Secure Video Hosting
Secure Video Hosting: What Each Layer Stops
Encrypt the stream. Lock it to your site. Choose who presses play.
Encryption, domain lock, and paid access each stop specific leaks. None can stop a phone aimed at the screen. Protect live and recorded video on your own site.
Paid Cohort Masterclass
Broadcast from Your Course WebsiteProtect a paid stream in three steps
Decide who presses play
Sell a WooCommerce product for pay-per-view, offer subscriptions, or create a free channel on a members-only page. For pay-per-view or subscription products, visitors without a paid order see a buy button.
Turn on encryption and sessions
Enable "Encrypt Live Stream" in the channel settings, then use "Sessions with Encryption." This only works with encryption active. Recordings have their own "Encrypt Video" setting.
Lock the player to your site
Enable "Lock to Website" for the channel and its recordings. Other sites can't embed your protected stream or its replay; viewers can only share the link to your page.
Control access through your WordPress users. Offer private, password-protected, subscriber-only or pay-per-view streams on your own site.
No single layer stops every leak
Encryption in transit stops interception, and stream encryption with authenticated keys prevents downloaded files from playing.
A domain lock stops embedding and hotlinking on other sites. Access control stops non-payers, while DRM binds playback to a licence checked inside a decryption module. No single layer can stop every leak.
Private is not secure. You can hide the page the video sits on, or you can gate the stream itself, and even a gated stream is just one layer.
"Piracy is a complex issue that cannot be addressed with a single solution or by targeting a single use case," says Brett Sappington of Parks Associates.
WpStream includes Content Protection in every plan. Its stack uses AES-128 encryption with keys delivered through your site's login and access rules, plus Lock to Website and access control. This is not DRM. Encryption and the lock are settings you activate per channel and video.
Five Layers and What Each One Misses
A secure video platform needs several layers, each addressing a specific threat. Each layer stops one kind of leak:
Encryption in Transit (HTTPS/TLS)
Stops: Eavesdropping and tampering on the network.
Does not stop: Anything the authorized player receives.
Stream Encryption (AES-128 Keys)
Stops: Segment files downloaded and played without the key, and hotlinking.
Does not stop: Logged-in sessions that got the key legitimately or screen recording.
Domain Lock (Lock to Website / CORS)
Stops: Embedding your live stream or recording on other sites.
Does not stop: Non-browser clients, modified Referer headers, or viewers sharing links.
Access Control (Paid Order, Members Page)
Stops: Strangers and non-payers.
Does not stop: Login sharing or forwarded passwords.
DRM (Widevine, FairPlay, PlayReady)
Stops: Decryption outside a licensed module and screen capture on certified devices.
Does not stop: A phone camera aimed at the screen or recording in desktop Chrome.
WpStream is not DRM. For its stack, "the relevant layer is AES-128 with authenticated key delivery rather than hardware DRM."
Which Layers Your Stream Needs
WpStream's DRM guide sizes protection based on three questions: what one session is worth, how much you trust the audience, and the content's value duration.
"For a live event, the piracy window is measured in hours." For a VOD library, "the window is open-ended".
Cohort Course
A costly leak occurs when a class link is forwarded.
Fitness Class Library
Members sharing one login is a common issue.
Licensed Live Match
Risks include restreams and embeds of licensed programs.
Member Association Session
Links shared to a members-only meeting can cause issues.
Free Public Stream
Other sites may still use your stream without payment.
Studio-licensed catalogue
If the licensor requires Widevine or FairPlay, you need a DRM provider, and Apple approves FairPlay only if your team provides "a streaming service to consumers."
WpStream is not DRM, so it is the wrong tool for this rights holder's catalogue.
What Gets Through
Every Layer
Screen Recording
The Screen Capture API allows users to record a screen.
Shared Logins
Netflix found over 100 million households using shared passwords.
Live Restreams
Illegal streams reached millions during major events.
Layer by Layer
Which layer stops which leak?
Each layer stops specific leaks. A paywall doesn't stop a phone aimed at the screen. Secure video streaming means understanding which gaps each layer leaves open.
A forensic watermark is a separate tool. It identifies the leak's source but doesn't prevent it.
| Layer | What it stops | What it does not stop |
|---|---|---|
| Layer: Encryption in transit (TLS) | What it stops: Eavesdropping and tampering on the network | What it does not stop: What the authorized player receives (our view) |
| Layer: AES-128 with authenticated keys | What it stops: Segment files played without the key; hotlinking | What it does not stop: A session holding the key; screen recording |
| Layer: Lock to Website / CORS | What it stops: Embeds of your stream on other sites | What it does not stop: Non-browser clients; links to your own page |
| Layer: Access control | What it stops: Strangers and non-payers | What it does not stop: Login sharing; a paying viewer recording |
| Layer: DRM | What it stops: Decryption outside a licensed module; capture on certified hardware | What it does not stop: Phone cameras; screen capture in desktop Chrome |
| Layer: Forensic watermark (separate tool) | What it stops: Nothing in advance; traces the leak source | What it does not stop: The leak itself |
Protect Live and Recorded Video in WpStream
WordPress secure video streaming with WpStream relies on settings you turn on. Set defaults in Default Channel Settings and VOD Settings, then override them per channel and video for secure live streaming and replays.
Encryption "may not work on some browsers," so test on your users' browsers. Selling tickets? See how to sell access to live streams.
Product
Sell or restrict the stream
You can sell a WooCommerce product for pay-per-view, offer a global subscription, or create plans per course or class track. A free channel can also be placed on a members-only page.
Channel
Encrypt Live Stream, then Use Sessions
Set both in Default Channel Settings for new channels; each channel's own settings override them. "Use Sessions with Encryption" is a crucial step and it only works with "Encrypt Live Stream" active.
Player
Lock to Website on channels and videos
Enable "Lock to Website" for each live channel so the stream shows only on your site. In VOD Settings, the same option blocks attempts to embed a recording elsewhere.
Replay
Lock and encrypt the recording
Set Encrypt Video and Lock to Website as defaults in VOD settings.
Live to Replay
The replay retains the same buyers
After a live event, the organizer changes the product from Live stream to Video on demand and selects the recording. Everyone who bought a ticket keeps access and watches the replay without paying again. The recording has its own Encrypt Video and Lock to Website settings. A 2-hour recording uses 2 recording hours.
Video unavailable. Please try again later.
Every plan card lists Content Protection. Protected streams use hours like public ones.
Lite
As of September 2026, Lite costs $24 a month or $190 a year. This plan includes 100 broadcast hours, 500 viewer hours each month, 25 recording hours, 200 simultaneous viewers, and 5 live channels.
Plus
Plus costs $59 a month or $490 a year. It offers 250 broadcast hours, 2,000 viewer hours, 100 recording hours, and 1,000 simultaneous viewers.
Pro ($169 a month: 1,000 broadcast hours, 10,000 viewer hours, 500 recording hours) and Ultra ($449 a month: 4,000 broadcast hours, 50,000 viewer hours, 1,500 recording hours) cater to larger libraries and events. Each plan adds more hours and costs more.
The trial
"Private, protected, free, and pay-per-view streams use resources the same way." One-time plans start at $36, and their hours don’t expire. You can start a free trial with no credit card.
If Something Leaks
What should you do if a protected stream leaks?
If you identify the leaking account, revoke it. Access links to each WooCommerce account, so one login can be revoked without affecting others. If the stream was behind a shared password page, change the password.
Next, check these settings: Encrypt Live Stream, Use Sessions with Encryption, Encrypt Video on recordings, and Lock to Website. Act quickly for live events.
As WpStream's DRM guide states, "the piracy window is measured in hours" and content "loses most of its money value once the event ends." Tracing a leaked copy back to its account requires a forensic watermark, a separate specialist tool. Choose one before the next licensed program, not after the restream.
More on Video Protection
What Is Video DRM and How Does It Work?
Most video content protection stops casual copying, not determined pirates. That’s the honest starting point.
Video Content Protection and Encryption
In online video, we protect your content with restricted access and encryption.
How do I restrict video content to paying subscribers on WordPress?
WordPress alone cannot restrict video to paying subscribers. You need a plugin that keeps a paid record for each viewer and checks it before the player loads.
Secure video hosting questions
No. Private hosting hides the page, so strangers can’t find the video. Secure hosting controls who can play the stream and where it plays: encryption, domain locks, and access rules tied to paid members. WpStream’s private streaming guide compares both.
Not by itself. A WordPress password page only gates the page, not the video. Anyone can share that password. Account-based access is more reliable: with WpStream, access ties to each WooCommerce account, allowing you to revoke one login without affecting others.
Only at hardware security levels on certified devices. Desktop Chrome and Firefox on Windows and macOS support only Widevine’s software-only L3 level, according to bunny.net’s docs. No DRM stops a phone camera aimed at the screen.
WpStream is not DRM. If a licensor requests it, read how video DRM works first.
No. WpStream offers AES-128 encryption, which you activate for each channel and video. Keys are issued through your site’s login and access rules, plus Lock to Website and access control. If a contract requires Widevine or FairPlay, you need a DRM provider for that content.
Encryption is a setting. In WpStream, enable Encrypt Live Stream, then Use Sessions with Encryption per channel, and Encrypt Video per recording. Encryption “may not work on some browsers,” so test the protected stream on your paid members’ browsers before a paid event.
Lock to Website prevents this. Viewers “will not be able to take your live stream and embed it on another website.” They can still share the link to your page, and browsers enforce the cross-domain rule, so encryption and access control matter.
Yes. WpStream’s pricing FAQ states: “Private, protected, free, and pay-per-view streams use resources the same way. Broadcast Hours count the live streaming time, and Viewer Hours count the viewer watch time.” Protection does not change how hours are counted.
Secure video hosting can block file access. Encrypted segment files won’t play without the key. WpStream describes Encrypt Video as “preventing unauthorized access, downloading, or redistribution of your video files.” A logged-in member can still record the screen, so combine encryption with account-based access that you can revoke.
Ready when you are
Start your free trial
Try live broadcasting and replays on your website.