diff --git a/mod/hotpot/attempt.php b/mod/hotpot/attempt.php
index a853ecb39f2..383be8ab2e2 100644
--- a/mod/hotpot/attempt.php
+++ b/mod/hotpot/attempt.php
@@ -27,6 +27,11 @@
     $next_url = "$CFG->wwwroot/course/view.php?id=$course->id";
     $time = time();
 
+    // check user can access this hotpot activity
+    if (!hotpot_is_visible($cm)) {
+        error(get_string("activityiscurrentlyhidden"), $next_url);
+    }
+
     // update attempt record fields using incoming data
     $attempt->score = optional_param('mark', NULL, PARAM_INT);
     $attempt->status = optional_param('status', NULL, PARAM_INT);
diff --git a/mod/hotpot/lib.php b/mod/hotpot/lib.php
index d669b1ad8c2..3afffb7dba5 100644
--- a/mod/hotpot/lib.php
+++ b/mod/hotpot/lib.php
@@ -431,15 +431,27 @@ function hotpot_get_chain(&$cm) {
 
     return $found ? $chain : false;
 }
+
 function hotpot_is_visible(&$cm) {
-    if (!isset($cm->sectionvisible)) {
-        if ($section = get_record('course_sections', 'id', $cm->section)) {
-            $cm->sectionvisible = $section->visible;
-        } else {
-            error('Course module record contains invalid section');
-        }
+    global $CFG, $COURSE;
+
+    // check if user can view hidden activities
+    if (isset($COURSE->context)) {
+        $coursecontext = &$COURSE->context;
+    } else {
+        $coursecontext = get_context_instance(CONTEXT_COURSE, $cm->course);
+    }
+    if (has_capability('moodle/course:viewhiddenactivities', $coursecontext)) {
+        return true; // user can view hidden activities
     }
 
+    if (!isset($cm->sectionvisible)) {
+        if (! $section = get_record('course_sections', 'id', $cm->section)) {
+            error('Course module record contains invalid section');
+        }
+        $cm->sectionvisible = $section->visible;
+    }
+ 
     if (empty($cm->sectionvisible)) {
         $visible = HOTPOT_NO;
     } else {
diff --git a/mod/hotpot/report.php b/mod/hotpot/report.php
index fddfa500a32..20e6ba994f0 100644
--- a/mod/hotpot/report.php
+++ b/mod/hotpot/report.php
@@ -40,6 +40,11 @@
 
     require_login($course->id);
 
+    // check user can access this hotpot activity
+    if (!hotpot_is_visible($cm)) {
+        error(get_string("activityiscurrentlyhidden"));
+    }
+
     // get report mode
     if (has_capability('mod/hotpot:viewreport',$modulecontext)) {
         $mode = optional_param('mode', 'overview', PARAM_ALPHA);
diff --git a/mod/hotpot/review.php b/mod/hotpot/review.php
index d0f7f39878e..0e2e5bc03ad 100644
--- a/mod/hotpot/review.php
+++ b/mod/hotpot/review.php
@@ -34,6 +34,12 @@
     
     $context = get_context_instance(CONTEXT_MODULE, $cm->id);
     require_login($course->id);
+
+    // check user can access this hotpot activity
+    if (!hotpot_is_visible($cm)) {
+        error(get_string("activityiscurrentlyhidden"));
+    }
+
     if (!has_capability('mod/hotpot:viewreport',$context)) {
         if (!$hotpot->review) {
             error(get_string("noreview", "quiz"));