diff --git a/doc/development/api/plugins.rst b/doc/development/api/plugins.rst
index f64973e2b..2bfb5b2b3 100644
--- a/doc/development/api/plugins.rst
+++ b/doc/development/api/plugins.rst
@@ -42,6 +42,13 @@ configuration class. The metadata class must define the following attributes:
 ``description`` (``str``):
     A more verbose description of what your plugin does.
 
+``visible`` (``bool``):
+   ``True`` by default, can hide a plugin so it cannot be normally activated.
+
+``restricted`` (``bool``):
+   ``False`` by default, restricts a plugin such that it can only be enabled for an event
+   by system administrators / superusers.
+
 A working example would be::
 
     # file: pretix/plugins/timerestriction/__init__.py
@@ -57,6 +64,8 @@ A working example would be::
             name = _("PayPal")
             author = _("the pretix team")
             version = '1.0.0'
+            visible = True
+            restricted = False
             description = _("This plugin allows you to receive payments via PayPal")
 
 
diff --git a/src/pretix/control/templates/pretixcontrol/event/plugins.html b/src/pretix/control/templates/pretixcontrol/event/plugins.html
index 417381921..7c175715d 100644
--- a/src/pretix/control/templates/pretixcontrol/event/plugins.html
+++ b/src/pretix/control/templates/pretixcontrol/event/plugins.html
@@ -23,6 +23,8 @@
                                     <div class="col-sm-4">
                                         {% if plugin.app.compatibility_errors %}
                                             <button class="btn disabled btn-block btn-default" disabled="disabled">{% trans "Incompatible" %}</button>
+                                        {% elif plugin.restricted and not request.user.is_superuser %}
+                                            <button class="btn disabled btn-block btn-default" disabled="disabled">{% trans "Not available" %}</button>
                                         {% elif plugin.module in plugins_active %}
                                             <button class="btn btn-default btn-block" name="plugin:{{ plugin.module }}" value="disable">{% trans "Disable" %}</button>
                                         {% else %}
@@ -42,6 +44,11 @@
                                     {% endblocktrans %}</p>
                                 {% endif %}
                                 <p>{{ plugin.description }}</p>
+                                {% if plugin.restricted and not request.user.is_superuser %}
+                                    <div class="alert alert-warning">
+                                        {% trans "This plugin needs to be enabled by a system administrator for your event." %}
+                                    </div>
+                                {% endif %}
                                 {% if plugin.app.compatibility_errors %}
                                     <div class="alert alert-warning">
                                         {% trans "This plugin cannot be enabled for the following reasons:" %}
diff --git a/src/pretix/control/views/event.py b/src/pretix/control/views/event.py
index cf3967f30..b30ae480a 100644
--- a/src/pretix/control/views/event.py
+++ b/src/pretix/control/views/event.py
@@ -132,6 +132,9 @@ class EventPlugins(EventPermissionRequiredMixin, TemplateView, SingleObjectMixin
                 if key.startswith("plugin:"):
                     module = key.split(":")[1]
                     if value == "enable" and module in plugins_available:
+                        if getattr(plugins_available[module], 'restricted', False):
+                            if not request.user.is_superuser:
+                                continue
                         self.request.event.log_action('pretix.event.plugins.enabled', user=self.request.user,
                                                       data={'plugin': module})
                         if module not in plugins_active: