Google account you send from, click Allow. 2. To: @ and the buyer's email field. From Name: your business name. Subject: for example Your Workplace Safety Basics course is ready. 3. Body: paste the template below, delete SIGN-IN-LINK, type @, search for magicLinkUrl, click it. For the greeting, pick the customer name field the same way (it may be the full name) or write "Hi there". 4. Continue, Test Action (a real email goes to the test buyer), Save. Hi FIRST-NAME, Thank you for your purchase. Your course is ready on the Example Academy site. Click this link to sign in and start (no password needed): SIGN-IN-LINK The link works once and expires 24 hours after this email was sent. If it has expired, go to https://academy.example.com/auth/signin and click "Email me a sign-in link" for a fresh one. Kind regards, The Example Academy team Ottokit also offers an SMTP Send Email app and a WordPress -> Send Email action if you would rather not send from Gmail; the mapping is similar (To, Subject, Body with the @ picker). What you should see: on Path A, nothing to build; on Path B, a test email in the test mailbox whose link opens the course learning page. ### 4d. Publish Click Publish at the top right. The label changes to Update, which means the workflow is live. Until then, real purchases do nothing. What you should see: the top-right button reads Update, not Publish. ## Step 5: Test the finished workflow end to end Use a second test address (name+test2@example.com) so you see a brand-new enrollment; reusing the Step 3 address returns "created": false, which is also correct. 1. In a private window, buy the course product with the second address and the code QA100. 2. Wait a minute or two (allow up to five), then check the next three places. 3. Ottokit: the workflow's history shows the trigger, then the API step with a response like the one in 4b. 4. Cubite admin: https://cubite.io/admin/courses -> the course -> Learners tab lists the test address with Status "Not started" and Access "No expiry" or an expiry date. 5. Test mailbox: Cubite's "You've been added to ..." email (Path A) or your Ottokit email (Path B). Check spam too. 6. Click the sign-in link. You should land signed in, on the course learning page, with no password asked. 7. Delete or disable the QA100 coupon; recreate it whenever you test again. What you should see: all three places agree on the same enrollment, and the link signs you in without a password. Spotting a failed run later. Nothing alerts you to a failed run, so after the first few sales, or when a buyer says no link arrived, open the workflow's history in Ottokit (kept 30 days on Business) and look at the API step for an "error": line. The fallback is always manual: Courses -> the course -> Learners -> Add learner. Tell buyers to expect a second email. SureCart's confirmation and the sign-in link arrive separately, so add a line to the Order Confirmation email (SureCart -> Settings -> Notifications -> Edit): "Your course sign-in link arrives in a separate email within a few minutes; check spam if you do not see it." Why a live coupon rather than test mode. It is not documented whether Ottokit's triggers fire for SureCart test-mode orders, and with Test Mode Restricted on (Settings -> Advanced -> Spam Protection & Security) a non-admin sees "Test checkout successful" but no order is created. ## Step 6 (optional): Remove course access after a SureCart refund Refunding in SureCart with Revoke Purchase checked (Orders -> the order -> Charge Section -> three-dot menu -> Refund) marks the purchase revoked; a refund without that box revokes nothing. Customers -> the customer -> Purchases -> Revoke does the same without a refund. Both fire one trigger, which a second workflow passes to Cubite. Build one refund workflow per course product. A single workflow that fires on any refund but always sends the same courseId would, on a refund of course B, remove access to course A, which the buyer still paid for. Before you start, refund your Step 5 test order with Revoke Purchase checked, so the trigger has a record to fetch. 1. Create Workflow -> Create from Scratch, named SureCart refund to Cubite: Workplace Safety Basics. 2. plus (+) -> SureCart -> Purchase Revoked -> your connection. If the trigger offers a Product selector, choose this course's product. Continue -> Fetch Data -> Save. If the fetched data shows a customer number but no buyer email, stop and contact Cubite support (hello@cubite.io). 3. If there was no Product selector, add plus (+) -> Filter: Condition the product name field (via @), Operator is equal to, Value the product's exact name. Continue -> Test Action (it should show True) -> Save. 4. plus (+) -> API -> API Request -> Continue -> New API, set up exactly as in 4b except: Method DELETE, and only two parameter rows, courseId = this course's ID and email = @ the buyer's email field. 5. Continue -> Test Action -> Save -> Publish. Success looks like: { "revoked": true } 404 No enrolment found for that learner (the response spells it that way) means the learner was not enrolled; harmless. Fallback 1: values in the address. If Test Action returns courseId is required or email or userId is required, Ottokit did not send the parameter rows with a DELETE. Set Endpoint URL to the address below (your course ID in place of COURSE-ID), click after the final =, type @, pick the buyer's email field, and remove the two parameter rows. Success looks the same. https://academy.example.com/api/v1/enrollments?courseId=COURSE-ID&email= Fallback 2: end access with PUT. If Ottokit will not place a field inside the URL, change Method to PUT, keep the parameter rows, and add a row expiresAt = 2020-01-01T00:00:00Z. Success starts { "enrollment": .... This sets the access expiry to the past instead of deleting the record: the course shows "Access expired" on the learner's dashboard and the lesson package stops recording progress, but not every page is locked on its own, so contact Cubite support (hello@cubite.io) if you end up here. What you should see: on the course's Learners tab, with DELETE the test address is gone; with PUT it remains, with a past expiry. Remove from course on a learner's row removes anyone by hand. ## Selling a bundle (learning path) instead of one course If a SureCart product should unlock a Cubite learning path (several courses in sequence), the call changes: - Endpoint URL: https://academy.example.com/api/v1/learning-paths/LEARNING-PATH-ID/enroll - Method: POST - Parameters: email and name only. - Scope on the key: learning-paths:write. Edit your key to add it. Cubite creates or finds the learner and enrolls them in the path and every course unlocked at the start, skipping payment and prerequisite checks. A success response (201) contains enrollment, enrolledCourses, and user. The path ID is the last part of the address bar at Learning Paths -> the path. This endpoint sends no email and returns no link. Two ways to get the buyer signed in: - Tell the buyer to use Email me a sign-in link at https://academy.example.com/auth/signin. - Add a second API step: POST to https://academy.example.com/api/v1/users/invite with email and redirectTo (for example /dashboard). It returns { "issued": true, "magicLinkUrl": "..." }, a 24-hour link with the same eligibility rules, which you email from Ottokit as in Path B. That call needs the users:write scope on your key. ## How learners sign in later - The welcome link is one-time and time-limited: 7 days from Cubite (Path A), 24 hours from Ottokit (Path B). A double click, second tab, or email scanner within about 5 minutes is tolerated; after that the page says "This link has already been used. Please request a new one." or, for an old link, "This link has expired. Please request a new one." - Email me a sign-in link always works. It is the main button on https://academy.example.com/auth/signin: the learner enters their email, passes the small "I am human" check, and gets a fresh link. API-created accounts have no password, so this is their intended way in. - A password is optional. Forgot your password? on the sign-in page sets one. From then on Cubite stops issuing one-click links for that address; later purchases still enroll them, but the email is the Course enrollment one. - Each new link for the same email cancels the previous one. ## Troubleshooting SureCart to Cubite enrollment errors | What you see | Likely cause | Fix | | --- | --- | --- | | 401 Missing X-Cubite-Key header | Key not sent as a header, or header name misspelled | Authentication = API Key, Key name exactly X-Cubite-Key, in Header | | 401 Invalid API key | Mistyped, an extra space, or another site's key | Re-paste from your password manager; if unsure, revoke and create a new key | | 401 API key revoked | The key was revoked in Cubite | Create a new key and paste it into every workflow | | 401 API key expired | Its expiration date passed | Edit the expiration under API keys, or create a new key | | 403 Key missing required scope: enrollments:write (or another scope) | That scope was not checked on the key | Edit the key and check it: enrollments:write for enroll and refund, learning-paths:write for bundles, users:write for /users/invite | | 403 Source IP not allowed for this API key | An IP allowlist is set on the key | Edit the key and clear the allowlist | | 400 Invalid JSON body | Payload Type is not JSON, or a hand-typed body has a typo | Set Payload Type to JSON; use the parameter rows | | 400 courseId is required, email and courseId are required, or email or userId is required | Misspelled key (capitals matter); empty mapped field; or no parameter rows sent with the DELETE | Check email and courseId spelling; re-run Fetch Data and re-map; on refunds use Fallback 1 or 2 | | 400 Invalid email | email is mapped to the wrong SureCart field | Re-map email to the buyer's email field | | 404 Course not found on this site | A slug or another site's course was used instead of this site's course ID | Copy the ID from the address bar in Courses | | 404 No enrolment found for that learner (refund) | Never enrolled, or the email differs from the enrollment | Harmless if no revoke was expected; otherwise check courseId and the email | | 409 Prerequisites not satisfied | The course has prerequisites the buyer has not completed | Remove them, or add the row skipPrerequisiteCheck = true; enroll the buyer by hand meanwhile | | 429 Rate limit exceeded for this API key. Retry later. | Over 120 write calls in one minute (only a bulk loop gets there) | Wait a minute and run it again | | 200 with "created": false | Already enrolled (for example a repeat purchase); Cubite re-confirmed it and, with sendInvite, emailed a fresh link | Nothing to fix. An existing expiry is not moved; to extend access on a renewal, use PUT with a new expiresAt (Step 6 shows the shape) | | 200 with "expiresAt" showing a date | The course has an access period; the enrollment ends then | Nothing to fix | | 200 but "magicLinkUrl": null and "emailSent": true | Not eligible for a one-click link (site administrator, account with a password, or account on another Cubite site); Cubite sent the Course enrollment email instead | Nothing to fix; they sign in the normal way. For a test, use a fresh non-admin mailbox | | 200 but "emailSent": false with sendInvite present | The value is not true (a typo, or a SureCart field mapped by mistake), or Member sign-in invite is off under Sites -> your site -> Emails | Fix the value; enable the email; or use Path B | | 200 with no "emailSent" or "created" line at all | Your site is on an older Cubite release that predates sendInvite | Contact Cubite support; until then use Path B, which needs nothing new | | "emailSent": true but nothing in the inbox | Spam; a typo in the buyer's email; a slow mail provider | Check spam and the email under SureCart -> Customers; the learner can use Email me a sign-in link | | "This link has expired" or "already been used" | The link is one-time and time-limited | The learner clicks Email me a sign-in link on the sign-in page | | Learner lands on "My courses" instead of the course | redirectTo was not a path starting with a single / (a full https:// address is ignored) | Use the redirectTo value from your Step 2 table | | Nothing happens after a real purchase | Workflow not published; wrong Product in the trigger; a test-mode order; or Test Mode Restricted blocked order creation | Check the button says Update; re-check the product; buy on the live store with the coupon | | Fetch Data shows no purchase | No purchase of that product yet | Make one coupon purchase with the test mailbox (Step 3) and fetch again | | The buyer mistyped their email | Cubite created the account exactly as typed, so nothing arrived | Correct it under SureCart -> Customers; Add learner with the right address on the course's Learners tab; Remove from course on the wrong one | ## Keeping your Cubite API key safe - Treat the ck_ key like a password. Paste it only into Ottokit's (or Automator's) header field: never on a web page, in your theme, in a shared document, or in an email to anyone, including Cubite support. - If it leaks: revoke it first under Sites -> your site -> Integrations -> API keys, then create a new one and paste it into every workflow (each course and refund workflow holds its own copy). - Planned yearly rotation: the opposite order, so no sale fails: create the new key, paste it into every workflow, test one with a coupon purchase, then revoke the old key. ## What else you can automate between SureCart and Cubite Under Integrations -> Webhooks, Cubite can send signed events such as enrollment.created, course.completed, and certificate.issued to Ottokit's Webhooks -> Catch Webhook trigger (every plan) or Automator's Receive data from a webhook trigger (Pro). The enrollment endpoint also accepts up to 100 learners per request, which suits a one-off import of past buyers; ask Cubite support about that. ## Appendix: the same integration with Uncanny Automator The Cubite side is identical; only the WordPress screens change. Free or Pro? The webhook action is free. Automator's SureCart trigger A user purchases a product is free too, but only runs for buyers logged in to WordPress at the time; A guest purchases a product covers buyers without a WordPress login and needs Automator Pro. SureCart appears to create a WordPress account and sign new buyers in at checkout, so the free trigger may catch most purchases; confirm with one coupon purchase in a private window, and if it does not fire, you need Pro. ### Enroll on purchase The webhook action's Body rows are these (Key / Data type / Value); insert SureCart values with the * button beside each Value field: | Key | Data type | Value | | --- | --- | --- | | email | Text | * -> SureCart -> Billing email (or Customer's email, depending on version) | | name | Text | * -> SureCart -> Billing name (or Customer's name) | | courseId | Text | the course ID from your Step 2 table | | redirectTo | Text | the redirectTo value from your Step 2 table | | externalReference | Text | surecart- followed by * -> SureCart -> Order ID | | sendInvite | Boolean | true | Build the recipe: 1. Uncanny Automator -> New Recipe, titled SureCart to Cubite: Workplace Safety Basics. Recipe type Logged-in (free trigger) or Everyone (Pro guest trigger). 2. Trigger: integration SureCart, then A user purchases a product (or A guest purchases a product). In the Product dropdown pick the course product, not Any product. Save the trigger. 3. Add action -> Webhooks -> Send data to a webhook. URL https://academy.example.com/api/v1/enrollments; Request method POST; Data format JSON; Authorization empty (it writes a standard Authorization header, which Cubite does not read); Headers: one row, Name X-Cubite-Key, Value your key. 4. Add the Body rows from the table above. 5. Check data format previews the JSON. 6. Send test sends a real request with whatever is in the fields. Temporarily type your test mailbox in the email Value instead of the * SureCart value, click Send test, wait for "Data successfully sent to: ...", then put the * value back before saving. 7. Save the action. 8. To have Automator send the email instead, remove the sendInvite row and add a second action below the webhook: Add action -> Emails -> Send an email, Content type HTML, To = * -> SureCart billing email, Subject and Body as in Path B. For the link, click * in the Body and choose Response - magicLinkUrl under the Send data to a webhook group; response tokens appear only after a successful Send test and only for actions placed after the webhook, so run Send test again if it is missing. 9. Switch the trigger, the actions, and the recipe from Draft to Live, then test with a coupon purchase as in Step 5. Uncanny Automator -> Logs shows each run's response. What you should see: "Data successfully sent to: ..." after Send test, and the same three checks as Step 5 after a coupon purchase. ### Refunds Automator has no "purchase revoked" trigger. The closest is A refund for a product is issued to a customer (Pro): one recipe per product, with the same webhook action set to Request method DELETE and Body rows courseId and email, or the PUT + expiresAt alternative from Step 6. It fires on every refund, whether or not you checked Revoke Purchase in SureCart, so a partial refund meant to keep access would still remove it in Cubite. --- # How to Run Your LMS From Claude and ChatGPT: A Step-by-Step Guide https://cubite.io/blogs/connect-claude-chatgpt-to-your-lms-step-by-step **By:** Amir Tadrisi **Updated:** 2026-08-20 The click-by-click walkthrough: connect Claude, Claude Code, or ChatGPT to your Cubite site over MCP, do real work in chat, and read your analytics. Every screenshot is production. Last month I wrote about [why we built an MCP server into Cubite](https://cubite.io/blogs/run-your-lms-from-an-ai-assistant): the argument, the honest competitive map, the security model. This post is the other half: the actual walkthrough. Every screenshot below is from our production environment at cubite.io, taken today, and every command is copy-pasteable. By the end you will have Claude or ChatGPT connected to your learning site and able to do real work: create a course, publish a post, enroll a cohort, and answer questions like "which of my courses has the worst completion rate?" from live data. --- ## What you need - A Cubite site (any plan; the MCP server is included). If you do not have one, [register](https://cubite.io/auth/register) and create a site first. - A Claude account (web or desktop; even the free plan can add one custom connector), Claude Code in the terminal, or ChatGPT with developer mode available (Plus, Pro, Business, Enterprise, or Edu; not the free tier). - About five minutes. There is exactly one server URL, for every site: ```bash https://cubite.io/api/mcp/mcp ``` You never tell the assistant which site is yours in a prompt. You pick the site (or several of your own sites) once, on the sign-in screen, and the connection is bound to that set from then on. There is no parameter an assistant can pass to reach a different site. --- ## Step 1: Connect Claude (web or desktop) 1. In Claude, open Settings, then Connectors (Anthropic currently files it under Customize), then Add custom connector. 2. Paste https://cubite.io/api/mcp/mcp and continue. 3. Claude opens a Cubite sign-in page in your browser. Sign in, pick which site to connect (or tick several of your own, with a search box to find them fast), and review the permission checkboxes. This is the consent screen you will see. Each permission is its own checkbox, ticked to start. Untick anything you do not want to grant; the connection gets only what stays ticked, on exactly the sites you selected. The screen also names the exact destination the authorization is sent to, because app names are self-reported and unverified; glance at it before you approve: 1. Approve. Back in Claude, the Cubite tools appear in your chat. That is the whole setup: no key was copied, nothing was pasted into a settings file. Try it immediately (this works even under the default read-only grant): > Give me a health check of my courses: enrollments, completion rates, and where learners stall. --- ## Step 2: Connect Claude Code (terminal) If you live in the terminal, one command: ```bash claude mcp add --transport http cubite https://cubite.io/api/mcp/mcp ``` Then run /mcp inside Claude Code and pick cubite to complete the same browser sign-in. From then on, your terminal sessions can operate the site: > > create a draft blog post announcing our new food safety course, link the course, and keep it hidden so I can review it Prefer a key over OAuth (for CI, servers, or a shared machine)? Create a scoped API key in Admin, then your site, then Integrations, and add it as a header instead: ```bash claude mcp add --transport http cubite https://cubite.io/api/mcp/mcp \ --header "Authorization: Bearer ck_..." ``` --- ## Step 3: Connect ChatGPT 1. In ChatGPT, enable developer mode (in Settings; OpenAI has filed it under connectors and under security at different times, so look around). 2. Add a connector and paste https://cubite.io/api/mcp/mcp as the server address. 3. Sign in when prompted, pick your site, approve the permissions. Same consent screen as Claude, same rules. Two ChatGPT-specific notes worth knowing: > **INFO:** Developer mode is what unlocks the write tools (creating courses, enrolling learners). That is OpenAI's policy for any connector with write actions, not a Cubite limitation. > **INFO:** ChatGPT's research modes only ever call two tools, named search and fetch. Cubite ships both. That means Deep Research and company knowledge can search your site's courses, pages, blog posts, and learning paths and cite them by URL, even though those modes never touch the write tools. --- ## Step 4: Do real work The server exposes 137 tools, and the assistant only sees the ones your connection is allowed to use. Some real prompts we use, verbatim: Build a course from a document. > Here is our onboarding SOP. Turn it into a course called "New Staff Onboarding": H2s become sections, H3s become units, and add a short graded quiz at the end of each section. Keep it out of the catalog until I review it. The assistant chains course_create, course_set_content, and the question tools, then hides the course from the public catalog. H2/H3 mapping is a server convention, so structure survives. Enroll a cohort. > Enroll these 12 people in Food Safety Level 2 and give me their sign-in links: [paste list] One bulk-enroll call. New learners are created on your site and come back with a magic sign-in link you can drop into an email. Existing learners are just enrolled, with one deliberate exception on the links: if an account signs in with a password, or also exists on another Cubite site, no sign-in link is minted for it (a link like that would be an account-takeover vector), and that learner keeps signing in the way they already do. Publish content. > Write a 900-word post about our new HACCP course for food-truck operators, use our usual tone, link the course, and publish it. Upload a SCORM or xAPI package. > Here is the URL of our Storyline export: https://... Upload it and add it as the final unit of the Compliance course. --- ## Step 5: Ask for analytics This shipped today and it changes how the connection feels: the assistant can now read your numbers, not just your content. Three report tools back it: - Site overview: members by role, enrollments (total, last 30 days, active learners), completions and completion rate, certificates issued, quiz attempts with average score and pass rate. - Per-course engagement: one row per course with enrollments, completions, completion rate, average progress, certificates, and quiz stats. - Per-learner progress: each member with their enrollment count, completed courses, average progress, certificates, and last activity. - Search Console (for sites with Google Search Console connected). Ask for search performance (clicks, impressions, average position and their trend), your top queries and pages, and ranked SEO opportunities. Requires the sensitive "View Google Search Console" permission, so it is an explicit opt-in, never in the default read-only grant. So you can ask: > Give me a health check of my site: how are enrollments trending, which courses complete well, and which have a quiz pass rate under 70%? or > Who enrolled in the last month but has not started anything? Draft a nudge email for them. > **INFO:** A deliberate privacy split: the aggregate reports sit behind a reports:read permission that never returns a learner's name or email, and it is part of the default read-only grant. The per-learner report requires the members permission (members:read), the same one that already means "may read who my learners are". An assistant you connected read-only can tell you your completion rate; it cannot tell you your learners' emails unless you granted that explicitly. Here is the overview tool answering for one of my own sites, verbatim from production while writing this post (a site where I park course experiments, so the completion numbers are honestly unflattering): ```json { "members": { "total": 13, "byRole": { "STUDENT": 13 } }, "courses": { "total": 363 }, "enrollments": { "total": 16, "last30Days": 0, "activeLearners": 6 }, "completions": { "total": 0, "last30Days": 0, "completionRatePct": 0 }, "certificates": { "total": 0, "last30Days": 0 }, "quizzes": { "submittedAttempts": 0, "averageScorePct": null, "passRatePct": null } } ``` And the per-course report on the same site, top row: ```json { "name": "AI-Driven LLM Evaluation: Picking the right AI model", "enrollments": 6, "completions": 0, "completionRatePct": 0, "averageProgressPct": 50.6, "lastEnrollmentAt": "2026-05-21T17:49:20.057Z" } ``` An assistant reading that will tell me the same thing I can see myself: learners get halfway through the flagship course and stall, and nobody has enrolled in 30 days. That is exactly the kind of thing you want surfaced in the same chat where you can then say "draft a re-engagement email". --- ## Step 6: Know your permissions, and how to cut it off Everything runs on scoped permissions: - The OAuth consent screen shows exactly what is requested; untick freely. - A client that asks for nothing specific gets read-only defaults: site settings, pages, courses, and aggregate analytics. It can look, not change. - Write permissions are explicit. So is reading learner data. - Access tokens last one hour and refresh automatically; replaying a stolen refresh token revokes the whole connection. And when you want it gone: Admin, then your site, then Integrations shows every connected assistant with its permissions, who authorized it, and when it was last used. Disconnect kills the credential immediately, no matter what the assistant's own settings say. --- ## Troubleshooting | Symptom | What is happening, and the fix | | --- | --- | | A 401 mid-session | "API key expired" means the one-hour access token lapsed and your client did not refresh it. Reconnect once; a client that implements OAuth refresh properly stays quiet after that. "Missing API key" is different: no credential was sent at all, so for header-based setups re-check the Authorization: Bearer ck_... header. | | The assistant says it has no Cubite tools | the tool list is filtered to the permissions the connection actually holds, so a narrow grant sees a short list. Check the connection's permissions in Admin, then Integrations. A key with no permissions at all is refused outright, with an error that says exactly that. | | A tool call fails with "missing required scope" | the connection was approved without that permission. Reconnect and tick it, or create an API key that has it. | | ChatGPT does not show the connector | developer mode is not enabled, or your workspace admin has not allowed it (Business and Enterprise gate it). | | Gemini | the consumer Gemini app has no custom-connector UI. Gemini CLI works with an API key; use httpUrl (not url) in its settings. | --- ## What is next The server, the OAuth flow, and everything in this post is live today. Next on the list: publishing to the official MCP registry and the assistant directories so connecting is one click from inside Claude and ChatGPT, with no URL to paste at all. ## Connect your site in about five minutes No Cubite site yet? Create one, connect your assistant, and build your first course by describing it. Questions? Email hello@cubite.io. [Get started](https://cubite.io/auth/register) --- # Customer Education LMS: Give Each Audience Its Own Branded Academy https://cubite.io/blogs/customer-education-lms **By:** Amir Tadrisi **Updated:** 2026-08-12 Training your customers is not the same as training your staff. Here is what a customer education LMS has to do, and why a single branded academy rarely survives once partners and resellers are in the mix. The people you most want to train are the ones your IT department never set up: your customers. They have no company email from you, no provisioned account, and no managed laptop. They sign themselves up, learn on their own device, and judge your product by how that goes. That is the job of a customer education LMS: a platform built to teach external audiences, meaning customers, partners, and resellers, rather than employees. Get it right and training becomes a retention and adoption engine. Get the plumbing wrong and you leak one customer's data into another customer's academy. _Built on Cubite_ ## You can run a serious external academy without building an LMS **160,000+ learners on one academy** — A single branded academy built on Cubite LMS has trained more than 160,000 external learners over seven years. Aquent Gymnasium. Source: cubite.io, verified August 2026. ## Customer education is not employee training Vendors that sell learning software draw a hard line here. Docebo, for example, splits its solutions into Internal Learning (employee onboarding, sales enablement, compliance) and External Training, and it groups customer education alongside partner enablement and member training. The audiences are outside your company, and that changes the requirements. An employee logs in through your identity provider on a device your team manages. An external learner does none of that. They arrive from a link in an email or your app, expect to sign themselves up, and have no patience for a portal that looks like it belongs to a software vendor they have never heard of. The academy has to look and feel like it is yours. - Self-serve access: customers enroll themselves, with no IT ticket and no waiting. - Your brand, your domain: the academy lives at your address, not a shared vendor URL. - Segmented by audience: a customer, a reseller, and a certified pro follow different paths. - Credentials that travel: certificates and CEUs that mean something outside your platform. - Measured by outcomes: adoption and retention, not seat time. ## Why one shared academy breaks when you add partners and resellers A single academy is fine while you train one audience. The moment you add a second, the requirements change. Your resellers should not see your direct customers' progress. A partner running its own cohort needs its own branded space and its own reporting, not a filtered view of everyone's. This is a data-separation problem, and branding alone does not solve it. > **WARNING:** Watch the word white-label. If it means your logo on one shared account, every audience still shares one user database. That is how one partner ends up able to see another partner's learners. Real separation is architectural, not cosmetic, and you have to confirm which one a platform gives you before you sign. The distinction is worth understanding before you buy, because it decides privacy, reporting, and whether you can ever resell access. We cover it in depth in [why real multi-tenancy beats a logo swap](/blogs/white-label-lms). ## What a customer education LMS actually has to do None of this is exotic. It is the difference between a training tab bolted onto your app and an academy your customers actually return to. The hard part is the isolation: doing all of the above once is easy, doing it separately for every audience without cross-contamination is where most tools quietly fall short. ## How Cubite LMS approaches customer education Cubite LMS is multi-tenant by design, which is the part that matters most here. On its white-label service, each tenant's data is fully isolated: separate user databases, course content, analytics, and certificates. Each academy deploys on your own domain, such as learn.yourcompany.com, with full SSL and branded URLs for courses, certificates, and student portals. That means a partner academy and a customer academy can live side by side without ever seeing each other. On top of that isolation, the pieces an external program needs are native. Cubite issues verifiable certificates with QR codes and CEUs, tracks completion with native SCORM 1.2 and 2004, xAPI, and a built-in Learning Record Store, and ships 14 built-in reports with one-click CSV export so you can see [who is adopting and who is stalling](/blogs/lms-reporting-at-risk-learners). Access scales from self-serve signup up to [SSO, SAML, and SCIM](/blogs/lms-sso-saml-guide) on the Enterprise tier, and Stripe handles monetization when training is something you sell. | External audience | What they need from your academy | | --- | --- | | Your customers | Self-serve access, product-focused paths, and completion they can show internally | | Your partners and resellers | Their own branded, isolated space with segmented reporting | | Certified professionals | Verifiable certificates and CEUs that hold up outside your platform | | Your own team | Per-segment analytics and clean exports, without exposing one account to another | ## How to stand up a customer academy - Define the outcome for each audience: what a trained customer, partner, or reseller can now do - Map content into role-based paths, not one flat library - Put each academy on its own branded domain with SSL - Decide what stays isolated: separate user data, analytics, and certificates per audience - Choose the access model: self-serve signup, SSO, or both - Add verifiable certificates, with CEUs where credibility matters - Connect completion and engagement data to the tools your team already uses - Pick the metric that proves it worked: adoption, retention, or ticket deflection ## When a general LMS is enough, and when you need a purpose-built platform Be honest about your scale. If you train a single audience and do not need separate branded spaces, a general LMS, even a lightweight one, is plenty, and a multi-tenant platform is complexity you will not use. The multi-tenant case only earns its keep once you are running distinct customer, partner, or reseller academies that must stay apart. There is also a case where a purpose-built platform beats a general LMS outright. If the core job of your customer education program is to feed completion and engagement signals natively into your revenue stack, a specialist like Skilljar, which ships native Salesforce, Gainsight, and Zendesk integrations and links training directly to those business metrics, is the better fit today. Cubite gives you a headless REST API and signed webhooks to build those connections, but it does not offer them as one-click native integrations. If that wiring is your priority, weigh the specialist. ## Where Cubite LMS fits If you are training customers, partners, and resellers, and each one needs its own branded space, its own certificates, and data you actually own and can keep separate, that is the multi-tenant white-label case, and it is what Cubite LMS was built for. You can see how the architecture works on the [white-label LMS service](/services/white-label-lms), then decide whether it fits the academy you are trying to build. ## Customer education LMS: frequently asked questions ### What is a customer education LMS? A customer education LMS delivers training to external audiences, meaning your customers, partners, and resellers, rather than employees. It runs branded academies, tracks completion and engagement by segment, issues certificates, and usually supports self-serve signup, so people who never had a company login from you can still learn your product. ### What is the difference between customer training and customer education? In practice the terms are used interchangeably: both mean teaching people outside your company to succeed with your product. Customer education tends to describe the broader program, with paths, certifications, and community, while customer training points at specific courses. The platform requirements are the same: branded, segmented, external-facing delivery. ### How is training customers different from training employees? External learners have no corporate email, no IT-provisioned account, and no managed device. They sign themselves up, learn on their own hardware, and judge you by the experience. Your platform has to be self-serve, branded as yours, and able to keep each customer's or partner's data separate from the rest. ### Can I give each customer or partner its own branded academy? Yes, if your LMS is genuinely multi-tenant. True multi-tenancy gives each academy its own domain, branding, user database, analytics, and certificates, fully isolated from the others. A single shared account with only a logo swap cannot do this, and it risks exposing one audience's data to another. ### Do I need a purpose-built customer education platform or will a general LMS work? If you run one small audience, a general LMS is usually enough. If you need each customer, partner, and reseller isolated on its own branded domain, a multi-tenant white-label LMS fits. If your priority is piping completion data natively into Salesforce or Gainsight, a purpose-built platform is worth the premium. ## Planning a customer, partner, or reseller academy? Book a 30-minute session and we will map your audiences to a multi-tenant setup: what stays isolated, what gets its own domain, and how certificates and reporting work for each one. [Book a 30-minute customer academy review](https://calendly.com/cubite/30min) --- # HIPAA Training LMS: The Records an Audit Actually Tests https://cubite.io/blogs/hipaa-training-lms **By:** Amir Tadrisi **Updated:** 2026-08-12 HIPAA training is easy to deliver and hard to prove. Here is what a HIPAA training LMS must actually record: per-person, timestamped, role-based, and kept for six years. HIPAA has required training for every member of your workforce since the Privacy Rule took effect, and that has not changed in 2026. When the Office for Civil Rights (OCR) opens an investigation, the first question is rarely whether you ran a training session. It is whether you can prove who completed it, when, and on what content. Delivering the training is the easy part; any video and a short quiz can do that. The hard part, the part that fails audits, is producing a defensible record for every worker, kept for six years, that an auditor can read in minutes. That record, not the video, is the real job of a HIPAA training LMS. _Compliance training_ ## The number that decides a HIPAA training audit **6 years minimum record retention** — Every HIPAA training record must be kept for at least six years, and OCR can ask to see any of them. 45 CFR 164.530(j). Source: HIPAA Journal, updated July 2026. ## What HIPAA actually requires you to train, and how often The rule is broad on purpose. Under the Privacy Rule (45 CFR 164.530(b)(1)), you must train every member of your workforce on your policies and procedures, and that includes clinicians, billing and administrative staff, IT, volunteers, students, and contractors who might encounter protected health information. The Security Rule (45 CFR 164.308(a)(5)) adds a separate security awareness and training program for the same people. - At hire: before a new employee or contractor touches electronic PHI. The rule requires a reasonable period after joining, and some employers set a hard 30 to 90 day limit. - Annually: HIPAA sets no fixed federal interval, but an annual refresher is the enforced best-practice standard, and recent OCR settlements have required it by name. - On material change: whenever you update a policy, adopt new technology that touches PHI, or a risk analysis finds a gap. None of that matters if you cannot prove it. HIPAA requires you to document what training was delivered, when, to whom, and how often, and to keep those records for at least six years from the date they were last in effect (45 CFR 164.530(j)). A completion date with no learner name, or a certificate with no content version, is not evidence an auditor will accept. > **WARNING:** The quiet failure is not the missing session, it is the lapsed one. Annual training that slipped to fourteen months for a handful of staff, or a contractor who was never assigned it, is exactly the gap an OCR corrective action plan is built around. You need the current status of every person, not an average completion rate. ## The audit is a records test, not a training test OCR does not grade your slides. In an investigation it asks for evidence, and if the training records are incomplete it issues a corrective action plan. A February 2026 settlement over a phishing incident, for example, required the organization to conduct annual workforce training on its written HIPAA policies and to document it. This is where a spreadsheet quietly loses. It can hold a list of names, but it cannot timestamp a completion, version the content that was completed, flag a certificate that is about to expire, or export a clean per-person history on the day OCR asks. Those are the four things the record actually has to do. ## What a HIPAA training LMS has to capture Role-based training is not a nice-to-have in 2026. The proposed HIPAA Security Rule update would make documented, role-specific training an explicit requirement, and auditors already expect a billing coordinator and a clinical nurse to have completed different material. An LMS that assigns by role, and records which role got which course, turns that expectation into evidence. ## How Cubite LMS handles the record Cubite LMS was built for compliance and accredited training, so the record-keeping is native rather than bolted on. It issues verifiable certificates with QR codes and CEUs, gates completion behind a quiz so a pass is a real pass, and tracks everything with native SCORM 1.2 and 2004, xAPI, and a built-in Learning Record Store. You can see how it approaches [verifiable certificates and audit-ready records](/blogs/compliance-training-lms) in more depth. For the audit itself, Cubite LMS ships fourteen built-in reports, including completion funnels and a certificate-expiry report that flags refreshers coming due, with one-click CSV export for anything an auditor requests. That [certificate-expiry report](/blogs/lms-reporting-at-risk-learners) is the one that closes the lapsed-training gap before it becomes a finding. Each academy also runs as its own white-label environment under your domain, with SSO, SAML, and SCIM on the Enterprise tier for [role-based access controls](/services/sso-integration). | What an OCR audit asks for | Where it lives in a HIPAA training LMS | | --- | --- | | Proof each worker was trained | A dated, per-person completion record | | When they were trained | A timestamp on every completion, kept six years | | On what content | The course and version tied to the record | | Whether it is current | A certificate-expiry report, not a manual calendar | | Role-appropriate training | Assignment and records by job role | | Evidence you can hand over | A one-click CSV export, per person and per course | ## The BAA question, answered honestly Here is the part most vendor pages blur. A Business Associate Agreement is required when a vendor creates, receives, or stores protected health information on your behalf. Your HIPAA training records, names and completion dates and quiz scores, are workforce records, not patient PHI, so training delivery alone usually does not trigger one. > **INFO:** Do not put real patient data into training courses or scenarios. If PHI will ever touch the platform, a signed Business Associate Agreement is required first. Ask any vendor, including us, for their BAA and security documentation before you build a course around real records, and treat a vague answer as a red flag. ## The 2026 Security Rule update: proposed, not law yet You will see a lot of 2026 HIPAA Security Rule content this year, so be precise about its status. OCR issued the proposed update in January 2025, the comment period has closed, and as of mid-2026 it is not final, with the federal agenda now targeting July 2027 for final action (RIN 0945-AA22). Treat its stronger, documented, role-based training expectations as the clear direction of travel, but build to the rule that is actually in force today. ## When you might not need a dedicated HIPAA training LMS If you are a three-person practice that trains everyone in one room once a year, a signed attendance sheet and a folder can meet the documentation rule, and an LMS is overhead you do not need yet. The software earns its place when the numbers move: dozens or hundreds of staff, regular turnover, contractors, multiple sites, or a real chance of an OCR audit. At that point the manual record is the liability, not the tool. - A current, dated training completion exists for every workforce member, including contractors and volunteers - Each record shows the content and version completed, with a timestamp - Training is assigned by role, and the records show which role got which course - Certificate expiry is tracked automatically, so refreshers do not lapse - All records are retained for at least six years - You can export a per-person, per-course history in one step - A policy change triggers re-training, and that is logged too ## Where Cubite LMS fits If your HIPAA training program lives in a spreadsheet, a video tool, and someone's memory, the gap is not the training, it is the evidence. Cubite LMS delivers the training and produces the audit record in one place: per-person completions, versioned content, verifiable certificates with expiry tracking, and a one-click export when OCR asks. It is the same discipline behind our [accredited food-safety training](/blogs/food-safety-training-lms) work, applied to healthcare. ## HIPAA training LMS: frequently asked questions ### How often is HIPAA training required? HIPAA requires training at hire, before a worker accesses PHI, and again whenever policies or technology change. There is no fixed federal interval, but an annual refresher is the enforced best-practice standard, and recent OCR settlements have required annual workforce training by name. ### Does an LMS need a BAA for HIPAA training? Usually not for training delivery alone. Your training records, names and completion dates, are workforce records, not patient PHI, so a Business Associate Agreement is not automatically triggered. If real PHI ever enters the platform, a signed BAA is required first, so ask the vendor before you build around real data. ### How long must HIPAA training records be kept? At least six years. HIPAA requires you to retain training documentation for six years from the date it was last in effect, under 45 CFR 164.530(j). The records should show what training was delivered, to whom, when, and how often, which is why per-person, timestamped records matter. ### Who has to complete HIPAA training? Every member of your workforce who might encounter protected health information: clinicians, billing and administrative staff, IT, volunteers, students, and contractors. The Privacy Rule (45 CFR 164.530(b)) and the Security Rule (45 CFR 164.308(a)(5)) both require it, and role-based content is expected for different job functions. ### What should a HIPAA training LMS produce for an OCR audit? A defensible, per-person record: who was trained, on what content and version, when, and whether it is current. It should export that history in one step, track certificate expiry so refreshers do not lapse, and keep everything for six years. A completion count alone is not evidence. ## See whether your HIPAA training records would survive an audit Book a 30-minute review of how your team trains and documents it. We will map your current records against what an OCR audit asks for, and show where an LMS closes the gap. [Book a 30-minute audit-readiness review](https://calendly.com/cubite/30min) --- # About Us https://cubite.io/pages/about-us **By:** Amir Tadrisi **Updated:** 2026-04-17 # About Cubite We build learning platforms that organizations actually depend on. For over 13 years, Cubite has been the engineering team behind custom LMS platforms for enterprises, universities, nonprofits, and developer education companies. We specialize in Open edX and custom-built learning systems — from emergency migrations to headless architectures to platforms serving hundreds of thousands of learners. ## What We Do Open edX Development — Customization, hosting, upgrades, and integrations. We've migrated platforms through 12 Open edX releases, built headless LMS architectures with LTI, and implemented everything from custom XBlocks to enterprise SSO. Custom LMS Development — When Open edX isn't the right fit, we build from scratch using Next.js, React, TypeScript, and Tailwind. Multi-tenant, AI-powered, white-label — whatever the platform needs to be. Managed Hosting & Support — We don't disappear after launch. Our longest client partnership is 7 years and counting. We handle infrastructure, updates, monitoring, and scaling so your team can focus on content and learners. ## Who We Work With | Sector | Clients | | --- | --- | | Corporate Training | Starbucks, Chef (Progress) | | Developer Education | Redis Labs, InterSystems | | Higher Education | ASU, University of Washington, The Open University | | Global Health | DHIS2 (University of Oslo) | | Nonprofit | EMPath, Aquent Gymnasium | | Enterprise SaaS | Snowflake, Appsembler | ## By the Numbers - 13+ years in EdTech - 160,000+ learners on a single platform we support - 175+ countries reached through DHIS2 Academy - 7 years — our longest active client partnership - 3 days — fastest emergency platform migration - 77% performance improvement on Aquent Gymnasium's Redwood upgrade - SOC 2, GDPR, FERPA compliant ## Our Approach We're not a dev shop that takes a spec and delivers a build. We're a technical partner that understands learning platforms deeply enough to challenge assumptions, suggest better approaches, and stick around to evolve the platform as your needs change. Every engagement starts with understanding your actual problem — not selling a pre-built solution. We've built mobile apps for Starbucks, converted Open edX into a headless CMS for Redis, implemented progressive authentication profiling for Chef, and migrated EMPath's entire platform in 72 hours when their previous provider shut down. Different problems. Same engineering rigor. --- # Custom LMS Development Case Studies: How Cubite Builds Learning Platforms That Scale https://cubite.io/pages/case-studies **By:** Amir Tadrisi **Updated:** 2026-04-17 Custom LMS development case studies from Cubite. See how Starbucks, Redis University, EMPath, and Aquent Gymnasium built scalable learning platforms. # Custom LMS Development Case Studies: How Cubite Builds Learning Platforms That Scale Forty-two percent of organizations are [actively seeking LMS upgrades or replacements](https://www.shortlister.com/). Most of them will spend months evaluating vendors, sit through demos that look nothing like their actual requirements, and eventually pick a partner based on promises rather than proof. This page is the proof. If you're searching for a custom LMS development case study with real names and real numbers, you're in the right place. Over 13 years, Cubite has built, migrated, and scaled custom learning platforms for organizations ranging from global enterprises like **Starbucks** to mission-driven nonprofits like **EMPath**. What follows are real case studies — the challenges, the technical decisions, and the measurable results. Whether you need to migrate off a dying platform in 72 hours, scale to support thousands of concurrent learners, or convert Open edX into a headless content engine, you'll find a relevant LMS implementation case study here. --- ## Why Organizations Choose Custom LMS Development A custom LMS is a learning management system built specifically for an organization's unique needs — tailored workflows, branded experiences, enterprise integrations, and specialized pedagogy that off-the-shelf platforms can't accommodate. The [LMS market is projected to reach $70.83 billion by 2030](https://research.com/education/lms-statistics), and 42% of organizations are actively seeking upgrades. The reasons are consistent: 1. SaaS platforms hit walls when organizations need multi-tenant deployments 2. Compliance certifications (SOC 2, GDPR, FERPA) 3. Enterprise SSO 4. Headless architectures 5. Virtual lab environments The case studies below show what happens when these organizations find the right custom LMS development partner. Each started with a problem their current platform couldn't solve. --- ## EMPath: Emergency Migration in 3 Days — Zero Data Loss Client: [EMPath (Economic Mobility Pathways)](https://empathways.org/) — a Boston-based nonprofit disrupting poverty through direct services, advocacy, and research Platform: [Engage@EMPath](https://engage.empathways.org/) — online learning for hundreds of Mobility Mentoring practitioners worldwide Challenge: EMPath's learning platform ran on Appsembler's managed Open edX SaaS. When Appsembler announced it was shutting down, EMPath had a 4-day window to find a provider, migrate their entire platform, and go live — or lose access to their courses, learner data, and professional development infrastructure. Four days. Hundreds of active practitioners. Course content, learner progress, certifications — all of it at risk. What Cubite delivered in 3 days: - Full data migration — every course, every learner record, every certification, moved to a self-managed hosting environment with zero data loss - Brand continuity — EMPath's custom branding, themes, and domain configuration reproduced exactly on the new infrastructure - Platform functionality — all integrations, course structures, and enrollment workflows preserved and tested - Live before deadline — Engage@EMPath went live on Cubite-managed infrastructure a full day before the shutdown The platform now runs on Cubite's infrastructure as an open edx managed hosting provider, with ongoing support, updates, and monitoring. EMPath's practitioners experienced no interruption to their learning. --- ## Aquent Gymnasium: A 7-Year Partnership, 160,000+ Learners, 70% Faster Client: [Aquent Gymnasium](https://gymnasium.aquent.com/) — a free online education platform for creative professionals, backed by global staffing firm Aquent Partnership span: 7 years and counting Challenge: Gymnasium needed a technical partner who could grow with them — not a one-off development shop. As an open edx development company with deep platform expertise, Cubite was uniquely positioned for this kind of long-term engagement. Over seven years, their needs evolved from basic platform maintenance to complex integrations, and eventually a massive version upgrade spanning six years of Open edX releases. Cubite's open edx customization services for Gymnasium spanned the full spectrum — from ongoing maintenance to deep platform integrations to major version upgrades: Ongoing platform support and maintenance — Cubite served as Gymnasium's dedicated Open edX engineering team, handling everything from bug fixes to infrastructure optimization as the platform grew from 80,000 to 160,000+ learners. Accredible certification integration — Built and maintained the integration between Open edX and [Accredible](https://www.accredible.com/), enabling Gymnasium to issue verifiable digital certificates and badges to thousands of course completers. This turned course completions into shareable professional credentials. Analytics system — Implemented custom analytics infrastructure giving the Gymnasium team visibility into learner engagement, course completion rates, and content performance — the data they needed to continuously improve their curriculum. Hawthorn-to-Redwood upgrade — The crown jewel. Open edX Hawthorn was released in 2018. Redwood in 2024. Upgrading between them means migrating through 12 intermediate releases: Hawthorn → Ironwood → Juniper → Koa → Lilac → Maple → Nutmeg → Olive → Palm → Quince → Redwood. Each version introduces database schema changes, dependency updates, and breaking changes. Most organizations either stay stuck on old versions or start from scratch. Cubite built [a custom automation pipeline](https://github.com/amirtds/upgrade-openedx) that handles the entire multi-version upgrade sequence — database dumps, Docker/Tutor environment management, sequential version-to-version data transformations, and validation at each stage. This turned what would normally be months of manual, error-prone work into a reliable, repeatable process. The results after the upgrade: | Metric | Before (Hawthorn) | After (Redwood) | Improvement | | --- | --- | --- | --- | | Largest Contentful Paint | 5.2s | 1.2s | **77% faster** | | First Contentful Paint | 5.0s | 1.2s | **76% faster** | | Time to First Byte | 2.7s | 0.8s | **70% faster** | The upgrade was co-presented at the 2025 Open edX Conference in Paris in a talk called "Seemingly Seamless," where the Gymnasium team [gave Cubite a shoutout](https://www.youtube.com/watch?v=uCbbREm5Dxc&t=995s) for the migration work — calling Amir Tadrisi the **migration wizard.** --- ## Starbucks Global Academy: Mobile Apps and Enterprise Scale Client: [Starbucks Global Academy](https://starbucksglobalacademy.com/) — a free learning platform created in partnership with Arizona State University, offering courses to Starbucks partners and the public worldwide Challenge: Starbucks needed their learning platform to work on mobile devices for a global workforce of baristas, shift supervisors, and store managers — many of whom access training exclusively on their phones. The platform also needed to handle thousands of concurrent users during company-wide training rollouts without performance degradation. What Cubite delivered: Native mobile applications — Built the Starbucks Global Academy app for both [iOS](https://apps.apple.com/us/app/starbucks-global-academy/id1200272516) and Android, giving Starbucks partners seamless access to their courses, progress tracking, and certifications on mobile devices. Enterprise scalability architecture — Designed and implemented the infrastructure to support thousands of concurrent learners: - Load balancers distributing traffic across multiple application servers - Multi-server architecture ensuring no single point of failure - Performance optimization for peak training periods when entire regions onboard simultaneously When Starbucks rolls out a new training module across thousands of stores, the platform doesn't flinch. --- ## Redis University: Converting Open edX to a Headless LMS Client: [Redis University](https://university.redis.io/) — free online courses and certification for developers learning Redis, offered by Redis Labs Challenge: Redis wanted their learning content on Open edX — it's the best platform for structured, self-paced technical courses. But they didn't want the standard Open edX frontend. They needed their courses to live inside their own website and design system, with their own navigation, branding, and user experience. In other words: they needed Open edX as a headless LMS (a learning management system that serves content via API without its own frontend interface) — keeping the content engine but replacing the entire presentation layer. What Cubite delivered: - Headless architecture — Converted Redis's Open edX instance into a content-only backend, stripping away the default frontend entirely - LTI integration — Implemented [LTI (Learning Tools Interoperability)](https://www.imsglobal.org/lti) to serve Open edX course content, grading, and progress tracking directly into Redis's custom-built frontend - Seamless learner experience — Redis University users interact with courses through Redis's own interface. They never see Open edX. But behind the scenes, Open edX handles course structure, assessments, progress tracking, and certification This is one of the most technically ambitious Open edX implementations in the ecosystem. Most organizations either use Open edX as-is or build something entirely custom. Redis got the best of both: the maturity and reliability of Open edX's learning engine with the complete design freedom of a custom frontend. --- ## Chef (Progress): Complex Auth0 SSO with Progressive Profiling Client: [Learn Chef](https://learn.chef.io/) (now Progress) — the technical training platform for Chef, the infrastructure automation tool used by thousands of DevOps teams Challenge: Chef needed more than basic single sign-on. They wanted an authentication system that let developers log in with their GitHub or Google accounts, progressively collected profile information over multiple sessions (company, job title, use case), and triggered marketing automation based on learning behavior — courses completed, badges earned, login frequency. What Cubite delivered: - Auth0 SSO integration — Implemented [Auth0](https://auth0.com/) for Open edX, enabling GitHub and Google social login. Developers could start learning in seconds without creating yet another account - Progressive user profiling — Rather than hitting learners with a long registration form, the system collected additional information (company, role, goals) gradually across sessions. Each login could prompt for one new field, building a complete profile over time without friction - Action-based triggers — Built logic to take actions based on login frequency and learning milestones. Complete a course? Trigger a badge via [Badgr](https://badgr.com/). Hit a login threshold? Send targeted content via Marketo. This turned the learning platform into a product adoption engine - Analytics pipeline — Learner events flowed through [Segment](https://segment.com/) to Marketo, giving Chef's marketing team visibility into which learners were most engaged and ready for sales conversations The result: Learn Chef wasn't just a training platform — it was a demand generation machine that identified and nurtured the most engaged developers in Chef's ecosystem. --- ## DHIS2 Academy: External Grading for Global Health Education Client: [DHIS2 Academy](https://academy.dhis2.org/) — the online learning platform for DHIS2, the world's largest health information management system, used across 175+ countries with 52,000+ learners Partnership: DHIS2 Academy is led by the HISP Centre at the University of Oslo and serves health professionals, data analysts, and system administrators globally. Challenge: DHIS2 needed their Open edX courses to grade learners based on work performed in external systems — specifically, exercises completed inside live DHIS2 environments. Standard Open edX grading only evaluates answers submitted within the platform itself. What Cubite delivered: - Custom External Graded XBlock — Built a custom [XBlock](https://openedx.org/about/open-edx-platform/#xblocks) (Open edX's pluggable component architecture) that fetches grades from external DHIS2 training environments and writes them back into the Open edX gradebook - Platform upgrades and maintenance — Ongoing support to keep DHIS2 Academy current with Open edX releases and security patches - Global scale reliability — Infrastructure support for a platform serving learners across 175+ countries with content in multiple languages The external graded XBlock solved a fundamental limitation of Open edX for hands-on technical training: students learn by doing real work in real systems, and their grades reflect actual competency — not just quiz answers. --- ## InterSystems Learning: Virtual Labs for Product Training Client: [InterSystems](https://www.intersystems.com/) — a global technology company whose data platforms power healthcare, financial services, and government systems Challenge: InterSystems needed their developer training to go beyond slides and quizzes. Developers, system administrators, and data analysts needed to work with live InterSystems environments during courses — pre-configured, isolated, and disposable after each session. What Cubite delivered: - Virtual lab integration — Connected Open edX with Docker-based virtual lab environments, giving each learner a pre-configured, individual lab instance spun up on demand - Cross-platform integration — Linked the Open edX learning platform with InterSystems' other education tools and internal systems - Hands-on learning at scale — Over 100 concurrent lab instances running at any given time, each isolated and pre-loaded with the right datasets and configurations The labs eliminated the biggest barrier to technical training: setup time. Learners focused on learning InterSystems technology, not fighting with installation and configuration. --- ## Trusted by Industry Leaders These case studies represent a cross-section of Cubite's work as a custom LMS development company. The full client portfolio spans corporate training, higher education, nonprofits, and developer education: | Sector | Clients | Work Performed | | --- | --- | --- | | Corporate Training | Starbucks, Chef (Progress) | Mobile apps, scalability, SSO, marketing automation | | Developer Education | Redis Labs, InterSystems | Headless LMS, virtual labs, LTI integration | | Higher Education | ASU, University of Washington, The Open University | Platform customization, course infrastructure | | Global Health | DHIS2 (University of Oslo) | External grading, multilingual platform support | | Nonprofit | EMPath, Aquent Gymnasium | Emergency migration, long-term partnership, certification | | Enterprise SaaS | Snowflake, Appsembler | Platform development, integrations | Every engagement is backed by SOC 2, GDPR, and FERPA compliance — because enterprise and education clients don't get to compromise on data security. --- ## How Cubite Delivers Custom LMS Projects Every project starts with understanding what you actually need — not selling you what we already built. Here's how engagement typically works: ### Three Paths to Your Platform | | Open edX Customization | Custom LMS (MVP) | Custom LMS (Full) | | --- | --- | --- | --- | | Starting investment | From $10,000 | $15,000–$25,000 | $40,000–$80,000 | | Timeline | 4–8 weeks | 3–4 months | 6–9 months | | Best for | Organizations that need Open edX with custom branding, integrations, or features | Validating a learning product idea before full investment | Multi-tenant platforms, AI-powered learning, complex integrations | | Technology | Open edX, Tutor, Docker | Next.js 15, React 19, TypeScript, Tailwind | Full stack + your requirements | | Managed hosting | $1,900/month | Custom quote | Custom quot | | Includes | Discovery, development, migration, training, support | Discovery, architecture, MVP build, deployment | Full lifecycle: discovery through ongoing evolution | ### What "partnership" actually means The average Cubite client relationship isn't a 3-month project — it's measured in years. Aquent Gymnasium is at 7 years. The reason is simple: a learning platform is a product, not a project. It evolves with your curriculum, your learners, and your technology stack. Cubite's managed hosting and ongoing support means you're not left maintaining a codebase you didn't build. When Open edX releases a new version, when your SSO provider changes their API, when you need to scale for a training rollout — you have a team that already knows your platform inside out. --- ## Frequently Asked Questions ### What is a custom LMS? A custom LMS is a learning management system built specifically for an organization's unique needs, rather than using off-the-shelf software. Custom LMS platforms support tailored workflows, branded experiences, enterprise integrations, and specialized pedagogy that generic solutions cannot accommodate. You need a custom LMS when your requirements go beyond what Teachable, Thinkific, or even standard Open edX can offer — multi-tenant architectures, headless content delivery via LTI, virtual lab environments, complex authentication flows, or compliance requirements like SOC 2 and FERPA. Organizations building a custom LMS for universities need multi-tenant architecture, LTI integration with existing campus tools, and compliance with FERPA and accessibility standards — requirements that go well beyond what any SaaS LMS offers. If your learning platform is core to your business (not just a nice-to-have), custom development gives you full control over the experience, the data, and the roadmap. ### How long does it take to build a custom LMS? Building a custom LMS typically takes 3–6 months for an MVP and 6–12 months for a full-featured platform. Open edX customization projects can launch in 4–8 weeks for basic deployments. Timeline depends on complexity, integrations, content migration, and compliance requirements. EMPath's emergency migration took 3 days. Aquent Gymnasium's Hawthorn-to-Redwood upgrade was a planned, phased project. The right timeline depends on your situation — Cubite has delivered on both extremes. ### Why choose Open edX for enterprise learning? Open edX powers learning at IBM, Microsoft, and Harvard because it offers enterprise-grade scalability, full source code ownership, and extensible architecture. Organizations choose Open edX when they need multi-tenant deployments, custom integrations, and complete control over their learning data and infrastructure. Every case study on this page runs on Open edX — from Redis University's headless architecture to DHIS2 Academy's custom grading to Starbucks' mobile apps. The platform is proven at scale (IBM's Skills Network serves millions), and its open-source nature means you're never locked into a vendor's roadmap. Cubite's expertise across 13+ years of Open edX development means you get the platform's power without its complexity. ### What should I look for in an LMS development company? Look for proven implementation experience with measurable case study results, platform expertise across Open edX and custom builds, full-cycle support from development through managed hosting, compliance certifications like SOC 2, GDPR, and FERPA, and a long-term partnership approach rather than one-off project delivery. Ask for named clients you can verify. Ask about their longest client relationship (Cubite's is 7 years). Ask what happens after launch — because that's when the real work begins. A development company that disappears after deployment is a liability, not a partner.