Secure video hosting
Secure Video Hosting: What Each Layer Stops
Encrypt the stream. Lock it to your site. Choose who presses play.
Encryption, a domain lock and paid access each stop one kind of leak. None stops a phone aimed at the screen. Protect live and recorded video on your own site.
Paid cohort masterclass
Broadcast from your course websiteProtect a paid stream in three steps
Decide who presses play
Sell a WooCommerce product for pay-per-view, sell a subscription, or place a free channel on a members-only page.
On a pay-per-view or subscription product, visitors without a paid order see a buy button.
Turn on encryption and sessions
Switch on Encrypt Live Stream in the channel settings, then Use Sessions with Encryption, which only works with encryption on. Recordings have their own Encrypt Video setting.
Lock the player to your site
Turn on Lock to Website for the channel and its recordings. Another site can't embed your protected stream or its replay; viewers can only share the link to your page.
WpStream streams from your own domain and ties access to your WordPress users.
Private, password-protected, subscriber-only and pay-per-view streams all run on your site, not on someone else's platform, and your paid members watch them there.
What is secure video hosting?
Secure video hosting is video delivery where each protection layer answers one threat. Encryption in transit stops interception, and stream encryption with authenticated keys stops downloaded segment files from playing.
A domain lock stops embeds and hotlinking on other sites. Access control stops non-payers, while DRM binds playback to a licence checked inside a decryption module. No single layer stops every leak.
Private is not secure. As WpStream's private streaming guide puts it: "You can hide the page the video sits on, or you can gate the stream itself."
And even a gated stream is only one layer.
"Piracy is a complex issue that cannot be addressed with a single solution or by targeting a single use case," said Brett Sappington of Parks Associates.
WpStream lists Content Protection on every plan. Its stack is AES-128 encryption with keys handed out through your site's login and access rules, plus Lock to Website and access control.
It is not DRM. Encryption and the lock are settings you turn on per channel and per video.
Five layers and what each one misses
A secure video streaming platform needs several layers, and each one answers a single threat to your protected stream. What each layer does not stop is where leaks come from.
Encryption in transit (HTTPS/TLS)
Stops: eavesdropping and tampering on the network. MDN describes TLS as "preventing tampering with and eavesdropping", which covers the trip from server to player.
Does not stop: anything the authorized player receives. Our view: once a paying member's browser has the lesson, TLS has done its job.
Stream encryption (AES-128 keys)
Stops: segment files downloaded and played without the key, and other sites hotlinking your stream.
Under RFC 8216, AES-128 encrypts each media segment completely with a 128-bit key, and key delivery "SHOULD be secured" in conjunction with "a secure realm or a session token".
Does not stop: a logged-in session that got the key legitimately, or screen recording, which is a standard browser feature.
In WpStream, the encryption key goes out through your site's login and access rules, and you turn on encrypted video streaming per channel and per video.
Domain lock (Lock to Website / CORS)
Stops: a page on another site embedding your live stream or recording, which is what domain restricted video means.
With Lock to Website on, viewers "will not be able to take your live stream and embed it on another website".
Does not stop: clients that are not browsers, because CORS is a rule browsers apply; a modified Referer header; or viewers sharing the link to your own page.
Access control (paid order, members page)
Stops: strangers and non-payers. WpStream reads the WooCommerce order, and a viewer with no matching paid order gets a buy button instead of a player.
Does not stop: login sharing, a forwarded password, or a paying viewer recording the class. A WordPress password page is weaker still: "What this gates is the HTML page, not the video."
More on password protected video hosting.
DRM (Widevine, FairPlay, PlayReady)
Stops: decryption outside a licensed decryption module and, at hardware security levels on certified devices, screen capture. HDCP separately guards the link between the player and the screen.
Does not stop: a phone camera aimed at the screen, or recording in desktop Chrome, which "doesn't offer a native mechanism to prevent screen recording, even when DRM protects the content," per Dolby's player docs.
Widevine needs a licence agreement and FairPlay needs Apple's approval, so DRM fits studio-licensed content whose licensor requires it.
WpStream is not DRM. For its stack, "the relevant layer is AES-128 with authenticated key delivery rather than hardware DRM." More on how video DRM works.
Which layers your stream needs
WpStream's DRM guide sizes protection on three questions: what one session is worth, how far you trust the audience, and how long the content keeps its value.
"For a live event, the piracy window is measured in hours." For a VOD library, "the window is open-ended".
Cohort course (example)
The costly leak is a forwarded class link or a shared login. In 2020 the FBI's Boston office reported a stranger who "dialed into the classroom" of a high school Zoom class.
Layers: a paid order or per-course plan, encryption with sessions, Lock to Website on lessons. Gets through: a student sharing a login.
Fitness class library (example)
Members share one login with friends. Layers: a subscription plan per class track, or one global subscription for the whole library, plus encryption and Lock to Website on every on-demand class.
Gets through: shared logins.
Licensed live match (example)
A broadcaster's risk is restreams and embeds of the licensed program. Layers: pay-per-view access, encryption with sessions, Lock to Website. Gets through: a paying viewer recording the screen.
If the rights contract names DRM, WpStream is not that layer.
Member association session (example)
The costly leak is a member forwarding the link to a members-only annual meeting or training session.
Layers: a membership plugin such as MemberPress gates the page, a free channel sits on it, plus the lock and encryption. Gets through: a member sharing their login.
Free public stream
Nobody pays, but other sites can still use your stream. Encryption and Lock to Website stop that hotlinking and keep your viewer hours for your own audience.
Gets through: a viewer who re-shares or restreams what they watch.
Studio-licensed catalogue
If the licensor requires Widevine or FairPlay, you need a DRM provider, and Apple approves FairPlay only if your team provides "a streaming service to consumers."
WpStream is not DRM, so it is the wrong tool for this rights holder's catalogue.
What gets through
every layer
Screen recording
Screen capture is a standard browser feature: the Screen Capture API lets a user record a screen or a window.
Dolby's player docs call screen recording "a major, (arguably) unsolved issue in the video industry." And a phone camera can always be aimed at the screen.
Shared logins
In April 2022 Netflix estimated more than 100 million households using a shared password, over 30 million of them in the U.S. and Canada, CNBC reported.
Parks Associates found 27% of US broadband households pirate or share accounts (2019). Access control decides who logs in, not who they share with.
Live restreams
Irdeto found 239 illegal streams of the Mayweather vs McGregor fight in August 2017, reaching about 2.93 million viewers.
"When combatting live sports piracy, speed in disrupting piracy is essential," said Irdeto's Rory O'Connor. A paid live event leaks while it is still worth money.
Layer by layer
Which layer stops which leak?
A leak comes through the gap a layer was never built to close. Lock to Website does nothing against a shared login.
A paywall does nothing against a phone aimed at the screen. Secure video streaming means knowing which gap each layer leaves open.
A forensic watermark is a separate specialist tool. Dolby's docs say a watermark lets you "identify the source of the leak." It prevents nothing in advance.
It only tells you, afterwards, where the leaked copy came from.
| Layer | What it stops | What it does not stop |
|---|---|---|
| Layer: Encryption in transit (TLS) | What it stops: Eavesdropping and tampering on the network | What it does not stop: What the authorized player receives (our view) |
| Layer: AES-128 with authenticated keys | What it stops: Segment files played without the key; hotlinking | What it does not stop: A session holding the key; screen recording |
| Layer: Lock to Website / CORS | What it stops: Embeds of your stream on other sites | What it does not stop: Non-browser clients; links to your own page |
| Layer: Access control | What it stops: Strangers and non-payers | What it does not stop: Login sharing; a paying viewer recording |
| Layer: DRM | What it stops: Decryption outside a licensed module; capture on certified hardware | What it does not stop: Phone cameras; screen capture in desktop Chrome |
| Layer: Forensic watermark (separate tool) | What it stops: Nothing in advance; traces the leak source | What it does not stop: The leak itself |
Protect live and recorded video in WpStream
WordPress secure video streaming with WpStream comes down to settings you turn on.
Set defaults in Default Channel Settings and VOD Settings, then override them per channel and per video, for secure live streaming and replays alike.
Encryption "may not work on some browsers", so test on your paid members' browsers. Selling tickets? See how to sell access to live streams.
Product
Sell or restrict the stream
Sell a WooCommerce product for pay-per-view, a global subscription for everything, or a plan per course or class track.
Or put a free channel on a members-only page gated by a membership plugin.
Channel
Encrypt Live Stream, then Use Sessions
Set both in Default Channel Settings for new channels; each channel's own settings override them.
WpStream's docs call Use Sessions with Encryption "step 2 of encryption", and it only works with Encrypt Live Stream on.
Player
Lock to Website on channels and videos
Turn on Lock to Website for each live channel so the stream shows only on your site. In VOD Settings, the same option blocks attempts to embed a recording on another site.
Replay
Lock and encrypt the recording
Set Encrypt Video and Lock to Website as defaults in VOD Settings, then check both on the recording before you publish the replay. Each video can overwrite the defaults.
Live to replay
The replay keeps the same buyers
After a paid live event, the organizer switches the product from Live stream to Video on demand and picks the recording.
Everyone who bought the ticket keeps access and watches the replay without paying again.
The recording has its own Encrypt Video and Lock to Website settings. It uses recording hours by length: a 2-hour recording uses 2 recording hours.
Video unavailable. Please try again later.
Every plan card lists Content Protection. Protected streams use hours like public ones.
Lite
Per the WpStream pricing page (September 2026), Lite costs $24 a month or $190 a year: 100 broadcast hours and 500 viewer hours a month, 25 recording hours, 200 simultaneous viewers and 5 live channels.
Plus
Plus costs $59 a month or $490 a year: 250 broadcast, 2,000 viewer and 100 recording hours, 1,000 simultaneous viewers.
Pro ($169 a month: 1,000 broadcast, 10,000 viewer, 500 recording hours) and Ultra ($449 a month: 4,000, 50,000 and 1,500) cover bigger libraries and events.
Each plan step costs more and adds more hours.
The trial
"Private, protected, free, and pay-per-view streams use resources the same way." One-time plans start at $36, and their hours don't expire. Start a free trial, no credit card.
If something leaks
What should you do when a protected stream leaks?
If you know which account leaked, revoke it. Access is tied to each WooCommerce account, so one login can go without changing anything for your other paid members.
If the stream sat behind a shared password page, that password can be forwarded, so change it.
Then check the switches: Encrypt Live Stream and Use Sessions with Encryption on the channel, Encrypt Video on the recordings, Lock to Website on both. For a live event, move fast.
As WpStream's DRM guide puts it, "the piracy window is measured in hours", and the content "loses most of its money value once the event ends."
Tracing a leaked copy back to its account takes a forensic watermark, a separate specialist tool. Decide on one before the next licensed program, not after the restream.
More on video protection
What Is Video DRM and How Does It Work?
Most video content protection stops casual copying, not a determined pirate. That's the honest starting point.
Video Content Protection and Encryption
In the online video realm, we are protecting your content via a combination of restricted access and encryption.
How do I restrict video content to paying subscribers on WordPress?
WordPress on its own cannot restrict video to paying subscribers. You add a plugin that holds a paid record for each viewer and checks it before the player loads.
Secure video hosting questions
No. Private hosting hides the page, so strangers don’t find the video.
Secure video hosting decides who can play the stream and where it plays: encryption, a domain lock and access rules tied to paid members. WpStream’s private streaming guide compares the two.
Not on its own. A WordPress password page gates the page, not the video, and anyone can forward the password to a friend.
Account-based access holds up better: with WpStream, access is tied to each WooCommerce account, so you can revoke one login without changing anything for everyone else.
Only at hardware security levels on certified devices.
Desktop Chrome and Firefox on Windows and macOS support only Widevine’s software-only L3 level, per bunny.net’s docs, and no DRM stops a phone camera aimed at the screen.
WpStream is not DRM, so if a licensor asks for it, read how video DRM works first.
No. WpStream offers AES-128 encryption, which you turn on per channel and per video, with keys handed out through your site’s login and access rules, plus Lock to Website and access control.
If a rights contract requires Widevine or FairPlay, you need a DRM provider for that content.
Encryption is a setting. In WpStream you turn on Encrypt Live Stream, then Use Sessions with Encryption, per channel, and Encrypt Video per recording.
Encryption “may not work on some browsers”, so test the protected stream on your paid members’ browsers before a paid event.
Lock to Website stops it. WpStream’s docs say viewers “will not be able to take your live stream and embed it on another website.”
They can still share the link to your page, and the cross-domain rule is enforced by browsers, so encryption and access control still matter.
Yes. WpStream’s pricing FAQ says: “Private, protected, free, and pay-per-view streams use resources the same way. Broadcast Hours count the live streaming time, and Viewer Hours count the viewer watch time.”
Protection doesn’t change how hours are counted.
Secure video hosting can block the file route. Encrypted segment files won’t play without the key, and WpStream describes Encrypt Video as “preventing unauthorized access, downloading, or redistribution of your video files.”
A logged-in member can still record the screen, so pair encryption with per-account access you can revoke.
Ready when you are
Start your free trial
Try live broadcasting and replays on your website.