How to protect course videos in WordPress

The short answer: you cannot make a video impossible to copy in a browser, but you can make copying inconvenient and traceable. Put every lesson behind a member login, limit where the embed can play, cap how many devices one account can watch on, show the viewer’s name on the video while it plays, and watch your analytics for odd patterns. Those five steps stop most casual sharing on a WordPress course site. If you need encrypted playback, you need a DRM host, which is a different product.

This guide walks through each step with the actual settings in MediaShield, a WordPress player for course video hosted on YouTube, Vimeo, Wistia, Bunny Stream or your own server. Most of the advice applies whatever tool you use.

What “protecting” a video can and cannot mean

Before touching a setting, be clear about which problem you are solving, because the word “protect” covers four different things:

1. Only paying students can press play. This is access control, and WordPress can do it well.
2. The video cannot be shown on someone else’s website. This is embed control. Your host and your player can both help.
3. One paid seat is used by one person. This is login sharing, and it is the most common leak on course sites.
4. Nobody can ever keep a copy. This is the one no WordPress plugin can deliver. A student can point a phone at the screen, or run a screen recorder. Encryption (DRM) stops downloader tools, not cameras.

So the realistic goal is the first three, plus making the fourth traceable. A recording that shows the student’s name is a recording they think twice about posting. That is the model the rest of this guide follows.

One more ground rule: a protection layer only covers the videos it knows about. In MediaShield, that means videos added to its library. A video you paste raw into a post and never add to the library plays as a plain embed. MediaShield does wrap a library video wherever it appears, including in a standard YouTube or Vimeo embed block, but it cannot protect what it has never been told about.

Step 1: Gate the page and the player by login and role

Your course or membership plugin probably already hides lesson pages from logged-out visitors. That is a good start, but the video embed itself does not know about it. Copy the embed code out of the page source and it plays anywhere. So gate the player too.

In MediaShield:

• Require Login under MediaShield > Settings > General is on by default. A logged-out visitor sees a login message where the player would be. You can change the wording under Login & Access Messages.
• Restrict to Role on each video limits it to one WordPress role. Most membership plugins assign a role per level, so a premium lesson can be restricted to the premium role. The match is exact: a video for one role does not open to another just because it sounds more senior. Administrators always pass.
• Protection Level on each video should be Standard for paid lessons. Standard turns on the login gate, the watermark and session tracking. Basic gates the video but records nothing and shows no watermark, and None is a free preview with no gate at all. Use None deliberately for a sample lesson.

If you run LearnDash, Tutor LMS or LifterLMS, MediaShield Pro adds Require enrollment to watch on the video, so only students enrolled in the course that contains the linked lesson can play it. See LMS and course plugins.

Add your first video with this walkthrough, and read access control for the order the checks run in.

Step 2: Restrict where the embed can play

A gate on your page does nothing if the video can be embedded on another site. Close that from two sides.

On your host. Vimeo’s paid plans offer domain-level embed privacy and Hide from Vimeo. Bunny Stream has token authentication and hotlink protection. YouTube offers unlisted videos, which keeps them out of search but does not restrict embedding. Use whatever your host provides, because the host is the only party that can refuse to serve the stream.

In WordPress. MediaShield’s Allowed Domains setting lists the domains, comma separated, where your MediaShield players may run. Your own domain always passes. Requests from other domains, or with no referer at all, are refused with the access denied message.

Be honest with yourself about what this is. A referer check is a courtesy fence: it stops casual reuse, and a determined person can forge a header. That is why the host’s own setting matters too.

About hiding the video address. For files on your own server, MediaShield’s Hide Video Source URL setting (on by default) stops the page printing the file address and plays it through a permission-checked address instead, so a copied link is useless without access. That works for self-hosted video only. A YouTube, Vimeo, Wistia or Bunny embed has to contain the host’s video ID to play at all, so no plugin can hide it. Treat any product that claims otherwise with suspicion.

One more self-hosted detail: MediaShield protects its upload folder with an .htaccess rule, which Apache honours and nginx ignores. On nginx, add the rule MediaShield shows under Tools > Site Health, or the files stay downloadable by address. See troubleshooting.

Step 3: Stop one login being shared

A student who gives their password to three friends has turned one sale into four viewers. You do not need to catch them in the act. You need to make the shared login stop working well.

MediaShield’s Max Concurrent Streams (under Settings > Concurrent Streams) limits how many devices one account can watch on at the same time. The default is 2, which covers a laptop and a phone. When a third device tries to start a lesson, it is told: “Too many active streams. Please close another video first.”

A few details make this fair to real students:

• The player sends a heartbeat every 30 seconds, and a device that has gone quiet for 5 minutes stops counting. Closing a laptop does not lock someone out for long.
• Closing a tab ends the session straight away.
• Several players on one page count as one device, not several.
• Guests are never counted, because there is no account to share.

Pick the number for your audience. A family plan might be 3 or 4. A per-seat corporate licence might be 1. There is more on reading sharing patterns in how to stop students sharing logins, and the setting itself is on stop shared logins.

Step 4: Add a watermark that names the viewer

This is the step that changes behaviour. A recording with the student’s name drifting across it is not something most people will post in a group.

MediaShield draws the watermark over the player for every video at Standard or Strict protection. In the free plugin it shows the viewer’s display name and IP address. The settings live under MediaShield > Settings > Watermark:

• Opacity, 0 to 1, default 0.5. Around 0.3 to 0.5 is readable without being annoying.
• Color, default white. Pick what reads against your footage.
• Position Swap Interval, default 30 seconds. The watermark moves between the four corners and the centre. A shorter interval, 10 to 15 seconds, covers more of the frame over time and makes cropping it out much harder.

Pro lets you choose from seven fields: username, email, IP, user ID, timestamp, site name and your own text, plus font size and badge control. A timestamp is useful when you need to know which session a recording came from.

The watermark is an overlay drawn in the browser, not burned into the video file. That is what lets it show the current viewer’s name, and it also means anyone with the original file has a clean copy. If someone removes or hides the watermark element with developer tools, MediaShield pauses self-hosted video and hides platform players rather than playing on unmarked. There is a full guide in video watermarks for WordPress and the settings are on viewer watermark.

Step 5: Watch the analytics for odd patterns

Protection that nobody looks at decays. Ten minutes a week with your analytics tells you whether the steps above are working.

MediaShield records a watch session for every Standard or Strict playback. The Dashboard shows sessions, average completion and active viewers for the last 7, 30 or 90 days. Viewers lists every student with videos watched, average completion and last active time, and opens each student’s history. Things worth noticing:

• An account that has watched every lesson in a few days, far faster than anyone else.
• A student who keeps running into the stream limit.
• A video with far more sessions than enrolled students.

Pro adds a Realtime screen of who is watching now and an Alerts screen that flags an account starting sessions from many IP addresses in a short window, a viewer opening developer tools, and rapid seeking to the end. These are flags on a screen; no alert email is sent, so the habit of looking matters. See watch analytics.

What no plugin can stop

To keep expectations honest, here is what remains possible after every step above:

• Screen recording. Any student can record their screen or film it with a phone. The watermark makes that recording traceable, not impossible.
• Cropping a recording. A moving watermark is hard to crop out without losing much of the picture, but it can be done by someone determined.
• Downloading a platform video from the host. If the host itself serves the file to anyone with the ID, that is a host setting, not something a WordPress plugin controls.
• Copies made from the original file. An overlay watermark is not in the file.

If any of these is unacceptable for your content, look at a DRM host. MediaShield does not offer DRM, and the VdoCipher comparison says plainly when that trade is worth paying for.

Choosing a host for protected course video

MediaShield plays from five places, and each has a different profile:

For most paid courses, Vimeo with domain privacy or Bunny Stream with token authentication, plus a WordPress layer for members, is the sensible middle. More detail is on keep your video host, MediaShield and Vimeo and MediaShield and Bunny Stream.

Common questions

Can I stop students downloading my course videos?

You can stop the easy ways: right-click saving is blocked, self-hosted file addresses are hidden behind a permission check, and embeds can be limited to your domain. You cannot stop screen recording or a determined copier. A viewer watermark makes any recording traceable to the account that made it.

Is YouTube unlisted safe enough for paid lessons?

Unlisted keeps a video out of search, but anyone who gets the video ID can watch it on YouTube itself. Gating the player on your site helps, and the watermark still names the viewer on your site, but for paid lessons a host with domain-level privacy, such as Vimeo on a paid plan, or token authentication, such as Bunny Stream, is safer.

Does MediaShield protect every video on my site automatically?

It protects every video in its library, wherever that video appears, including standard YouTube and Vimeo embed blocks. A video never added to the library passes through untouched.

Do I need Pro for this?

No. Login and role gates, allowed domains, the viewer watermark, the stream limit and per-student analytics are all in the free plugin. Pro adds LMS enrolment gating and completion, heatmaps, realtime viewers, suspicious viewing flags, more watermark fields and CSV and PDF exports. See pricing.