To share videos privately with members on WordPress, host the video where only logged-in members can reach it, then place it on a page that only the right members can open. You have three real options: upload the file to your own site, embed it from a video host that supports private embeds (Vimeo, Bunny Stream or Wistia), or let members upload their own with a media plugin such as MediaVerse. None of them can stop a determined person from screen recording.
Product details here were checked against each vendor’s own help pages in October 2026. Plans and settings change often, so confirm anything that affects your budget on the vendor’s site.
In this guide
- What “private video” actually means, and the two layers you need
- Where to host: your own WordPress site versus a video host
- How Vimeo, Bunny Stream and Wistia handle private embeds
- Letting members upload and share their own videos
- Gating the page: membership tiers and private Spaces
- Can you stop people downloading or copying a video?
- Bandwidth, storage, captions and mobile playback
- A comparison table
- How to set it up, step by step
- Questions people ask
What does “private video” actually mean on WordPress?
A private video is one that only the people you choose can watch. On WordPress that takes two separate layers, and most failed setups only build one of them.
The first layer is the page. This is the post, lesson or Space where the video appears. You decide who can open it, usually by login, by membership tier or by group.
The second layer is the video file itself. Even if the page is locked, the file or embed sits at an address. If that address works for anyone who finds it, the lock on the page protects very little. Someone with the link can paste it into a browser, or share it in a chat.
Think of a house. The page is the front door, and the video file is the window. A good lock on the door does not help if the window is open.
Every option below is really a different answer to the same question: how do I lock the window as well as the door?
Should I host the video on my own WordPress site?
You can, and for a few short clips it is the simplest route. For anything long, or for many members watching at once, a dedicated video host usually works better.
WordPress has a built-in Video block. According to the WordPress documentation, it lets you upload a file from your computer, pick one from the Media Library, or insert a URL. It also supports text tracks in WebVTT format, which is how you add captions and subtitles. That makes self-hosting a reasonable starting point for a small library.
The limits show up quickly, and they are about your server, not about WordPress itself.
- Upload size. Your hosting company sets a maximum file size through PHP settings (
upload_max_filesizeandpost_max_size). Many hosts set it low. You can often raise it, but some plans do not allow it. - Bandwidth. Every member who plays a video pulls the whole file from your server. Ten members watching a 500 MB lecture is 5 GB of transfer. Shared hosting plans can throttle or suspend sites that do this.
- One file for every screen. A video host makes several versions of each video at different quality levels and switches between them as a viewer’s connection changes. A plain file on your server is one version. A member on a weak mobile connection gets a stalled player.
- The file is a normal file. Files in the Media Library have public URLs by default. Anyone who learns the address can open it without logging in, no matter how well you locked the page. Closing this gap needs extra work, such as serving files through a protected route.
Self-hosting makes sense when you have a handful of short videos, a modest member count, and a host that allows large uploads. It is a poor fit for a course library or a community where people watch hour-long sessions.
How do Vimeo, Bunny Stream and Wistia handle private video?
Each of these services lets you hide a video from the public and limit where it can be embedded. They differ in how, and in what else they offer. All three were checked against their own pages for this guide.
Vimeo
Vimeo’s help center lists several privacy settings for each video. As of October 2026 these include Public, Unlisted, Password, Embed only, and Private. Unlisted keeps a video out of search results, but anyone with the link can still open and share it. Password requires viewers to enter a password first. Embed only means the video is not viewable on Vimeo.com but can play on other sites. Private means the video is viewable only by you and your team members, and Vimeo says other people cannot see it, even if it is embedded elsewhere.
The setting that matters most for members-only sites is domain-level privacy. Vimeo’s help article says you can specify and manage up to 50 domains where your video can be embedded, and that any site not on your list receives an error when it tries to embed the video. You set it by opening the video’s settings, choosing Share, then Embed, and picking “Specific domains” under “Where can this be embedded?”. Vimeo states this feature is included with all plans.
The practical effect: if someone copies your embed code and pastes it on their own site, the video does not play there. It still plays on your site, where your members log in.
Bunny Stream
Bunny Stream is a video hosting service from bunny.net. Its features page lists captions generated with one click, a player, token authentication and enterprise DRM, and says videos are transcoded into multiple resolutions.
The part that matters here is token authentication. Bunny’s documentation says that once it is enabled, every embed request to the iframe must include a valid token and expires pair. The expires value is a Unix timestamp, and after that time the URL stops working. The token is a SHA256 hash built from your token security key, the video ID and the expiry time. The docs say to generate tokens on the server and never to expose the key in client-side code.
That is a signed URL. In plain terms, your site creates a short-lived link for a logged-in member, and the link stops working after a set time. A link copied from a member’s browser expires. The catch is that this takes server-side code, so it suits sites where a developer, or a plugin built for it, handles the signing. Read Bunny’s own documentation before you promise this to a client, because it is a setup step and not a toggle.
Bunny’s documentation also shows a DRM license endpoint for MediaCage Enterprise, but the page does not explain DRM setup in detail. If DRM matters to you, ask Bunny directly what it covers.
Wistia
Wistia calls its version domain restrictions. Wistia’s help center says it is an account-level setting, so it cannot be turned on for a single video, folder or channel. When it is on, embeds display only on domains you add to an allowlist. The player checks the parent page’s referrer against the list, and a blocked viewer sees “This video is not authorized to be embedded here.”
A few details from the same article are worth knowing before you rely on it. You enter domains without the http:// or https:// prefix. A root domain covers its subdomains. Channels cannot be reached through share links while the setting is on. Removing, modifying, delaying or self-hosting Wistia’s player script breaks detection. If your embed sits inside a non-Wistia iframe, such as some page builders, the player may detect the iframe’s domain instead, so test on the live page and not in a builder preview. The article does not say which plans include the feature, so check Wistia’s pricing page.
What none of these give you
Domain restrictions answer “which sites can show this video”. They do not answer “which members can watch it”. That is still the job of your WordPress page lock. A domain restriction stops outsiders embedding your video elsewhere. It does not stop a logged-in member from sharing their own login.
Can members upload and share their own videos?
Yes. If your community is the source of the videos and not just the audience, use a plugin built for member uploads. MediaVerse (wpmediaverse.com) is Wbcom’s media plugin, and Wbcom makes Reign, so weigh this section with that in mind.
MediaVerse’s site says members upload photos, video and audio from the front end. It says privacy is set per item and per album, not once for the whole site, and that members can sort uploads into albums and choose who can see each one. A grid block lets you place a gallery on any page, filtered by tag, category, media type or member. The site also lists a reporting and review queue, where members report content, you review it, and a log records who did what.
Two limits are stated on the site. MediaVerse does not transcode video, so files play as members uploaded them. And an optional storage limit per member is available. If members will upload long or large videos, those two facts matter for your hosting bill. Check the product page for the storage options available to you.
If you only publish videos yourself, a hosted service with private embeds is usually the better choice. If members are meant to post to each other, MediaVerse is built for that. Our guide to building a media-rich community with Reign and MediaVerse covers the community side in more detail.
How do I make sure only the right members can open the page?
Lock the page with a membership level or a private Space, not with a hidden link. A hidden link is not access control. It is a guess that nobody will find the address.
There are two common patterns.
Gate by membership. Members pay or are granted access, and the video page is visible only to members with the right level. BuddyNext (buddynext.com) includes native Stripe membership tiers, so you can sell access and gate content without a separate membership plugin. Our guide to building a paid community on WordPress with Stripe walks through that setup, and the one on selling courses on WordPress with Stripe covers it for lessons.
Gate by Space. BuddyNext Spaces can be open, private or secret. If you run a mastermind, a cohort or a premium group, a private or secret Space is a natural home for a recording, because the audience is whoever you let into the Space. Check the BuddyNext product page for exactly how each type behaves before you rely on it.
You can combine the two: a paid tier that grants entry to a private Space. For the wider picture of locking down a whole site, see our guides on building a private social network on WordPress and creating a members-only content area.
Pair the page lock with the file lock from the earlier section. A private Space with a public video file behind it leaves the window open.
Can I stop people downloading or copying a video?
No. Nothing can stop a determined person from recording their screen, and no honest vendor will tell you otherwise. What you can do is raise the effort and make leaks traceable.
Consider what a viewer can always do. A video you can watch is a video you can point a phone camera at, or capture with screen-recording software. Anything on a screen can be recorded. So the realistic goals are narrower:
- Stop casual downloading. Hide the direct file address and block the right-click menu, so a member cannot simply save the file.
- Stop link sharing. Use domain restrictions, or short-lived signed links, so a pasted address stops working.
- Make leaks traceable. Overlay the viewer’s name on the video. A person is less likely to post a recording that has their own name running across it.
- Limit account sharing. Cap how many streams one login can run at once. Our post on stopping course account sharing covers what to check in a course plugin.
MediaShield, Wbcom’s video protection plugin
MediaShield is a Wbcom plugin built for exactly this, so the usual disclosure applies: we make it. Its product page says it protects video with viewer-specific watermarks, session tokens and anti-download blocking, and reports on who watched and how far they got. It supports self-hosted files (MP4, WebM, MOV and M4V) as well as YouTube, Vimeo, Bunny Stream and Wistia embeds.
The page describes a moving overlay showing the viewer’s display name and IP address on top of the player, access control by login and role, and per-user stream caps. It describes the blocking as aimed at casual ripping. On screen recording, the page does not claim to prevent it. It says the name and IP ride the video and move position, so a screen recording still names the leaker.
For DRM, the page says a software DRM using AES-128 is available and that hardware-backed Widevine L1 is not included. Check the product page for which licence covers what, and treat software DRM as a deterrent and not a guarantee.
That honest framing is the right one for any tool in this category. If a plugin promises “100% unrecordable video”, walk away.
How much bandwidth and storage will private video use?
More than you expect, and it grows with every member. Video is the heaviest thing most community sites ever serve.
A rough way to plan: multiply the file size of a video by the number of members who will watch it. A 1 GB recording watched by 100 members is about 100 GB of transfer if it is served as one file from your own server. A video host spreads that load across its own network, and creates smaller versions so most viewers download less.
Storage works the same way. A course with 40 lessons of 300 MB each is 12 GB before you add backups. WordPress backups that include the Media Library will carry that weight too, which makes every backup slower and larger.
That is why a video host is the usual answer once the library grows. You keep the pages and the member data in WordPress. You keep the heavy files elsewhere. For a community where members upload their own videos, set a per-member storage limit if your plugin offers one, and watch your host’s disk usage in the first month.
Are my private videos accessible, with captions?
Add captions. They make video usable for deaf and hard-of-hearing members, for people watching on mute, and for members who are not fluent in the language.
The Web Content Accessibility Guidelines (WCAG) 2.1 success criterion 1.2.2 is a Level A requirement. It asks that captions be provided for prerecorded audio in synchronized media. The W3C guidance says captions should go beyond dialogue: they should identify speakers and include meaningful non-speech sounds.
How you add them depends on the host.
- WordPress Video block. Upload a WebVTT file through the Text tracks option. The documentation lets you set a label, a source language and a kind, including Captions, Subtitles, Descriptions and Chapters.
- Bunny Stream. Its features page lists AI-generated captions with a single click. Review the output before you publish. Automatic captions make mistakes with names and technical terms.
- Vimeo and Wistia. Check their help pages for the current caption steps, since menus change.
Captions are also useful to you. A written transcript is searchable, so a member can find the moment a topic came up instead of scrubbing through an hour.
Will private video play well on phones?
It can, if you plan for it. Most members will watch on a phone at some point, often on a mobile connection.
Three things matter. First, the video must adapt to the connection. Hosted services that create several quality levels do this. A single large file from your own server cannot. Second, the player must fit the screen without horizontal scrolling. Make sure the theme gives embeds a responsive container. Third, the page lock must work on mobile too. Test the login flow on a real phone, because that is where members get stuck.
BuddyNext lists a PWA among its features, which lets members add the site to their home screen, and a mobile app is in development, so do not promise members an app today. Always test your own setup on a phone.
If you use a signed link or token, test on a mobile browser in particular. A link that expires while a member pauses the video to answer a call can show an error on resume. Set the expiry longer than your longest video, not equal to it.
Which option should I choose?
The right option depends on who uploads, how long the videos are, and how much protection you need. This table compares them fairly. Where pricing matters, check each vendor’s own pricing page.
| Option | Best for | How privacy works | Watch out for |
|---|---|---|---|
| Self-hosted in WordPress | A few short videos, small audience | Page lock only, unless you add file protection | Public file URLs by default, server bandwidth, host upload limits |
| Vimeo | Teams that want a polished player and simple controls | Per-video privacy settings, plus domain-level embed privacy for up to 50 domains | Domain privacy limits where it embeds, not which member watches |
| Bunny Stream | Developers who want signed, expiring links | Token authentication with a token and expiry on each embed | Signing runs on your server, so it takes code or a plugin that does it |
| Wistia | Marketing and training video with analytics | Account-level domain restrictions with an allowlist | Setting applies to the whole account; plan availability is not stated in the help article |
| MediaVerse | Members uploading and sharing their own media | Privacy set per item and per album | No transcoding of uploads; plan storage |
| MediaShield (over any of the above) | Watermarking, login and role gating, stream caps | Protected player with viewer-specific overlay | Deters and traces; does not prevent screen recording |
Wbcom makes MediaVerse and MediaShield, so we list them with the same limits as everyone else. Vimeo is often the better pick if you want the least setup and a familiar player. Bunny Stream is often the better pick if you want signed links and are comfortable with some code. Wistia is often the better pick if viewer analytics are your main reason for hosting video.
How do I set up private video for members, step by step?
These steps assume a Reign site with BuddyNext for the community. Swap in your own membership setup if you use something else.
Step 1: Decide who uploads
If you publish all the videos, pick a video host. If members will post their own, add MediaVerse as well. To confirm you chose right, write one sentence: “Videos are uploaded by ___ and watched by ___.” If the two blanks are different groups, you need both access control and a clear upload path.
Step 2: Upload the video and set it private at the host
On Vimeo, open the video, go to Share, then Embed, and set “Where can this be embedded?” to Specific domains. Add your site’s domain. On Wistia, turn on domain restrictions in your account settings and add your domain without the protocol. On Bunny Stream, enable token authentication in your library’s security settings. To confirm it worked, paste the embed code onto a different website you control, or ask a colleague to. The video should show an error and not play.
Step 3: Create a locked place for it
Create a private or secret Space in BuddyNext, or a page restricted to a membership tier. Name it for the audience, such as “Cohort 3 Recordings”. To confirm it worked, open the page in a private browser window while logged out. You should be asked to log in, or see a “you do not have access” message.
Step 4: Embed the video on the locked page
Paste the embed code or URL into the page. Add a poster image so the page does not show a black rectangle while loading. To confirm it worked, log in as a test member with the right access and play the video on a laptop and on a phone.
Step 5: Add captions
Upload a WebVTT file, or generate captions at your host and correct them. To confirm it worked, play the video with captions on and check that names and technical terms are right.
Step 6: Test the wrong member
Log in as a member who should not have access, for example one on a lower tier or outside the Space. To confirm it worked, that member should not see the page or the embed. This is the step most people skip, and it is the one that catches mistakes.
Step 7: Add protection if the content is valuable
If the video is paid content, add watermarking and stream caps with a tool such as MediaShield. Tell members in your terms that sharing logins or recording is not allowed. To confirm it worked, play the video and check that the viewer’s name appears on screen.
What mistakes do people make with private video?
- Locking the page but not the file. A public file URL makes the page lock meaningless. Always test the video address in a logged-out browser.
- Relying on an unlisted link. Unlisted means hidden from search. It does not mean secret. Anyone with the link can watch.
- Promising “download protection”. You can discourage downloads. You cannot prevent recording. Say that plainly in your sales page and avoid promises you cannot keep.
- Testing only as an admin. Admins see everything. Always test as an ordinary member and as a logged-out visitor.
- Skipping captions. Adding them later across a large library costs far more than adding them as you publish.
- Ignoring the hosting bill. Self-hosting video on cheap shared hosting can get a site suspended. Watch bandwidth in the first month.
Questions people ask
What is the best way to host private video on WordPress?
For most sites, a video host with private embeds plus a locked WordPress page. Vimeo, Bunny Stream and Wistia all offer ways to limit where a video can be embedded. Self-hosting works for a few short clips, but it uses your server’s bandwidth and the file URL is public by default.
Can I make a members-only video without a plugin?
Partly. WordPress lets you set a post to password-protected or private, and the Video block plays uploaded files. That locks the page, but the uploaded file’s URL can still be opened by anyone who has it. For a stricter setup you need a host with embed controls, or a protection plugin.
Is an unlisted Vimeo video private?
No. Vimeo’s help center says unlisted videos do not appear in public search results, but anyone with the link can open and share them. For a members-only site, combine a stronger setting such as Password or domain-level privacy with a locked page.
Can members be stopped from screen recording?
No. No tool can stop a phone camera or screen-recording software. You can discourage it with a watermark showing the viewer’s name, and limit account sharing with stream caps. Treat any claim of full prevention as a warning sign.
Do I need DRM for a paid course?
Usually not. DRM raises the effort to copy a video, but it adds cost and setup, and it still cannot stop a screen recording. For most course creators, a locked page, domain-restricted embeds and a visible watermark cover the realistic risks.
Reign is the theme behind the setups in this guide. It styles the community, Spaces and member pages from one place, so the site looks like yours. See the Reign theme page for features and demos, or try the BuddyNext live demo to see Spaces in a working community first. For a related build, read how to launch a community and get your first 100 members.