Password-Protected Live Streaming: Everything You Need to Know

By the WpStream Editorial Team

Last updated: June 26, 2026

Here’s the surprise that trips up most people: YouTube doesn’t offer true password protection for live streams (its “Unlisted” option can be reshared by anyone with the link), and Facebook Live has no native password option either. So if you want a broadcast only authorized viewers can reach, you need a different setup. Password-protected live streaming locks a stream behind a credential gate, whether that’s a shared password, a purchased ticket, or an active subscription, so only the right people get in. On WordPress you’ve got three access layers to work with: a password-protected page, WooCommerce pay-per-view or subscription gating, and, on WpStream’s paid plans, AES-128 encryption applied to the video segments themselves. Most real setups combine at least two of them. (Disclosure: WpStream is the publisher of this article and the plugin described below.) And if private live streaming is your goal, the platform you pick matters as much as the password you set.

What is password-protected streaming?

Password-protected live streaming is a live broadcast where viewers have to pass a credential check before the video player loads. The credential might be a shared password you email out, a WooCommerce account with a completed purchase, or an active subscription. That’s the whole idea: no valid credential, no stream.

It sits between two other models people often confuse it with. Public streaming has no gate at all. “Unlisted” streaming has no password either, just a URL that’s hard to guess (more on why that isn’t security in a moment).

One distinction matters more than any other here. Password protection describes the access gate, not the delivery itself. The page can be gated while the underlying stream stays unencrypted, or both can be locked down. That gap is the thread running through this whole article, and it’s what separates a setup that merely restricts who can watch from one of the genuinely private streaming platforms that protect the stream end to end.

Unlisted, Private, or Password Protected: What’s the Difference

Before any setup, clear up the three access models people mix up constantly. They aren’t interchangeable, and treating one as another is how a “private” event ends up on someone’s group chat.

Start with the most common mistake. YouTube Help puts it plainly: “Unlisted videos and playlists can be seen and shared by anyone with the link … Anyone with the link can also reshare it.” Unlisted is a discoverability control, not a security one. It keeps a stream out of search results and off your channel page, and that’s all it does. Anyone who receives the link can watch, and pass it on.

And the second mix-up is on the WordPress side. WordPress “Private” visibility isn’t a viewer-facing password gate. Per WordPress.org’s documentation, Private content is visible only to Administrators and Editors, which means your audience sees nothing at all. The setting you actually want for a gated event is “Password Protected,” a separate option entirely.

Three Ways to Restrict Live Stream Access

On a WordPress site running WpStream, three distinct mechanisms control who reaches a live stream, and they operate at different points in the delivery chain. Here’s what each one gates, and where each one falls short.

WordPress Password-Protected Page

The simplest method uses WordPress on its own. You open a page’s Visibility setting, choose “Password Protected,” enter a password, and publish. Then you embed the WpStream player on that page and share the URL plus the password with the people you want watching. Visitors without the password see a WordPress password prompt where the player would be.

What this gates is the HTML page, not the video. And there’s a quirk worth knowing before you lean on it: WordPress stores the entered password in a browser cookie that expires after about 10 days by default, so a viewer who authenticates once can return for up to 10 days without retyping it (worth flagging for any shared library or kiosk machine, where the next person inherits that session).

The deeper limitation is that a password is a shared secret. Anyone who has it can forward it. So page-level password protection fits trusted audiences best, employees or registered attendees whose contact details you already hold, rather than a high-value public event where one leaked password could expose the stream to thousands. Think corporate all-hands meetings, VIP one-time events (WpStream’s one-time Lite license runs $36 for a single event, no recurring billing), and internal training sessions.

WooCommerce Pay-Per-View and Subscription Gating

When access needs to map to individual identities, and especially when money changes hands, WpStream connects a channel to a WooCommerce product instead. Viewers must buy the product or hold an active subscription before the player unlocks. Access is tied to each WooCommerce account, not to one shared password, which means you can revoke a single account without changing anything for everyone else.

There are two sub-modes. Pay-per-view is a one-off purchase per event. Subscription is recurring access, either per-channel or global across everything you publish. WpStream’s Subscription Options documentation describes the global mode this way: “Use Global Subscription Mode: If your viewers purchase one subscription, they have access to ALL your LIVE and video content.” That’s the model that behaves like a streaming service rather than a ticket booth.

The trade-off is friction. Every viewer has to create a WooCommerce account and complete a checkout, which a shared page password never demands. For a paid webinar or a member-only channel that friction is the point. For a casual internal broadcast it’s overkill. This method is built for ticketed live events, paid webinars, and subscription channels, and you can see the guide on how to sell access to live streams for the full WooCommerce configuration.

Stream-Level Content Protection (AES-128 and CORS)

The third item isn’t a separate access toggle like the first two; it’s a stream-level protection layer that works alongside them, hardening whichever page-level gate you’ve chosen. It’s part of WpStream’s content protection, which ships with the paid plans. On those plans the video is delivered over HLS with AES-128 encryption (the scheme defined in RFC 8216, IETF, August 2017), and CORS (cross-origin resource sharing) rules stop other websites from hotlinking or embedding your player without permission. Decryption keys go only to authenticated sessions.

What this gates is the video segments in transit. Even if someone digs out the raw stream URL, they can’t decode the video without a valid key. WpStream’s content-protection page (updated February 2026) puts it this way: “A third party website will not be able to hot-link to your videos or live events, as that’s ruled out by means of secure key distribution and adequate cross-domain policies.” This layer pairs automatically with the page password or the WooCommerce gate above. (If your need is purely pre-recorded video with no live component, Presto Player is the simpler tool for that job; WpStream is built for live streaming and pay-per-view.)

Setting Up a Password-Protected Live Stream with WpStream

Here’s the full WordPress setup, in the order that works.

1. Install the WpStream plugin from WordPress.org and activate it. As of June 2026, the plugin’s WordPress.org listing shows 3,000+ active installs and a 4.8/5 rating from 78 reviews.
2. Create a channel: open the WpStream admin panel, go to Channels, and click Add New. Note the Channel ID in the channel settings; you need it shortly.
3. Create a new WordPress page. In the page editor, open Visibility, select “Password Protected,” and enter a password. Publish the page.
4. Add the player to that page. In the block editor, insert the WpStream Player block and pick the channel you just made. If you prefer a shortcode, drop this into the page and swap in your own Channel ID:

   [wpstream_player
       id="123"
   ][/wpstream_player]
   

5. Back in the WpStream admin, open the channel and toggle it to “ON.”
6. Open OBS Studio (or another RTMP encoder such as vMix, Wirecast, or StreamYard). In OBS Settings, choose Stream, select WpStream as the service, and paste the stream key from the WpStream channel settings. To go live directly from your browser instead of OBS, you need a Lite plan ($24/month) or higher; the free plan supports external RTMP ingest only.
7. Click Start Streaming in OBS, then confirm in the WpStream admin that the channel is receiving the signal (running a quiet test with one colleague before the real event is always worth ten minutes).
8. Share the page URL and password with authorized viewers only. Because WordPress keeps the password in a roughly 10-day cookie, a viewer who enters it once won’t be prompted again during that window.
9. To end the broadcast, click Stop Streaming in OBS, then return to the WpStream admin and toggle the channel to “OFF.”

So that free-plan caveat in step six is the detail most tutorials skip. Browser broadcasting is a paid feature; the free tier, which covers up to 50 concurrent viewers on one channel, expects an external encoder feeding it over RTMP.

Which access method is right for your stream?

The right method comes down to two questions: how much do you trust the audience, and do you need to collect revenue tied to individual identities? (Those two answers do most of the deciding for you.) Match your answer to the table.

And there’s one operational wrinkle for tiered events: running a VIP tier and a paid public tier at the same time needs two separate broadcast setups, one per channel, since each channel needs its own feed (yes, that means a second encoder running in parallel).

Stream-Level Encryption: Why the Second Layer Matters

Here’s the part most guides leave out. A WordPress password-protected page hides the player from unauthorized visitors. It doesn’t encrypt the video data itself. A technical user who discovers the raw HLS stream URL and shares it could try to play the stream directly, going around the page gate entirely.

On WpStream’s paid plans, AES-128 encryption closes that gap. Decryption keys are issued only to authenticated sessions, per the HLS specification (RFC 8216), so the stream URL on its own produces nothing playable. WpStream’s content-protection page states: “All live and VOD content is encrypted with AES-128, and decryption keys are distributed through your website’s built-in user authentication and restricted access logic.” This isn’t cause for alarm; it’s just how HLS delivery works, and WpStream’s approach to video content protection handles it at the delivery layer. So the page gate and the encryption layer solve two different problems, and serious setups want both.

Key Takeaways

• WordPress password-protected pages store the viewer’s password in a browser cookie that expires after about 10 days by default, gating the page, not the video stream.
• YouTube “Unlisted” is not password protection: anyone who receives the link can view and reshare the stream with no credential required.
• On its paid plans, WpStream encrypts every live and VOD segment with AES-128, so the stream stays protected even if the page URL circulates beyond the intended audience.
• WooCommerce pay-per-view and subscription gating via WpStream ties access to individual buyer accounts, enabling per-account revocation a shared password cannot provide.
• Layering a WordPress password page with WpStream’s paid-plan AES-128 encryption creates two independent barriers, one at the page level and one at the stream-segment level.

Frequently Asked Questions

Can you password-protect a YouTube live stream?

No. YouTube offers only Public, Private (invited Google accounts only), and Unlisted for live streams and videos. Unlisted is not a password gate; anyone who receives the link can watch and share it further. For a true password-protected live stream on your own site, WpStream’s WordPress plugin supports both page-level password gates and WooCommerce-based access control, neither of which YouTube provides.

What is the difference between unlisted and password-protected streaming?

Unlisted hides a stream from search results and channel listings, but anyone who receives the URL can watch and reshare it with no further check. Password-protected streaming requires viewers to enter a credential before the player appears. WpStream adds page-level password protection plus AES-128 stream encryption on its paid plans, giving you two layers of access control that an unlisted link on any platform simply can’t match.

Does a WordPress password-protected page also protect the video stream?

Not on its own. A WordPress password-protected page stops unauthorized visitors from reaching the player, but the video segments are delivered separately over HLS. If someone finds and shares the raw playlist URL, the page gate alone doesn’t stop playback. WpStream adds AES-128 encryption on its paid plans so decryption keys reach only authenticated sessions, and that’s the layer that protects the stream itself rather than just the page.

Is browser live streaming available on the WpStream free plan?

No. The WpStream free plan supports up to 50 concurrent viewers on one channel and requires an external RTMP encoder such as OBS Studio. Going live directly from a web browser requires a paid tier: the Lite plan at $24/month or the Plus plan at $59/month (pricing as of June 2026). The free plan is fully capable for streaming, it just expects OBS or a similar encoder to do the broadcasting.

As live streaming keeps moving from entertainment into core business and education infrastructure, controlling who watches a stream is becoming as operationally important as the broadcast quality itself. Corporate boards, paying students, and member communities all expect their access to be genuinely exclusive, not just hard to stumble across. And the fact that page-level password gating, WooCommerce ticketing, and paid-plan AES-128 stream encryption now live inside a single WordPress plugin means publishers no longer have to choose between an easy setup and real access control. That’s the direction password protected streaming is heading: layered by default, so private live streaming on WordPress can match the security each event actually demands.