A whole training platform, inside your own WordPress.
Course authoring, a learner player, eight question types with server-side grading, SCORM 1.2 and 2004, certificates and gamification — with no SaaS, no per-seat fee, and no data leaving your server.
No credit card required. Cancel any time.
Version 1.4.6 · Requires WordPress 6.2 or newer and PHP 8.0 or newer.
No hosted component, at all
Stedica LMS turns a WordPress install into a full learning management system. Everything runs on your host: your courses, your learners, your grades and your certificates live in your database, and nothing is sent anywhere unless you switch on an optional integration yourself.
Most WordPress LMS plugins are the thin end of a subscription — the plugin is free, and the parts you actually need, like reporting, integrations and live training, are a hosted service you rent with your learner records inside it. Stedica LMS has no hosted component. Uninstall it and the data is still in your database.
Built to be correct, not just featureful
- 01
Your data stays yours
No hosted component and no per-seat fee. Data is never destroyed on uninstall unless you explicitly tick the box, and GDPR export and erasure are wired into WordPress's own Tools screens.
- 02
Security enforced on the server
Hiding a menu item is never treated as access control. Quiz answer keys physically cannot reach the browser — the learner payload is rebuilt field by field from an allow-list, so correct answers, option flags and explanations stay on the server. Grades are clamped server-side.
- 03
Correct under contention
Seats for live sessions are claimed with a conditional update inside a transaction, so twelve people racing for the last two seats get exactly two — not three. Course completion fires its side effects exactly once, so nobody gets two certificates. Both are verified by tests running real concurrent processes against a real database.
- 04
It degrades instead of breaking
No Anthropic API key? Every AI feature switches off cleanly and recommendations fall back to a deterministic ranking. Licence lapsed? Learners keep their enrolments, sessions, skills and certificates, and nobody is shown an upgrade wall they cannot act on.
Three audiences, one install
Learners
A course catalog with self-enrolment, a player that resumes where they left off, drip-released lessons, quizzes, progress tracking, certificates, points, streaks, badges and a leaderboard.
Instructors
A drag-and-drop course builder, a reusable question bank, a grading queue with a visual rubric grid, a weighted gradebook, and per-learner progress.
Administrators
Three roles and eleven capabilities, white-label branding, editable categories and levels, an audit log across 34 action types, GDPR export and erasure, and multisite support.
One version, and the trial includes all of it
Stedica LMS is sold as a single paid level — Business — with a 14-day trial that includes every feature and needs no payment method. Licences differ only by how many sites you may activate on. And a lapsed licence never traps anyone: learners keep access to their own enrolments, sessions, skills and certificates, a seat booked while licensed can still be released, staff can always cancel a session or switch off a webhook, and orders that were already paid still fulfil.
Everything in the box
Grouped by the job it does. Every group is included in every licence.
Course authoring
- Two-level structure — courses hold ordered lessons, lessons hold ordered topics.
- Six working topic types: text, video, audio, document, quiz and SCORM package.
- Drag-and-drop builder with keyboard reordering — focus a handle and use the arrow keys. Moving a topic past the end of a lesson hops it into the next one.
- Immutable published versions: publishing appends a frozen snapshot while the draft you keep editing stays a separate row, so learners always see the published state.
- Drip release per lesson — immediately, N days after that learner's enrolment, or on a fixed date. A locked lesson's topics are stripped from the payload before it leaves the site, and progress writes against it are refused.
- Course-to-course prerequisites, with circular dependencies rejected.
- Bulk enrolment of up to 100 learners per request, reporting every skipped learner with a machine-readable reason rather than a silent partial success.
The learner experience
- Course catalog with search and self-enrolment.
- The player opens at the resume point: the first incomplete topic in an available lesson.
- Video completion rules — require a minimum watched percentage, 90% by default, before a topic can be completed, enforced server-side. Watch position is restored on reload.
- Progress only moves forward. Completion is sticky, and time spent, furthest seek and watched percentage never decrease, so a reload or a tampered payload cannot reduce them.
- Eleven shortcodes and matching blocks — catalog, player, my courses, certificates, leaderboard, achievements, discussions, live sessions, learning paths, skills and membership — all available regardless of licence.
Assessment
- Eight question types: multiple choice, multi-select, true/false, short answer, essay, matching, fill-in-the-blank and ordering.
- Ordering is answered with accessible up/down controls rather than drag-and-drop, so it works on a keyboard and on touch.
- Seven grade automatically; essays always route to a human.
- Partial credit on multi-select, matching, fill-in-the-blank and ordering.
- Randomised bank-backed quizzes — draw N questions from the bank on top of the inline ones. The delivered set is frozen on the attempt, so a reload re-delivers the same questions.
- Attempt limits per course, applied independently to each quiz. Unsubmitted attempts do not count; zero means unlimited.
- Time limits with a 30-second grace period.
- Integrity signals — attempts are flagged for three or more tab switches, exceeding the time limit, or finishing implausibly fast. Signals for a human to review, not proctoring.
- Rubric grading grid with five levels per criterion, and a weighted gradebook with A–F letter grades.
- Item analysis per question, labelling items easy, moderate or hard by the share answering correctly.
Standards and content
- SCORM 1.2 and SCORM 2004 import and runtime. Completion status and score persist and drive topic completion.
- Hardened package import — an archive is rejected whole if any entry escapes the target directory, carries an executable or server-config file, exceeds 5,000 entries, or declares more than 512 MB uncompressed.
- Range-aware media streaming: protected audio and video are served with real 206 Partial Content responses, which is what stops Safari cutting audio off after a minute. Conditional requests answer 304, so a package's few hundred assets are not re-downloaded on every page turn.
- Protected file proxy for SCORM assets, submissions and certificates, with permission derived from the request path — necessary because a package's own sub-resource requests cannot carry a token.
- Fail-closed upload allow-list: 18 extensions for course media, 8 for learner submissions. SVG is excluded from both.
Certificates
- Issued automatically on course completion, exactly once.
- Unique numbering in the form STD-2026-A1B2C3D4, regenerated on collision.
- Optional expiry in months, configurable per site.
- Revocation is recorded rather than deleted.
- A verification endpoint so a third party can check a certificate number.
- Rendering is queued out of band, so generating a certificate never blocks the request that completed the course.
- The template is theme-overridable.
Engagement
- Points across six events — enrolling, completing a topic, completing a course, passing a quiz, attending a session and maintaining a streak — with configurable values.
- Streaks, levels, badges and a leaderboard, each with its own shortcode and block.
- Discussions per course, with instructor answers marked, upvotes and thread locking.
- Transactional email for enrolment, course completion, certificate availability, session registration and waitlist promotion — with distinct copy for self-enrolment versus being assigned by a named colleague, and all sent out of band so a slow mail server never stalls an enrolment.
Administration, security and compliance
- Three roles — Learner, Instructor, Admin — built from eleven capabilities. Tier is resolved from capabilities rather than role slugs, so a site that grafts LMS capabilities onto its own custom roles still works.
- Audit log across 34 action types, with its own admin screen and a configurable retention period.
- GDPR exporter and eraser registered with WordPress's own Tools screens. IP addresses can be stored in full, anonymised, or not at all. Certificates and audit entries are anonymised rather than deleted, because they are attestations.
- Secrets encrypted at rest when PHP's OpenSSL extension is available, and masked in every API response regardless.
- White-label branding — logo, primary and accent colours, font stack and certificate styling, pushed to the front end as CSS custom properties.
- Multisite aware: a network activation installs into every site, and sites created afterwards are installed on creation.
- Fully translatable — 535 strings across PHP and JavaScript, with a .pot template included.
AI features
- Requires your own Anthropic API key; every one of these degrades cleanly without it.
- Course tutor — a streaming assistant scoped to the course the learner is in.
- Study guides and flashcards generated from course content.
- Essay grading suggestions for the grader to accept, edit or ignore. The learner's name is substituted out before the text is sent and restored in the returned feedback, so nothing identifying them leaves the site.
- Quiz generation into the question bank, 1–25 questions per call.
- Adaptive course recommendations, falling back to a deterministic ranking when the learner has no history or no key is set.
- At-risk interpretation in plain language.
Instructor-led training
- Sessions with capacity, waitlists and automatic promotion when a seat is released.
- Seat claiming is transactionally correct under contention — verified with twelve concurrent processes racing for two seats, and again with one learner double-clicking eight times.
- Attendance marking, roster export and per-session registration emails.
- Online, in-person and hybrid session types with timezone-correct notifications.
Structure and reporting
- Learning paths — ordered sequences of courses with their own progress.
- Competency frameworks — define a skill as "all of" or "any of" a set of courses; learners see their mastery, admins see population-wide coverage.
- Analytics — catalog totals, instructor headcount computed by capability, enrolment and completion counts.
- At-risk detection — a deterministic 0–100 score from six signals with nine factor codes. No model call and no black box: the same inputs always produce the same score.
- CSV export of enrolments, progress and grades.
- HMAC-signed outbound webhooks on any of the 34 audited events, with exact, prefix or wildcard matching, an SSRF guard that rejects private and reserved addresses, a delivery log and retries.
- Sell courses through WooCommerce — map a product to a course; enrolment is granted on order completion and revoked on refund, with entitlement always checked server-side.
What is not included yet
Published deliberately, so nobody discovers it on day two.
- LTI 1.1 and 1.3 and xAPI have database tables and settings but no protocol implementation — there is no launch, no grade passback and no LRS forwarding.
- H5P is an embed slot rather than a bundled runtime.
- Direct Stripe checkout is not implemented; selling runs through WooCommerce.
- SCORM bookmarking is not persisted. Completion and score carry across sessions, but the package's internal suspend data does not, so a partially-completed SCO restarts.
- One launchable SCO per package. SCORM 2004 sequencing and navigation are not implemented.
- PDF certificates require dompdf, which is not bundled. Without it, certificates render as HTML.
- YouTube and Vimeo topics have no watch tracking — they render as a plain iframe. Watch enforcement applies to self-hosted HTML5 video.
- No PWA and no offline mode.
- Translations: the .pot template ships, individual locales do not.
What it needs to run
| WordPress | 6.2 or newer |
|---|---|
| PHP | 8.0 or newer |
| Database | MySQL 5.7+ or MariaDB 10.3+ |
| PHP extensions | mysqli; zip for SCORM import; openssl recommended, for secret encryption |
| External services | None required |
Optional: WooCommerce for selling courses, an Anthropic API key for AI features, and Action Scheduler for background jobs — WP-Cron is used automatically if it is absent.
Simple, honest pricing
| 1 site | 3 sites | 5 sitesBest value | 10 sites | |
|---|---|---|---|---|
| Monthly | $9.90/mo | $16.99/mo | $24.99/mo | $43.99/mo |
| Yearly | $95.88/yrSave 19% | $167.88/yrSave 18% | $239.88/yrSave 20% | $419.88/yrSave 20% |
| Lifetime | $289.99one-time | $509.99one-time | $719.99one-time | $1,259.99one-time |
No credit card required. Cancel any time.
All prices in US dollars. Each plugin and add-on is licensed separately. Every plan includes the complete feature set, automatic updates and support — plans differ only by how many sites you license.
Questions, answered
Is there a free version?
No. Stedica LMS is sold as one paid level, Business, and every licence includes the complete feature set — courses, SCORM, certificates and gamification alongside the AI features, live sessions, learning paths, competency frameworks, WooCommerce selling, webhooks and analytics. The 14-day trial is how you try it: no payment method, no automatic conversion, and every feature available throughout.
What happens if my licence lapses?
Nobody gets trapped, and nobody is locked out of work they already did. Learners keep access to their own enrolments, sessions, skills and certificates. A seat booked while licensed can still be released, staff can always cancel a session or switch off a webhook, and orders that were already paid still fulfil.
Does it send my learner data anywhere?
Not unless you switch on an optional integration yourself. There is no hosted component: courses, learners, grades and certificates live in your own database. The AI features are the only outbound path, they need your own Anthropic API key, and a learner's name is substituted out of essay text before it is sent.
How complete is the SCORM support?
Import and runtime for both 1.2 and 2004, with completion status and score persisting and driving topic completion. Two honest limits: internal suspend data is not persisted, so a partially-completed SCO restarts, and only one launchable SCO per package is supported — 2004 sequencing and navigation are not implemented.
Can I sell courses?
Through WooCommerce, on the Pro plan. Map a product to a course and enrolment is granted on order completion and revoked on refund, with entitlement always checked server-side. Direct Stripe checkout is not implemented.
Do I need a credit card for the trial?
No. The 14-day trial includes every feature and needs no payment method. It does not convert automatically — if you do nothing it simply expires.
Start with the plugin you need most
Fourteen days, every feature, no card. See what it finds on your own site.
No credit card required. Cancel any time.