diff --git a/certbot/cli.py b/certbot/_internal/cli.py
similarity index 99%
rename from certbot/cli.py
rename to certbot/_internal/cli.py
index f13dedbaa..ad20f6494 100644
--- a/certbot/cli.py
+++ b/certbot/_internal/cli.py
@@ -25,7 +25,7 @@ import certbot._internal.plugins.selection as plugin_selection
 from certbot._internal import constants
 from certbot import crypto_util
 from certbot import errors
-from certbot import hooks
+from certbot._internal import hooks
 from certbot import interfaces
 from certbot import util
 from certbot.compat import os
diff --git a/certbot/_internal/client.py b/certbot/_internal/client.py
index f694a0ae7..2a9a52e73 100644
--- a/certbot/_internal/client.py
+++ b/certbot/_internal/client.py
@@ -20,7 +20,7 @@ from acme.magic_typing import Optional, List  # pylint: disable=unused-import,no
 import certbot
 from certbot._internal import account
 from certbot._internal import auth_handler
-from certbot import cli
+from certbot._internal import cli
 from certbot._internal import constants
 from certbot import crypto_util
 from certbot._internal import eff
diff --git a/certbot/hooks.py b/certbot/_internal/hooks.py
similarity index 100%
rename from certbot/hooks.py
rename to certbot/_internal/hooks.py
diff --git a/certbot/_internal/main.py b/certbot/_internal/main.py
index bf6fd2b11..e58c5285f 100644
--- a/certbot/_internal/main.py
+++ b/certbot/_internal/main.py
@@ -16,14 +16,14 @@ from acme.magic_typing import Union  # pylint: disable=unused-import, no-name-in
 import certbot
 from certbot._internal import account
 from certbot._internal import cert_manager
-from certbot import cli
+from certbot._internal import cli
 from certbot._internal import client
 from certbot._internal import configuration
 from certbot._internal import constants
 from certbot import crypto_util
 from certbot._internal import eff
 from certbot import errors
-from certbot import hooks
+from certbot._internal import hooks
 from certbot import interfaces
 from certbot._internal import log
 from certbot._internal import renewal
diff --git a/certbot/_internal/plugins/manual.py b/certbot/_internal/plugins/manual.py
index 4bb11de3f..43f70d650 100644
--- a/certbot/_internal/plugins/manual.py
+++ b/certbot/_internal/plugins/manual.py
@@ -7,7 +7,7 @@ from acme.magic_typing import Dict  # pylint: disable=unused-import, no-name-in-
 
 from certbot import achallenges  # pylint: disable=unused-import
 from certbot import errors
-from certbot import hooks
+from certbot._internal import hooks
 from certbot import interfaces
 from certbot import reverter
 from certbot.compat import os
diff --git a/certbot/_internal/plugins/selection.py b/certbot/_internal/plugins/selection.py
index ae3d8448b..1ac3456d3 100644
--- a/certbot/_internal/plugins/selection.py
+++ b/certbot/_internal/plugins/selection.py
@@ -197,7 +197,7 @@ def choose_configurator_plugins(config, plugins, verb):
     # Which plugins do we need?
     if verb == "run":
         need_inst = need_auth = True
-        from certbot.cli import cli_command
+        from certbot._internal.cli import cli_command
         if req_auth in noninstaller_plugins and not req_inst:
             msg = ('With the {0} plugin, you probably want to use the "certonly" command, eg:{1}'
                    '{1}    {2} certonly --{0}{1}{1}'
@@ -328,7 +328,7 @@ def diagnose_configurator_problem(cfg_type, requested, plugins):
                    "your existing configuration.\nThe error was: {1!r}"
                    .format(requested, plugins[requested].problem))
     elif cfg_type == "installer":
-        from certbot.cli import cli_command
+        from certbot._internal.cli import cli_command
         msg = ('Certbot doesn\'t know how to automatically configure the web '
           'server on this system. However, it can still get a certificate for '
           'you. Please run "{0} certonly" to do so. You\'ll need to '
diff --git a/certbot/_internal/plugins/webroot.py b/certbot/_internal/plugins/webroot.py
index 33e6530a1..b87b3092a 100644
--- a/certbot/_internal/plugins/webroot.py
+++ b/certbot/_internal/plugins/webroot.py
@@ -15,7 +15,7 @@ from acme.magic_typing import Dict, Set, DefaultDict, List
 # pylint: enable=unused-import, no-name-in-module
 
 from certbot import achallenges  # pylint: disable=unused-import
-from certbot import cli
+from certbot._internal import cli
 from certbot import errors
 from certbot import interfaces
 from certbot.compat import os
diff --git a/certbot/_internal/renewal.py b/certbot/_internal/renewal.py
index 31833c806..5f2f90d63 100644
--- a/certbot/_internal/renewal.py
+++ b/certbot/_internal/renewal.py
@@ -15,10 +15,10 @@ import zope.component
 
 from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
 
-from certbot import cli
+from certbot._internal import cli
 from certbot import crypto_util
 from certbot import errors
-from certbot import hooks
+from certbot._internal import hooks
 from certbot import interfaces
 from certbot._internal import storage
 from certbot._internal import updater
diff --git a/certbot/_internal/storage.py b/certbot/_internal/storage.py
index b7b878dab..f7e7d5e7f 100644
--- a/certbot/_internal/storage.py
+++ b/certbot/_internal/storage.py
@@ -12,7 +12,7 @@ import pytz
 import six
 
 import certbot
-from certbot import cli
+from certbot._internal import cli
 from certbot._internal import constants
 from certbot import crypto_util
 from certbot._internal import error_handler
diff --git a/certbot/plugins/enhancements.py b/certbot/plugins/enhancements.py
index 8896c1a98..d917b0ea4 100644
--- a/certbot/plugins/enhancements.py
+++ b/certbot/plugins/enhancements.py
@@ -78,9 +78,9 @@ def enable(lineage, domains, installer, config):
 
 def populate_cli(add):
     """
-    Populates the command line flags for certbot.cli.HelpfulParser
+    Populates the command line flags for certbot._internal.cli.HelpfulParser
 
-    :param add: Add function of certbot.cli.HelpfulParser
+    :param add: Add function of certbot._internal.cli.HelpfulParser
     :type add: func
     """
     for enh in _INDEX:
diff --git a/certbot/tests/cli_test.py b/certbot/tests/cli_test.py
index 8a398188c..a38a6fc4f 100644
--- a/certbot/tests/cli_test.py
+++ b/certbot/tests/cli_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.cli."""
+"""Tests for certbot._internal.cli."""
 import argparse
 import copy
 import tempfile
@@ -11,7 +11,7 @@ from six.moves import reload_module  # pylint: disable=import-error
 from acme import challenges
 
 import certbot.tests.util as test_util
-from certbot import cli
+from certbot._internal import cli
 from certbot._internal import constants
 from certbot import errors
 from certbot.compat import os
@@ -94,7 +94,7 @@ class ParseTest(unittest.TestCase):  # pylint: disable=too-many-public-methods
 
         return output.getvalue()
 
-    @mock.patch("certbot.cli.flag_default")
+    @mock.patch("certbot._internal.cli.flag_default")
     def test_cli_ini_domains(self, mock_flag_default):
         with tempfile.NamedTemporaryFile() as tmp_config:
             tmp_config.close()  # close now because of compatibility issues on Windows
@@ -366,7 +366,7 @@ class ParseTest(unittest.TestCase):  # pylint: disable=too-many-public-methods
             errors.Error, self.parse, "-n --force-interactive".split())
 
     def test_deploy_hook_conflict(self):
-        with mock.patch("certbot.cli.sys.stderr"):
+        with mock.patch("certbot._internal.cli.sys.stderr"):
             self.assertRaises(SystemExit, self.parse,
                               "--renew-hook foo --deploy-hook bar".split())
 
@@ -386,7 +386,7 @@ class ParseTest(unittest.TestCase):  # pylint: disable=too-many-public-methods
         self.assertEqual(namespace.renew_hook, value)
 
     def test_renew_hook_conflict(self):
-        with mock.patch("certbot.cli.sys.stderr"):
+        with mock.patch("certbot._internal.cli.sys.stderr"):
             self.assertRaises(SystemExit, self.parse,
                               "--deploy-hook foo --renew-hook bar".split())
 
@@ -406,7 +406,7 @@ class ParseTest(unittest.TestCase):  # pylint: disable=too-many-public-methods
         self.assertEqual(namespace.renew_hook, value)
 
     def test_max_log_backups_error(self):
-        with mock.patch('certbot.cli.sys.stderr'):
+        with mock.patch('certbot._internal.cli.sys.stderr'):
             self.assertRaises(
                 SystemExit, self.parse, "--max-log-backups foo".split())
             self.assertRaises(
@@ -462,7 +462,7 @@ class ParseTest(unittest.TestCase):  # pylint: disable=too-many-public-methods
 
 
 class DefaultTest(unittest.TestCase):
-    """Tests for certbot.cli._Default."""
+    """Tests for certbot._internal.cli._Default."""
 
 
     def setUp(self):
@@ -536,7 +536,7 @@ class SetByCliTest(unittest.TestCase):
 
 
 def _call_set_by_cli(var, args, verb):
-    with mock.patch('certbot.cli.helpful_parser') as mock_parser:
+    with mock.patch('certbot._internal.cli.helpful_parser') as mock_parser:
         with test_util.patch_get_utility():
             mock_parser.args = args
             mock_parser.verb = verb
diff --git a/certbot/tests/client_test.py b/certbot/tests/client_test.py
index e7cf84c3c..1ebd5f7b5 100644
--- a/certbot/tests/client_test.py
+++ b/certbot/tests/client_test.py
@@ -462,7 +462,7 @@ class ClientTest(ClientTestCommon):
         names = [call[0][0] for call in mock_storage.call_args_list]
         self.assertEqual(names, ["example_cert", "example.com", "example.com"])
 
-    @mock.patch("certbot.cli.helpful_parser")
+    @mock.patch("certbot._internal.cli.helpful_parser")
     def test_save_certificate(self, mock_parser):
         # pylint: disable=too-many-locals
         certs = ["cert_512.pem", "cert-san_512.pem"]
diff --git a/certbot/tests/hook_test.py b/certbot/tests/hook_test.py
index 017edc560..2e403d8f3 100644
--- a/certbot/tests/hook_test.py
+++ b/certbot/tests/hook_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.hooks."""
+"""Tests for certbot._internal.hooks."""
 import unittest
 
 import mock
@@ -12,14 +12,14 @@ from certbot.tests import util as test_util
 
 
 class ValidateHooksTest(unittest.TestCase):
-    """Tests for certbot.hooks.validate_hooks."""
+    """Tests for certbot._internal.hooks.validate_hooks."""
 
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.hooks import validate_hooks
+        from certbot._internal.hooks import validate_hooks
         return validate_hooks(*args, **kwargs)
 
-    @mock.patch("certbot.hooks.validate_hook")
+    @mock.patch("certbot._internal.hooks.validate_hook")
     def test_it(self, mock_validate_hook):
         config = mock.MagicMock()
         self._call(config)
@@ -31,30 +31,30 @@ class ValidateHooksTest(unittest.TestCase):
 
 
 class ValidateHookTest(test_util.TempDirTestCase):
-    """Tests for certbot.hooks.validate_hook."""
+    """Tests for certbot._internal.hooks.validate_hook."""
 
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.hooks import validate_hook
+        from certbot._internal.hooks import validate_hook
         return validate_hook(*args, **kwargs)
 
     def test_hook_not_executable(self):
         # prevent unnecessary modifications to PATH
-        with mock.patch("certbot.hooks.plug_util.path_surgery"):
+        with mock.patch("certbot._internal.hooks.plug_util.path_surgery"):
             # We just mock out filesystem.is_executable since on Windows, it is difficult
             # to get a fully working test around executable permissions. See
             # certbot.tests.compat.filesystem::NotExecutableTest for more in-depth tests.
-            with mock.patch("certbot.hooks.filesystem.is_executable", return_value=False):
+            with mock.patch("certbot._internal.hooks.filesystem.is_executable", return_value=False):
                 self.assertRaises(errors.HookCommandNotFound, self._call, 'dummy', "foo")
 
-    @mock.patch("certbot.hooks.util.exe_exists")
+    @mock.patch("certbot._internal.hooks.util.exe_exists")
     def test_not_found(self, mock_exe_exists):
         mock_exe_exists.return_value = False
-        with mock.patch("certbot.hooks.plug_util.path_surgery") as mock_ps:
+        with mock.patch("certbot._internal.hooks.plug_util.path_surgery") as mock_ps:
             self.assertRaises(errors.HookCommandNotFound, self._call, "foo", "bar")
         self.assertTrue(mock_ps.called)
 
-    @mock.patch("certbot.hooks._prog")
+    @mock.patch("certbot._internal.hooks._prog")
     def test_unset(self, mock_prog):
         self._call(None, "foo")
         self.assertFalse(mock_prog.called)
@@ -70,24 +70,24 @@ class HookTest(test_util.ConfigTestCase):
 
     @classmethod
     def _call_with_mock_execute(cls, *args, **kwargs):
-        """Calls self._call after mocking out certbot.hooks.execute.
+        """Calls self._call after mocking out certbot._internal.hooks.execute.
 
         The mock execute object is returned rather than the return value
         of self._call.
 
         """
-        with mock.patch("certbot.hooks.execute") as mock_execute:
+        with mock.patch("certbot._internal.hooks.execute") as mock_execute:
             mock_execute.return_value = ("", "")
             cls._call(*args, **kwargs)
         return mock_execute
 
 
 class PreHookTest(HookTest):
-    """Tests for certbot.hooks.pre_hook."""
+    """Tests for certbot._internal.hooks.pre_hook."""
 
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.hooks import pre_hook
+        from certbot._internal.hooks import pre_hook
         return pre_hook(*args, **kwargs)
 
     def setUp(self):
@@ -107,7 +107,7 @@ class PreHookTest(HookTest):
         super(PreHookTest, self).tearDown()
 
     def _reset_pre_hook_already(self):
-        from certbot.hooks import executed_pre_hooks
+        from certbot._internal.hooks import executed_pre_hooks
         executed_pre_hooks.clear()
 
     def test_certonly(self):
@@ -128,7 +128,7 @@ class PreHookTest(HookTest):
         self.config.verb = "renew"
         os.remove(self.dir_hook)
 
-        with mock.patch("certbot.hooks.logger") as mock_logger:
+        with mock.patch("certbot._internal.hooks.logger") as mock_logger:
             mock_execute = self._call_with_mock_execute(self.config)
         self.assertFalse(mock_execute.called)
         self.assertFalse(mock_logger.info.called)
@@ -154,18 +154,18 @@ class PreHookTest(HookTest):
         self._test_no_executions_common()
 
     def _test_no_executions_common(self):
-        with mock.patch("certbot.hooks.logger") as mock_logger:
+        with mock.patch("certbot._internal.hooks.logger") as mock_logger:
             mock_execute = self._call_with_mock_execute(self.config)
         self.assertFalse(mock_execute.called)
         self.assertTrue(mock_logger.info.called)
 
 
 class PostHookTest(HookTest):
-    """Tests for certbot.hooks.post_hook."""
+    """Tests for certbot._internal.hooks.post_hook."""
 
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.hooks import post_hook
+        from certbot._internal.hooks import post_hook
         return post_hook(*args, **kwargs)
 
     def setUp(self):
@@ -185,7 +185,7 @@ class PostHookTest(HookTest):
         super(PostHookTest, self).tearDown()
 
     def _reset_post_hook_eventually(self):
-        from certbot.hooks import post_hooks
+        from certbot._internal.hooks import post_hooks
         del post_hooks[:]
 
     def test_certonly_and_run_with_hook(self):
@@ -239,27 +239,27 @@ class PostHookTest(HookTest):
             self.assertEqual(self._get_eventually(), expected)
 
     def _get_eventually(self):
-        from certbot.hooks import post_hooks
+        from certbot._internal.hooks import post_hooks
         return post_hooks
 
 
 class RunSavedPostHooksTest(HookTest):
-    """Tests for certbot.hooks.run_saved_post_hooks."""
+    """Tests for certbot._internal.hooks.run_saved_post_hooks."""
 
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.hooks import run_saved_post_hooks
+        from certbot._internal.hooks import run_saved_post_hooks
         return run_saved_post_hooks()
 
     def _call_with_mock_execute_and_eventually(self, *args, **kwargs):
         """Call run_saved_post_hooks but mock out execute and eventually
 
-        certbot.hooks.post_hooks is replaced with
+        certbot._internal.hooks.post_hooks is replaced with
         self.eventually. The mock execute object is returned rather than
         the return value of run_saved_post_hooks.
 
         """
-        eventually_path = "certbot.hooks.post_hooks"
+        eventually_path = "certbot._internal.hooks.post_hooks"
         with mock.patch(eventually_path, new=self.eventually):
             return self._call_with_mock_execute(*args, **kwargs)
 
@@ -290,7 +290,7 @@ class RenewalHookTest(HookTest):
     # pylint: disable=abstract-method
 
     def _call_with_mock_execute(self, *args, **kwargs):
-        """Calls self._call after mocking out certbot.hooks.execute.
+        """Calls self._call after mocking out certbot._internal.hooks.execute.
 
         The mock execute object is returned rather than the return value
         of self._call. The mock execute object asserts that environment
@@ -311,7 +311,7 @@ class RenewalHookTest(HookTest):
             self.assertEqual(os.environ["RENEWED_LINEAGE"], lineage)
             return ("", "")
 
-        with mock.patch("certbot.hooks.execute") as mock_execute:
+        with mock.patch("certbot._internal.hooks.execute") as mock_execute:
             mock_execute.side_effect = execute_side_effect
             self._call(*args, **kwargs)
         return mock_execute
@@ -329,14 +329,14 @@ class RenewalHookTest(HookTest):
 
 
 class DeployHookTest(RenewalHookTest):
-    """Tests for certbot.hooks.deploy_hook."""
+    """Tests for certbot._internal.hooks.deploy_hook."""
 
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.hooks import deploy_hook
+        from certbot._internal.hooks import deploy_hook
         return deploy_hook(*args, **kwargs)
 
-    @mock.patch("certbot.hooks.logger")
+    @mock.patch("certbot._internal.hooks.logger")
     def test_dry_run(self, mock_logger):
         self.config.deploy_hook = "foo"
         self.config.dry_run = True
@@ -345,7 +345,7 @@ class DeployHookTest(RenewalHookTest):
         self.assertFalse(mock_execute.called)
         self.assertTrue(mock_logger.warning.called)
 
-    @mock.patch("certbot.hooks.logger")
+    @mock.patch("certbot._internal.hooks.logger")
     def test_no_hook(self, mock_logger):
         self.config.deploy_hook = None
         mock_execute = self._call_with_mock_execute(
@@ -363,11 +363,11 @@ class DeployHookTest(RenewalHookTest):
 
 
 class RenewHookTest(RenewalHookTest):
-    """Tests for certbot.hooks.renew_hook"""
+    """Tests for certbot._internal.hooks.renew_hook"""
 
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.hooks import renew_hook
+        from certbot._internal.hooks import renew_hook
         return renew_hook(*args, **kwargs)
 
     def setUp(self):
@@ -385,7 +385,7 @@ class RenewHookTest(RenewalHookTest):
             self.config, ["example.org"], "/foo/bar")
         mock_execute.assert_called_once_with("deploy-hook", self.config.renew_hook)
 
-    @mock.patch("certbot.hooks.logger")
+    @mock.patch("certbot._internal.hooks.logger")
     def test_dry_run(self, mock_logger):
         self.config.dry_run = True
         mock_execute = self._call_with_mock_execute(
@@ -397,7 +397,7 @@ class RenewHookTest(RenewalHookTest):
         self.config.renew_hook = None
         os.remove(self.dir_hook)
 
-        with mock.patch("certbot.hooks.logger") as mock_logger:
+        with mock.patch("certbot._internal.hooks.logger") as mock_logger:
             mock_execute = self._call_with_mock_execute(
                 self.config, ["example.org"], "/foo/bar")
         self.assertFalse(mock_execute.called)
@@ -417,11 +417,11 @@ class RenewHookTest(RenewalHookTest):
 
 
 class ExecuteTest(unittest.TestCase):
-    """Tests for certbot.hooks.execute."""
+    """Tests for certbot._internal.hooks.execute."""
 
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.hooks import execute
+        from certbot._internal.hooks import execute
         return execute(*args, **kwargs)
 
     def test_it(self):
@@ -433,10 +433,10 @@ class ExecuteTest(unittest.TestCase):
     def _test_common(self, returncode, stdout, stderr):
         given_command = "foo"
         given_name = "foo-hook"
-        with mock.patch("certbot.hooks.Popen") as mock_popen:
+        with mock.patch("certbot._internal.hooks.Popen") as mock_popen:
             mock_popen.return_value.communicate.return_value = (stdout, stderr)
             mock_popen.return_value.returncode = returncode
-            with mock.patch("certbot.hooks.logger") as mock_logger:
+            with mock.patch("certbot._internal.hooks.logger") as mock_logger:
                 self.assertEqual(self._call(given_name, given_command), (stderr, stdout))
 
         executed_command = mock_popen.call_args[1].get(
@@ -453,11 +453,11 @@ class ExecuteTest(unittest.TestCase):
 
 
 class ListHooksTest(test_util.TempDirTestCase):
-    """Tests for certbot.hooks.list_hooks."""
+    """Tests for certbot._internal.hooks.list_hooks."""
 
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.hooks import list_hooks
+        from certbot._internal.hooks import list_hooks
         return list_hooks(*args, **kwargs)
 
     def test_empty(self):
diff --git a/certbot/tests/main_test.py b/certbot/tests/main_test.py
index 789c0db42..ee9fe8558 100644
--- a/certbot/tests/main_test.py
+++ b/certbot/tests/main_test.py
@@ -22,7 +22,7 @@ from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-
 
 import certbot.tests.util as test_util
 from certbot._internal import account
-from certbot import cli
+from certbot._internal import cli
 from certbot._internal import configuration
 from certbot._internal import constants
 from certbot import crypto_util
@@ -715,7 +715,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         # This needed two calls to find_all(), which we're avoiding for now
         # because of possible side effects:
         # https://github.com/letsencrypt/letsencrypt/commit/51ed2b681f87b1eb29088dd48718a54f401e4855
-        #with mock.patch('certbot.cli.plugins_testable') as plugins:
+        #with mock.patch('certbot._internal.cli.plugins_testable') as plugins:
         #    plugins.return_value = {"apache": True, "nginx": True}
         #    ret, _, _, _ = self._call(args)
         #    self.assertTrue("Too many flags setting" in ret)
@@ -1145,7 +1145,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         test_util.make_lineage(self.config.config_dir, 'sample-renewal.conf')
         args = ["renew", "--dry-run", "--post-hook=no-such-command",
                 "--disable-hook-validation"]
-        with mock.patch("certbot.hooks.post_hook"):
+        with mock.patch("certbot._internal.hooks.post_hook"):
             self._test_renewal_common(True, [], args=args, should_renew=True,
                                       error_expected=False)
 
diff --git a/certbot/tests/renewal_test.py b/certbot/tests/renewal_test.py
index dcbaed6a2..9b36c8b83 100644
--- a/certbot/tests/renewal_test.py
+++ b/certbot/tests/renewal_test.py
@@ -12,7 +12,7 @@ import certbot.tests.util as test_util
 
 
 class RenewalTest(test_util.ConfigTestCase):
-    @mock.patch('certbot.cli.set_by_cli')
+    @mock.patch('certbot._internal.cli.set_by_cli')
     def test_ancient_webroot_renewal_conf(self, mock_set_by_cli):
         mock_set_by_cli.return_value = False
         rc_path = test_util.make_lineage(
diff --git a/certbot/tests/storage_test.py b/certbot/tests/storage_test.py
index 0c525fcc6..72394c2a8 100644
--- a/certbot/tests/storage_test.py
+++ b/certbot/tests/storage_test.py
@@ -43,7 +43,7 @@ class RelevantValuesTest(unittest.TestCase):
         from certbot._internal.storage import relevant_values
         return relevant_values(*args, **kwargs)
 
-    @mock.patch("certbot.cli.option_was_set")
+    @mock.patch("certbot._internal.cli.option_was_set")
     @mock.patch("certbot._internal.plugins.disco.PluginsRegistry.find_all")
     def test_namespace(self, mock_find_all, mock_option_was_set):
         mock_find_all.return_value = ["certbot-foo:bar"]
@@ -53,7 +53,7 @@ class RelevantValuesTest(unittest.TestCase):
         self.assertEqual(
             self._call(self.values.copy()), self.values)
 
-    @mock.patch("certbot.cli.option_was_set")
+    @mock.patch("certbot._internal.cli.option_was_set")
     def test_option_set(self, mock_option_was_set):
         mock_option_was_set.return_value = True
 
@@ -65,7 +65,7 @@ class RelevantValuesTest(unittest.TestCase):
 
         self.assertEqual(self._call(self.values), expected_relevant_values)
 
-    @mock.patch("certbot.cli.option_was_set")
+    @mock.patch("certbot._internal.cli.option_was_set")
     def test_option_unset(self, mock_option_was_set):
         mock_option_was_set.return_value = False
 
diff --git a/docs/api/cli.rst b/docs/api/cli.rst
deleted file mode 100644
index 91be86758..000000000
--- a/docs/api/cli.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.cli`
-----------------------
-
-.. automodule:: certbot.cli
-   :members:
diff --git a/docs/api/hooks.rst b/docs/api/hooks.rst
deleted file mode 100644
index 140fbf284..000000000
--- a/docs/api/hooks.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.hooks`
-------------------------
-
-.. automodule:: certbot.hooks
-   :members: