The most searched word in Spotlightr’s help center is “download,” which tells you where most creators start worrying. But unauthorized downloads are only one of three problems. What follows are the steps that actually work to prevent piracy, ranked by what each one costs you in money, setup, and friction for the people you want watching.
How does video actually get pirated?
For course creators and small video businesses, video piracy rarely looks like a Hollywood torrent ring. It looks like your paid lessons showing up in a Telegram channel, a shared Google Drive folder, or a forum thread. .
Shared access. A link, a password, or a login gets passed around. One paying student becomes twenty viewers. Multiple people watch on the same credentials, and you never know who any of them are. The fix: knowing exactly who is watching, with named sign-in and device limits.
The file gets taken. Right-click and save, a browser extension, or the developer tools built into every browser. If the video stream can be pulled off the page as a downloadable file, it can be uploaded to other sites. The fix: locking the file delivery so there is nothing to grab – domain restrictions, encrypted delivery, and signed URLs that expire.
Screen recording. Someone plays the video and records their screen using screen recording tools like OBS, built-in OS recorders, or simply points a phone at the screen. This gets past every lock. It cannot be prevented, only traced back to the person who did it through digital watermarking and forensic watermarking.
Most creators put all their effort into blocking downloads and none into controlling access or watermarking – which is why their video files still end up in places they shouldn’t be.
What actually stops video piracy
Each step below stops something the step before it doesn’t, and each costs a little more – in money, in setup, or in friction for the people you want watching.
| Step | What it stops | What gets past it | What it costs you |
|---|---|---|---|
| 1. Know who’s watchingNamed sign-in, invite-only viewer lists, one watch per viewer, device limits | Shared links, shared passwords, one login passed around | Screen recording | One extra step for your viewers before they press play |
| 2. Lock the embed and the fileDomain restriction, no download option, encrypted delivery | Casual saving, and your video embedded on someone else’s site | Determined download tools, and screen recording | Almost nothing |
| 3. DRMWidevine and FairPlay | Download tools of every kind. The video can’t be played outside the authorized player | Screen recording — and a device that can’t run DRM, where the video plays unprotected | On many platforms an enterprise add-on or a monthly surcharge. On some, included |
| 4. Enforce DRMForce DRM | The unprotected fallback | Screen recording. Nothing else | A small number of viewers on unsupported setups can’t watch |
| Viewer watermarkNot a step — a different tool | Nothing. It identifies who leaked a copy | Nothing — it’s deterrence and tracing, not a lock | A visible name or email on the viewer’s screen |
Step 1 – Know who’s watching
Every viewer signs in as themselves – by email, with a one-time sign-in code, or from a list you control – so a forwarded link is useless to the person it was forwarded to. One watch per viewer and device limits stop a single login from being shared around. Be clear on one thing: a shared password is not this.
One password shared by everyone tells you nothing about who is watching and gives you no way to revoke a single person’s access. A cohort-based course might issue one-time sign-in codes per student. A membership site might limit each account to two or three devices. For some scenarios, like internal training videos, this step alone does most of the work.
Step 2 – Lock the embed and the file
Restrict playback to your own website using domain restrictions so your lessons cannot be embedded on someone else’s site. Geo-blocking restricts video access based on geographical location if you need regional limits. Disabling downloads prevents casual piracy of video content, and signed URLs provide time-limited access to video content so old links expire automatically. The goal is to avoid shipping a complete, static file that can be right-clicked and saved.
The browser must still receive the decryption key to play the video, which means encryption alone is not enough to fully prevent piracy. This approach breaks most browser extensions and basic “view source” attempts, though determined software tools with access to the key can still succeed.
For a deeper look at how to stop video file downloads, or specifically for preventing downloads on WordPress LMSes, those guides cover the details. These settings cost viewers nothing in extra friction – they simply stop unauthorized embedding and trivial saving.
Step 3 – DRM
DRM doesn’t hand the decryption key to the web page. It issues a license for each playback session to a protected module in the browser or device — hardware-backed on devices that support it — that no script on the page can reach.
Widevine covers Chrome, Edge, Firefox, and most Android devices. FairPlay covers Safari, iPhone, iPad, and Mac. Together, they reach the vast majority of viewers. The honest limit: on a device that can’t run DRM, many streaming platforms fall back to unprotected playback unless you enforce stricter behavior – and on many platforms, DRM is an enterprise add-on or surcharge. DRM is included on every Spotlightr plan, from $10. DRM protects playback wherever the device supports it; Force DRM blocks playback everywhere else.
Step 4 – Enforce it
Force DRM means the video refuses to play rather than playing unprotected on a device that can’t run DRM. That closes the last gap in content protection, at the cost of a few viewers on old or unusual setups who simply can’t watch. When is that trade worth it? Paid courses where premium content has real revenue at stake, licensed content a client owns, or anything that keeps showing up in piracy channels.
When isn’t it worth it? Free previews, lead magnets, and top-of-funnel content where you want everyone to be able to watch – enforcing DRM there just shrinks your reach. Because Spotlightr sets Force DRM on a per-video basis, a creator can keep previews open while paid modules are fully enforced, all within the same account. A small number of viewers on older browsers, corporate lockdown laptops, or unusual devices may be blocked, so be ready to tell those viewers which browser or device to use.
The viewer watermark – the answer to screen recording
Nothing stops screen recording. A viewer watermark puts viewer-specific data – the viewer’s name, email or IP address – on the video while they watch, so a recorded copy carries the identity of the person who made it. The trade-off is real: viewers see identifiable information on their screen, which some find distracting. That is why creators often reserve this setting for high-priced modules, repeat piracy problems, or compliance training where safeguarding content is non-negotiable.
Here’s the real-world flow: watermarking helps identify the source of pirated content – when a leaked copy surfaces, you check the overlay, revoke that account’s access, document the leak, and send DMCA takedowns with clear proof. Dynamic watermarking complements DRM by tracing leaks to users. For configuration details and placement options see Spotlightr’s video watermarking guide. It’s off until you switch it on.
Which steps do you need?
The right stack depends on what you are protecting and who you are protecting it from.
A free lead magnet or preview. You want it shared. Step 2 at most – lock the embed so it can’t be lifted onto someone else’s site, disable unauthorized downloads – but don’t enforce DRM. The whole point is reach, and a leaked preview is free marketing.
A paid course. Steps 1 through 3 as standard: named viewer identity, locked embed and file, DRM-encrypted streaming. Enforce DRM on the paid lessons. Add the viewer watermark if the course is high-priced, evergreen, or keeps turning up in places it shouldn’t. If you are still choosing a video hosting platform that can support these security measures, look for one that includes DRM on every plan rather than locking it behind enterprise pricing.
Licensed or client-owned content. Everything: steps 1 through 4 and the viewer watermark. Someone else’s contract usually sets the bar for content distribution security, and “it played unprotected on one device” is not an answer a rights holder will accept.
Internal training. Step 1 does most of the work for internal training videos: named viewers, device limits, and access that ends when someone leaves the company. Add DRM if the material is sensitive – legal, financial, or proprietary R&D training where unauthorized sharing would be a serious problem.
Your video is already out there – what now?
If you have found pirated content on a forum, a Telegram channel, or a file-sharing site, here is what to do, in order.
1 – Find out whose copy it is. If the video carried a viewer watermark, the name or email is on it. If not, compare access logs and timestamps against when the copy appeared – but without a watermark, attribution is mostly guesswork.
2 – Revoke that person’s access. Disable their account and audit whether any other sign-ins look suspicious. Close the door before more copies come through.
3 – Send a takedown notice. Most hosting companies and platforms have a copyright form. In the US, this is a DMCA notice.
4 – Ask search engines to remove the link. Google’s copyright removal tools help even when an offshore host drags its feet on DMCA takedowns.
5 – Keep a record. Screenshots, dates, links, watermark details – keep everything in one place. This matters for legal action and for spotting patterns if it happens again.
6 – Close the gap it came through. Go back to the table above. Did the leak come from shared access, file theft, or screen recording? Enable at least one more protective step on that route.
This is general guidance, not legal advice. Recurring or commercial-scale unauthorized distribution is a good reason to speak to a lawyer familiar with copyright and content protection law.
What doesn’t protect your video (much)
Disabling right-click. This only hides the browser’s context menu. It does nothing against developer tools, download tools, browser extensions, or screen recording. Bad actors bypass it in seconds.
Unlisted links. Hidden from search engines, but anyone holding the link can watch and pass it on. This is not access control – it is security through obscurity, and it is a common form of false confidence.
A single shared password. One person shares it and everyone has it, with no way of knowing who is watching. A password shared by a group is not password protection in any meaningful sense. For how to move from a shared password to per-viewer access, this guide covers the options.
“Encrypted at rest.” Some platforms advertise that video data is encrypted in storage. That protects the file on their servers – not the video once it is streaming in someone’s browser. Encryption at rest is a server security feature.
Questions people ask
Can you completely prevent video piracy?
No. Screen recording gets past every protection – including DRM, encryption, and access control. What you can do is make taking the file impossible, make unauthorized access useless, and make a recorded copy traceable to the person who made it. Layering access control, DRM, and a viewer watermark is what lets most content owners keep piracy to a manageable nuisance rather than a business-threatening problem. That combination is the best protection available.
Does DRM stop screen recording?
Partly. On Apple devices, FairPlay can cause protected video to record as a black screen in some screen recording tools. On most computers, it does not block capture, and nothing stops a phone pointed at a screen. That is why DRM must be paired with video watermarking: DRM protects the file and enforces playback rules; watermarks deter leaks and trace recordings.
Is encryption the same as DRM?
No. Standard video encryption scrambles data in transit, but the decryption key still reaches the viewer’s browser, where determined tools can find it. DRM adds a protected license system where keys live in a secure part of the device and expire after the viewing session. HLS streaming with encryption is an additional layer, but it is not DRM. For a deeper explanation of how digital rights management differs from encryption, that guide covers the technical details.
What happens if a viewer’s device can’t play DRM?
It depends on the platform. Some silently fall back to unprotected playback. Others fail with a generic error. On Spotlightr, it is your choice per video: by default, the video plays unprotected where DRM is unavailable. With Force DRM turned on, it won’t play at all on unsupported setups. If you sell paid content, test your audience’s common devices before enforcing DRM across your entire catalog.
How do I find out who leaked my video?
Use a viewer watermark. Each viewer sees their name, email, or IP address overlaid on the video during playback, so leaked copies literally carry the leaker’s identity. Without a watermark, you are left comparing sign-in records and IP addresses against the date the pirated copy appeared, which rarely points to a single person. For setup details and placement options, the watermark configuration guide walks through the full process.
How often should I check for piracy?
Set up a Google Alert for your course name and key lesson titles. A monthly check of common piracy channels – forums, Telegram groups, file-sharing sites – catches most leaks before they spread. Regular monitoring is more effective than a single annual audit.
How do I tell honest students about security without scaring them?
Add a short, friendly note in your onboarding email: mention that lessons are watermarked for their protection and that each account is limited to a set number of devices. Frame it as protecting valuable content they paid for – most students appreciate it rather than resent it.
Spotlightr Video Hosting With DRM
Spotlightr includes Widevine and FairPlay DRM on every plan, with Force DRM
per video, device limits, and one-time sign-in codes.
Register for a free 2 week trial, no credit card required.
Bill is the founder of Spotlightr, a video platform used by course creators, membership sites and marketers who need their video hosted properly rather than uploaded somewhere and hoped for. He writes about instructional video from the inside — what creators actually publish, where students actually stop watching, and what the platforms in this category actually charge. He’s currently building Spotlightr Courses, a course product built around the video rather than bolted on top of it.