diff --git a/certbot/_internal/client.py b/certbot/_internal/client.py
index 88a90aa32..37d61a7a4 100644
--- a/certbot/_internal/client.py
+++ b/certbot/_internal/client.py
@@ -32,7 +32,7 @@ from certbot import util
 from certbot.compat import os
 from certbot._internal.display import enhancements
 from certbot.display import ops as display_ops
-from certbot.plugins import selection as plugin_selection
+from certbot._internal.plugins import selection as plugin_selection
 
 logger = logging.getLogger(__name__)
 
diff --git a/certbot/_internal/main.py b/certbot/_internal/main.py
index a86436557..de68e8553 100644
--- a/certbot/_internal/main.py
+++ b/certbot/_internal/main.py
@@ -35,9 +35,9 @@ from certbot.compat import filesystem
 from certbot.compat import misc
 from certbot.compat import os
 from certbot.display import util as display_util, ops as display_ops
-from certbot.plugins import disco as plugins_disco
+from certbot._internal.plugins import disco as plugins_disco
 from certbot.plugins import enhancements
-from certbot.plugins import selection as plug_sel
+from certbot._internal.plugins import selection as plug_sel
 
 USER_CANCELLED = ("User chose to cancel the operation and may "
                   "reinvoke the client.")
diff --git a/certbot/_internal/plugins/__init__.py b/certbot/_internal/plugins/__init__.py
new file mode 100644
index 000000000..7831eab61
--- /dev/null
+++ b/certbot/_internal/plugins/__init__.py
@@ -0,0 +1 @@
+"""Certbot plugins."""
diff --git a/certbot/plugins/disco.py b/certbot/_internal/plugins/disco.py
similarity index 100%
rename from certbot/plugins/disco.py
rename to certbot/_internal/plugins/disco.py
diff --git a/certbot/plugins/manual.py b/certbot/_internal/plugins/manual.py
similarity index 100%
rename from certbot/plugins/manual.py
rename to certbot/_internal/plugins/manual.py
diff --git a/certbot/plugins/null.py b/certbot/_internal/plugins/null.py
similarity index 100%
rename from certbot/plugins/null.py
rename to certbot/_internal/plugins/null.py
diff --git a/certbot/plugins/selection.py b/certbot/_internal/plugins/selection.py
similarity index 99%
rename from certbot/plugins/selection.py
rename to certbot/_internal/plugins/selection.py
index 39a6b01fc..ae3d8448b 100644
--- a/certbot/plugins/selection.py
+++ b/certbot/_internal/plugins/selection.py
@@ -43,7 +43,7 @@ def get_unprepared_installer(config, plugins):
     Get an unprepared interfaces.IInstaller object.
 
     :param certbot.interfaces.IConfig config: Configuration
-    :param certbot.plugins.disco.PluginsRegistry plugins:
+    :param certbot._internal.plugins.disco.PluginsRegistry plugins:
         All plugins registered as entry points.
 
     :returns: Unprepared installer plugin or None
@@ -73,7 +73,7 @@ def pick_plugin(config, default, plugins, question, ifaces):
 
     :param certbot.interfaces.IConfig: Configuration
     :param str default: Plugin name supplied by user or ``None``.
-    :param certbot.plugins.disco.PluginsRegistry plugins:
+    :param certbot._internal.plugins.disco.PluginsRegistry plugins:
         All plugins registered as entry points.
     :param str question: Question to be presented to the user in case
         multiple candidates are found.
diff --git a/certbot/plugins/standalone.py b/certbot/_internal/plugins/standalone.py
similarity index 100%
rename from certbot/plugins/standalone.py
rename to certbot/_internal/plugins/standalone.py
diff --git a/certbot/plugins/webroot.py b/certbot/_internal/plugins/webroot.py
similarity index 100%
rename from certbot/plugins/webroot.py
rename to certbot/_internal/plugins/webroot.py
diff --git a/certbot/_internal/renewal.py b/certbot/_internal/renewal.py
index c11e675c1..31833c806 100644
--- a/certbot/_internal/renewal.py
+++ b/certbot/_internal/renewal.py
@@ -24,7 +24,7 @@ from certbot._internal import storage
 from certbot._internal import updater
 from certbot import util
 from certbot.compat import os
-from certbot.plugins import disco as plugins_disco
+from certbot._internal.plugins import disco as plugins_disco
 
 logger = logging.getLogger(__name__)
 
diff --git a/certbot/_internal/storage.py b/certbot/_internal/storage.py
index f19efe728..9684cc195 100644
--- a/certbot/_internal/storage.py
+++ b/certbot/_internal/storage.py
@@ -21,7 +21,7 @@ from certbot import util
 from certbot.compat import os
 from certbot.compat import filesystem
 from certbot.plugins import common as plugins_common
-from certbot.plugins import disco as plugins_disco
+from certbot._internal.plugins import disco as plugins_disco
 
 logger = logging.getLogger(__name__)
 
diff --git a/certbot/_internal/updater.py b/certbot/_internal/updater.py
index 58df6fcb4..50db0e21c 100644
--- a/certbot/_internal/updater.py
+++ b/certbot/_internal/updater.py
@@ -4,7 +4,7 @@ import logging
 from certbot import errors
 from certbot import interfaces
 
-from certbot.plugins import selection as plug_sel
+from certbot._internal.plugins import selection as plug_sel
 import certbot.plugins.enhancements as enhancements
 
 logger = logging.getLogger(__name__)
diff --git a/certbot/cli.py b/certbot/cli.py
index 7f09f4638..103347735 100644
--- a/certbot/cli.py
+++ b/certbot/cli.py
@@ -21,7 +21,7 @@ from acme.magic_typing import Any, Dict, Optional
 
 import certbot
 import certbot.plugins.enhancements as enhancements
-import certbot.plugins.selection as plugin_selection
+import certbot._internal.plugins.selection as plugin_selection
 from certbot import constants
 from certbot import crypto_util
 from certbot import errors
@@ -30,7 +30,7 @@ from certbot import interfaces
 from certbot import util
 from certbot.compat import os
 from certbot.display import util as display_util
-from certbot.plugins import disco as plugins_disco
+from certbot._internal.plugins import disco as plugins_disco
 
 logger = logging.getLogger(__name__)
 
diff --git a/certbot/plugins/__init__.py b/certbot/plugins/__init__.py
index 7b1aca2b4..7831eab61 100644
--- a/certbot/plugins/__init__.py
+++ b/certbot/plugins/__init__.py
@@ -1 +1 @@
-"""Certbot client.plugins."""
+"""Certbot plugins."""
diff --git a/certbot/plugins/disco_test.py b/certbot/plugins/disco_test.py
index 720b90b16..f739512f0 100644
--- a/certbot/plugins/disco_test.py
+++ b/certbot/plugins/disco_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.plugins.disco."""
+"""Tests for certbot._internal.plugins.disco."""
 import functools
 import string
 import unittest
@@ -12,21 +12,21 @@ from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-
 from certbot import errors
 from certbot import interfaces
 
-from certbot.plugins import standalone
-from certbot.plugins import webroot
+from certbot._internal.plugins import standalone
+from certbot._internal.plugins import webroot
 
 EP_SA = pkg_resources.EntryPoint(
-    "sa", "certbot.plugins.standalone",
+    "sa", "certbot._internal.plugins.standalone",
     attrs=("Authenticator",),
     dist=mock.MagicMock(key="certbot"))
 EP_WR = pkg_resources.EntryPoint(
-    "wr", "certbot.plugins.webroot",
+    "wr", "certbot._internal.plugins.webroot",
     attrs=("Authenticator",),
     dist=mock.MagicMock(key="certbot"))
 
 
 class PluginEntryPointTest(unittest.TestCase):
-    """Tests for certbot.plugins.disco.PluginEntryPoint."""
+    """Tests for certbot._internal.plugins.disco.PluginEntryPoint."""
 
     def setUp(self):
         self.ep1 = pkg_resources.EntryPoint(
@@ -40,11 +40,11 @@ class PluginEntryPointTest(unittest.TestCase):
         self.ep3 = pkg_resources.EntryPoint(
             "ep3", "a.ep3", dist=mock.MagicMock(key="p3"))
 
-        from certbot.plugins.disco import PluginEntryPoint
+        from certbot._internal.plugins.disco import PluginEntryPoint
         self.plugin_ep = PluginEntryPoint(EP_SA)
 
     def test_entry_point_to_plugin_name(self):
-        from certbot.plugins.disco import PluginEntryPoint
+        from certbot._internal.plugins.disco import PluginEntryPoint
 
         names = {
             self.ep1: "p1:ep1",
@@ -119,7 +119,7 @@ class PluginEntryPointTest(unittest.TestCase):
         self.plugin_ep._initialized = plugin = mock.MagicMock()
 
         exceptions = zope.interface.exceptions
-        with mock.patch("certbot.plugins."
+        with mock.patch("certbot._internal.plugins."
                         "disco.zope.interface") as mock_zope:
             mock_zope.exceptions = exceptions
 
@@ -183,11 +183,11 @@ class PluginEntryPointTest(unittest.TestCase):
 
 
 class PluginsRegistryTest(unittest.TestCase):
-    """Tests for certbot.plugins.disco.PluginsRegistry."""
+    """Tests for certbot._internal.plugins.disco.PluginsRegistry."""
 
     @classmethod
     def _create_new_registry(cls, plugins):
-        from certbot.plugins.disco import PluginsRegistry
+        from certbot._internal.plugins.disco import PluginsRegistry
         return PluginsRegistry(plugins)
 
     def setUp(self):
@@ -198,8 +198,8 @@ class PluginsRegistryTest(unittest.TestCase):
         self.reg = self._create_new_registry(self.plugins)
 
     def test_find_all(self):
-        from certbot.plugins.disco import PluginsRegistry
-        with mock.patch("certbot.plugins.disco.pkg_resources") as mock_pkg:
+        from certbot._internal.plugins.disco import PluginsRegistry
+        with mock.patch("certbot._internal.plugins.disco.pkg_resources") as mock_pkg:
             mock_pkg.iter_entry_points.side_effect = [iter([EP_SA]),
                                                       iter([EP_WR])]
             plugins = PluginsRegistry.find_all()
diff --git a/certbot/plugins/enhancements_test.py b/certbot/plugins/enhancements_test.py
index 22f6f54e9..86482184e 100644
--- a/certbot/plugins/enhancements_test.py
+++ b/certbot/plugins/enhancements_test.py
@@ -3,7 +3,7 @@ import unittest
 import mock
 
 from certbot.plugins import enhancements
-from certbot.plugins import null
+from certbot._internal.plugins import null
 
 import certbot.tests.util as test_util
 
diff --git a/certbot/plugins/manual_test.py b/certbot/plugins/manual_test.py
index 16d240316..8796c30f1 100644
--- a/certbot/plugins/manual_test.py
+++ b/certbot/plugins/manual_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.plugins.manual"""
+"""Tests for certbot._internal.plugins.manual"""
 import unittest
 import sys
 
@@ -15,7 +15,7 @@ from certbot.tests import util as test_util
 
 
 class AuthenticatorTest(test_util.TempDirTestCase):
-    """Tests for certbot.plugins.manual.Authenticator."""
+    """Tests for certbot._internal.plugins.manual.Authenticator."""
 
     def setUp(self):
         super(AuthenticatorTest, self).setUp()
@@ -39,7 +39,7 @@ class AuthenticatorTest(test_util.TempDirTestCase):
                                         self.tempdir, "temp_checkpoint_dir"),
             in_progress_dir=os.path.join(self.tempdir, "in_progess"))
 
-        from certbot.plugins.manual import Authenticator
+        from certbot._internal.plugins.manual import Authenticator
         self.auth = Authenticator(self.config, name='manual')
 
     def test_prepare_no_hook_noninteractive(self):
diff --git a/certbot/plugins/null_test.py b/certbot/plugins/null_test.py
index d5de33fb3..41cd45a93 100644
--- a/certbot/plugins/null_test.py
+++ b/certbot/plugins/null_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.plugins.null."""
+"""Tests for certbot._internal.plugins.null."""
 import unittest
 import six
 
@@ -6,10 +6,10 @@ import mock
 
 
 class InstallerTest(unittest.TestCase):
-    """Tests for certbot.plugins.null.Installer."""
+    """Tests for certbot._internal.plugins.null.Installer."""
 
     def setUp(self):
-        from certbot.plugins.null import Installer
+        from certbot._internal.plugins.null import Installer
         self.installer = Installer(config=mock.MagicMock(), name="null")
 
     def test_it(self):
diff --git a/certbot/plugins/selection_test.py b/certbot/plugins/selection_test.py
index a2a171c1d..9de7f7941 100644
--- a/certbot/plugins/selection_test.py
+++ b/certbot/plugins/selection_test.py
@@ -11,40 +11,40 @@ from certbot import errors
 from certbot import interfaces
 from certbot.compat import os
 from certbot.display import util as display_util
-from certbot.plugins.disco import PluginsRegistry
+from certbot._internal.plugins.disco import PluginsRegistry
 from certbot.tests import util as test_util
 
 
 class ConveniencePickPluginTest(unittest.TestCase):
-    """Tests for certbot.plugins.selection.pick_*."""
+    """Tests for certbot._internal.plugins.selection.pick_*."""
 
     def _test(self, fun, ifaces):
         config = mock.Mock()
         default = mock.Mock()
         plugins = mock.Mock()
 
-        with mock.patch("certbot.plugins.selection.pick_plugin") as mock_p:
+        with mock.patch("certbot._internal.plugins.selection.pick_plugin") as mock_p:
             mock_p.return_value = "foo"
             self.assertEqual("foo", fun(config, default, plugins, "Question?"))
         mock_p.assert_called_once_with(
             config, default, plugins, "Question?", ifaces)
 
     def test_authenticator(self):
-        from certbot.plugins.selection import pick_authenticator
+        from certbot._internal.plugins.selection import pick_authenticator
         self._test(pick_authenticator, (interfaces.IAuthenticator,))
 
     def test_installer(self):
-        from certbot.plugins.selection import pick_installer
+        from certbot._internal.plugins.selection import pick_installer
         self._test(pick_installer, (interfaces.IInstaller,))
 
     def test_configurator(self):
-        from certbot.plugins.selection import pick_configurator
+        from certbot._internal.plugins.selection import pick_configurator
         self._test(pick_configurator,
             (interfaces.IAuthenticator, interfaces.IInstaller))
 
 
 class PickPluginTest(unittest.TestCase):
-    """Tests for certbot.plugins.selection.pick_plugin."""
+    """Tests for certbot._internal.plugins.selection.pick_plugin."""
 
     def setUp(self):
         self.config = mock.Mock(noninteractive_mode=False)
@@ -54,7 +54,7 @@ class PickPluginTest(unittest.TestCase):
         self.ifaces = []  # type: List[interfaces.IPlugin]
 
     def _call(self):
-        from certbot.plugins.selection import pick_plugin
+        from certbot._internal.plugins.selection import pick_plugin
         return pick_plugin(self.config, self.default, self.reg,
                            self.question, self.ifaces)
 
@@ -95,7 +95,7 @@ class PickPluginTest(unittest.TestCase):
             "bar": plugin_ep,
             "baz": plugin_ep,
         }
-        with mock.patch("certbot.plugins.selection.choose_plugin") as mock_choose:
+        with mock.patch("certbot._internal.plugins.selection.choose_plugin") as mock_choose:
             mock_choose.return_value = plugin_ep
             self.assertEqual("foo", self._call())
         mock_choose.assert_called_once_with(
@@ -107,13 +107,13 @@ class PickPluginTest(unittest.TestCase):
             "baz": None,
         }
 
-        with mock.patch("certbot.plugins.selection.choose_plugin") as mock_choose:
+        with mock.patch("certbot._internal.plugins.selection.choose_plugin") as mock_choose:
             mock_choose.return_value = None
             self.assertTrue(self._call() is None)
 
 
 class ChoosePluginTest(unittest.TestCase):
-    """Tests for certbot.plugins.selection.choose_plugin."""
+    """Tests for certbot._internal.plugins.selection.choose_plugin."""
 
     def setUp(self):
         zope.component.provideUtility(display_util.FileDisplay(sys.stdout,
@@ -130,17 +130,17 @@ class ChoosePluginTest(unittest.TestCase):
         ]
 
     def _call(self):
-        from certbot.plugins.selection import choose_plugin
+        from certbot._internal.plugins.selection import choose_plugin
         return choose_plugin(self.plugins, "Question?")
 
-    @test_util.patch_get_utility("certbot.plugins.selection.z_util")
+    @test_util.patch_get_utility("certbot._internal.plugins.selection.z_util")
     def test_selection(self, mock_util):
         mock_util().menu.side_effect = [(display_util.OK, 0),
                                         (display_util.OK, 1)]
         self.assertEqual(self.mock_stand, self._call())
         self.assertEqual(mock_util().notification.call_count, 1)
 
-    @test_util.patch_get_utility("certbot.plugins.selection.z_util")
+    @test_util.patch_get_utility("certbot._internal.plugins.selection.z_util")
     def test_more_info(self, mock_util):
         mock_util().menu.side_effect = [
             (display_util.OK, 1),
@@ -148,12 +148,12 @@ class ChoosePluginTest(unittest.TestCase):
 
         self.assertEqual(self.mock_stand, self._call())
 
-    @test_util.patch_get_utility("certbot.plugins.selection.z_util")
+    @test_util.patch_get_utility("certbot._internal.plugins.selection.z_util")
     def test_no_choice(self, mock_util):
         mock_util().menu.return_value = (display_util.CANCEL, 0)
         self.assertTrue(self._call() is None)
 
-    @test_util.patch_get_utility("certbot.plugins.selection.z_util")
+    @test_util.patch_get_utility("certbot._internal.plugins.selection.z_util")
     def test_new_interaction_avoidance(self, mock_util):
         mock_nginx = mock.Mock(
             description_with_name="n", misconfigured=False)
@@ -174,7 +174,7 @@ class ChoosePluginTest(unittest.TestCase):
         self.assertTrue("default" in mock_util().menu.call_args[1])
 
 class GetUnpreparedInstallerTest(test_util.ConfigTestCase):
-    """Tests for certbot.plugins.selection.get_unprepared_installer."""
+    """Tests for certbot._internal.plugins.selection.get_unprepared_installer."""
 
     def setUp(self):
         super(GetUnpreparedInstallerTest, self).setUp()
@@ -192,7 +192,7 @@ class GetUnpreparedInstallerTest(test_util.ConfigTestCase):
         })
 
     def _call(self):
-        from certbot.plugins.selection import get_unprepared_installer
+        from certbot._internal.plugins.selection import get_unprepared_installer
         return get_unprepared_installer(self.config, self.plugins)
 
     def test_no_installer_defined(self):
diff --git a/certbot/plugins/standalone_test.py b/certbot/plugins/standalone_test.py
index e3e0c1f10..c9dabb8b4 100644
--- a/certbot/plugins/standalone_test.py
+++ b/certbot/plugins/standalone_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.plugins.standalone."""
+"""Tests for certbot._internal.plugins.standalone."""
 import socket
 # https://github.com/python/typeshed/blob/master/stdlib/2and3/socket.pyi
 from socket import errno as socket_errors  # type: ignore
@@ -22,10 +22,10 @@ from certbot.tests import util as test_util
 
 
 class ServerManagerTest(unittest.TestCase):
-    """Tests for certbot.plugins.standalone.ServerManager."""
+    """Tests for certbot._internal.plugins.standalone.ServerManager."""
 
     def setUp(self):
-        from certbot.plugins.standalone import ServerManager
+        from certbot._internal.plugins.standalone import ServerManager
         self.certs = {}  # type: Dict[bytes, Tuple[OpenSSL.crypto.PKey, OpenSSL.crypto.X509]]
         self.http_01_resources = {} \
         # type: Set[acme_standalone.HTTP01RequestHandler.HTTP01Resource]
@@ -82,10 +82,10 @@ def get_open_port():
 
 
 class AuthenticatorTest(unittest.TestCase):
-    """Tests for certbot.plugins.standalone.Authenticator."""
+    """Tests for certbot._internal.plugins.standalone.Authenticator."""
 
     def setUp(self):
-        from certbot.plugins.standalone import Authenticator
+        from certbot._internal.plugins.standalone import Authenticator
 
         self.config = mock.MagicMock(http01_port=get_open_port())
         self.auth = Authenticator(self.config, name="standalone")
diff --git a/certbot/plugins/webroot_test.py b/certbot/plugins/webroot_test.py
index d1aea5817..70501f812 100644
--- a/certbot/plugins/webroot_test.py
+++ b/certbot/plugins/webroot_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.plugins.webroot."""
+"""Tests for certbot._internal.plugins.webroot."""
 
 from __future__ import print_function
 
@@ -27,13 +27,13 @@ KEY = jose.JWKRSA.load(test_util.load_vector("rsa512_key.pem"))
 
 
 class AuthenticatorTest(unittest.TestCase):
-    """Tests for certbot.plugins.webroot.Authenticator."""
+    """Tests for certbot._internal.plugins.webroot.Authenticator."""
 
     achall = achallenges.KeyAuthorizationAnnotatedChallenge(
         challb=acme_util.HTTP01_P, domain="thing.com", account_key=KEY)
 
     def setUp(self):
-        from certbot.plugins.webroot import Authenticator
+        from certbot._internal.plugins.webroot import Authenticator
         # On Linux directories created by tempfile.mkdtemp inherit their permissions from their
         # parent directory. So the actual permissions are inconsistent over various tests env.
         # To circumvent this, a dedicated sub-workspace is created under the workspace, using
@@ -147,7 +147,7 @@ class AuthenticatorTest(unittest.TestCase):
             self.assertRaises(errors.PluginError, self.auth.perform, [])
         filesystem.chmod(self.path, 0o700)
 
-    @mock.patch("certbot.plugins.webroot.filesystem.copy_ownership_and_apply_mode")
+    @mock.patch("certbot._internal.plugins.webroot.filesystem.copy_ownership_and_apply_mode")
     def test_failed_chown(self, mock_ownership):
         mock_ownership.side_effect = OSError(errno.EACCES, "msg")
         self.auth.perform([self.achall])  # exception caught and logged
@@ -262,7 +262,7 @@ class WebrootActionTest(unittest.TestCase):
         challb=acme_util.HTTP01_P, domain="thing.com", account_key=KEY)
 
     def setUp(self):
-        from certbot.plugins.webroot import Authenticator
+        from certbot._internal.plugins.webroot import Authenticator
         self.path = tempfile.mkdtemp()
         self.parser = argparse.ArgumentParser()
         self.parser.add_argument("-d", "--domains",
@@ -308,7 +308,7 @@ class WebrootActionTest(unittest.TestCase):
         self.assertEqual(args.webroot_path, [self.path, other_webroot_path])
 
     def _get_config_after_perform(self, config):
-        from certbot.plugins.webroot import Authenticator
+        from certbot._internal.plugins.webroot import Authenticator
         auth = Authenticator(config, "webroot")
         auth.perform([self.achall])
         return auth.config
diff --git a/certbot/tests/cli_test.py b/certbot/tests/cli_test.py
index a2491f153..0adf33921 100644
--- a/certbot/tests/cli_test.py
+++ b/certbot/tests/cli_test.py
@@ -16,7 +16,7 @@ from certbot import constants
 from certbot import errors
 from certbot.compat import os
 from certbot.compat import filesystem
-from certbot.plugins import disco
+from certbot._internal.plugins import disco
 from certbot.tests.util import TempDirTestCase
 
 PLUGINS = disco.PluginsRegistry.find_all()
diff --git a/certbot/tests/main_test.py b/certbot/tests/main_test.py
index 1cad43823..177790028 100644
--- a/certbot/tests/main_test.py
+++ b/certbot/tests/main_test.py
@@ -33,10 +33,10 @@ from certbot._internal import updater
 from certbot import util
 from certbot.compat import os
 from certbot.compat import filesystem
-from certbot.plugins import disco
+from certbot._internal.plugins import disco
 from certbot.plugins import enhancements
-from certbot.plugins import manual
-from certbot.plugins import null
+from certbot._internal.plugins import manual
+from certbot._internal.plugins import null
 
 CERT_PATH = test_util.vector_path('cert_512.pem')
 CERT = test_util.vector_path('cert_512.pem')
@@ -1220,7 +1220,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         self._test_renew_common(renewalparams=renewalparams, error_expected=True,
                                 names=names, assert_oc_called=False)
 
-    @mock.patch('certbot.plugins.selection.choose_configurator_plugins')
+    @mock.patch('certbot._internal.plugins.selection.choose_configurator_plugins')
     def test_renew_with_configurator(self, mock_sel):
         mock_sel.return_value = (mock.MagicMock(), mock.MagicMock())
         renewalparams = {'authenticator': 'webroot'}
@@ -1493,7 +1493,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
                             email in mock_utility().add_message.call_args[0][0])
                         self.assertTrue(mock_handle.called)
 
-    @mock.patch('certbot.plugins.selection.choose_configurator_plugins')
+    @mock.patch('certbot._internal.plugins.selection.choose_configurator_plugins')
     @mock.patch('certbot._internal.updater._run_updaters')
     def test_plugin_selection_error(self, mock_run, mock_choose):
         mock_choose.side_effect = errors.PluginSelectionError
diff --git a/certbot/tests/renewal_test.py b/certbot/tests/renewal_test.py
index 162146d7e..612a5fcb2 100644
--- a/certbot/tests/renewal_test.py
+++ b/certbot/tests/renewal_test.py
@@ -31,7 +31,8 @@ class RenewalTest(test_util.ConfigTestCase):
     @mock.patch('certbot._internal.renewal.cli.set_by_cli')
     def test_webroot_params_conservation(self, mock_set_by_cli):
         # For more details about why this test is important, see:
-        # certbot.plugins.webroot_test::WebrootActionTest::test_webroot_map_partial_without_perform
+        # certbot._internal.plugins.webroot_test::
+        #   WebrootActionTest::test_webroot_map_partial_without_perform
         from certbot._internal import renewal
         mock_set_by_cli.return_value = False
 
diff --git a/certbot/tests/renewupdater_test.py b/certbot/tests/renewupdater_test.py
index 9ac55a48d..42b723c94 100644
--- a/certbot/tests/renewupdater_test.py
+++ b/certbot/tests/renewupdater_test.py
@@ -22,8 +22,8 @@ class RenewUpdaterTest(test_util.ConfigTestCase):
         self.mockinstaller = mock.MagicMock(spec=enhancements.AutoHSTSEnhancement)
 
     @mock.patch('certbot._internal.main._get_and_save_cert')
-    @mock.patch('certbot.plugins.selection.choose_configurator_plugins')
-    @mock.patch('certbot.plugins.selection.get_unprepared_installer')
+    @mock.patch('certbot._internal.plugins.selection.choose_configurator_plugins')
+    @mock.patch('certbot._internal.plugins.selection.get_unprepared_installer')
     @test_util.patch_get_utility()
     def test_server_updates(self, _, mock_geti, mock_select, mock_getsave):
         mock_getsave.return_value = mock.MagicMock()
@@ -64,7 +64,7 @@ class RenewUpdaterTest(test_util.ConfigTestCase):
         self.assertEqual(mock_log.call_args[0][0],
                           "Skipping renewal deployer in dry-run mode.")
 
-    @mock.patch('certbot.plugins.selection.get_unprepared_installer')
+    @mock.patch('certbot._internal.plugins.selection.get_unprepared_installer')
     def test_enhancement_updates(self, mock_geti):
         mock_geti.return_value = self.mockinstaller
         updater.run_generic_updaters(self.config, mock.MagicMock(), None)
@@ -76,7 +76,7 @@ class RenewUpdaterTest(test_util.ConfigTestCase):
                                      self.mockinstaller)
         self.assertTrue(self.mockinstaller.deploy_autohsts.called)
 
-    @mock.patch('certbot.plugins.selection.get_unprepared_installer')
+    @mock.patch('certbot._internal.plugins.selection.get_unprepared_installer')
     def test_enhancement_updates_not_called(self, mock_geti):
         self.config.disable_renew_updates = True
         mock_geti.return_value = self.mockinstaller
@@ -89,7 +89,7 @@ class RenewUpdaterTest(test_util.ConfigTestCase):
                                      self.mockinstaller)
         self.assertFalse(self.mockinstaller.deploy_autohsts.called)
 
-    @mock.patch('certbot.plugins.selection.get_unprepared_installer')
+    @mock.patch('certbot._internal.plugins.selection.get_unprepared_installer')
     def test_enhancement_no_updater(self, mock_geti):
         FAKEINDEX = [
             {
diff --git a/certbot/tests/storage_test.py b/certbot/tests/storage_test.py
index 183d9a020..0c525fcc6 100644
--- a/certbot/tests/storage_test.py
+++ b/certbot/tests/storage_test.py
@@ -44,7 +44,7 @@ class RelevantValuesTest(unittest.TestCase):
         return relevant_values(*args, **kwargs)
 
     @mock.patch("certbot.cli.option_was_set")
-    @mock.patch("certbot.plugins.disco.PluginsRegistry.find_all")
+    @mock.patch("certbot._internal.plugins.disco.PluginsRegistry.find_all")
     def test_namespace(self, mock_find_all, mock_option_was_set):
         mock_find_all.return_value = ["certbot-foo:bar"]
         mock_option_was_set.return_value = True
diff --git a/docs/api/plugins/disco.rst b/docs/api/plugins/disco.rst
deleted file mode 100644
index 1a27f0f69..000000000
--- a/docs/api/plugins/disco.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.plugins.disco`
---------------------------------
-
-.. automodule:: certbot.plugins.disco
-   :members:
diff --git a/docs/api/plugins/manual.rst b/docs/api/plugins/manual.rst
deleted file mode 100644
index eea443499..000000000
--- a/docs/api/plugins/manual.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.plugins.manual`
----------------------------------
-
-.. automodule:: certbot.plugins.manual
-   :members:
diff --git a/docs/api/plugins/selection.rst b/docs/api/plugins/selection.rst
deleted file mode 100644
index 6211bf9c0..000000000
--- a/docs/api/plugins/selection.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.plugins.selection`
-------------------------------------
-
-.. automodule:: certbot.plugins.selection
-   :members:
diff --git a/docs/api/plugins/standalone.rst b/docs/api/plugins/standalone.rst
deleted file mode 100644
index 60aa48b4f..000000000
--- a/docs/api/plugins/standalone.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.plugins.standalone`
--------------------------------------
-
-.. automodule:: certbot.plugins.standalone
-   :members:
diff --git a/docs/api/plugins/webroot.rst b/docs/api/plugins/webroot.rst
deleted file mode 100644
index e1f4523f7..000000000
--- a/docs/api/plugins/webroot.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.plugins.webroot`
-----------------------------------
-
-.. automodule:: certbot.plugins.webroot
-   :members:
diff --git a/setup.py b/setup.py
index 3ae2fe282..b230f3ba0 100644
--- a/setup.py
+++ b/setup.py
@@ -168,10 +168,10 @@ setup(
             'certbot = certbot._internal.main:main',
         ],
         'certbot.plugins': [
-            'manual = certbot.plugins.manual:Authenticator',
-            'null = certbot.plugins.null:Installer',
-            'standalone = certbot.plugins.standalone:Authenticator',
-            'webroot = certbot.plugins.webroot:Authenticator',
+            'manual = certbot._internal.plugins.manual:Authenticator',
+            'null = certbot._internal.plugins.null:Installer',
+            'standalone = certbot._internal.plugins.standalone:Authenticator',
+            'webroot = certbot._internal.plugins.webroot:Authenticator',
         ],
     },
 )