How to protect a stream from copying

What you can protect

Protection helps you control where the player runs, who gets access to the video, and which network addresses may reach the stream or the original camera.

• EmbeddingThe player runs on allowed sites only
• ViewingA password or a mandatory user sign-in
• LinksPersonal addresses with a limited lifetime
• NetworkBlocking suspicious IPs and restricting access to the camera

1. Protection from copying

Level of protection: medium

Allow the player to run only on the sites you name. If the stream's code is embedded on another domain, playback will be blocked.

In the settings, enter the domain name only — no https://, no path and no page address:

Several allowed sites can be listed separated by commas:

Add every domain the player is meant to work on, including a separate subdomain if you use one. This method protects you from someone simply copying the HTML code onto their own site.

2. Password access

Level of protection: medium

Access to the video is granted only after the password you have set has been entered correctly. This option suits temporary private streams and a limited audience.

• use a long, unique password;
• do not publish it next to the player or in open messages;
• change the password after the event or if it leaks;
• pass the password only to viewers who are allowed access.

A shared password can be forwarded to someone else, so for control at the level of the individual it is better to use sign-in or temporary links.

3. IP blacklist

Level of protection: medium

Users at the IP addresses you add will not be able to reach the stream. Addresses to block can be taken from the statistics log.

1. Open the stream's statistics.
2. Find an IP address with a suspiciously large number of requests.
3. Make sure it is not your own office, a proxy server or a network your viewers share.
4. Add the address to the blacklist.
5. Keep watching the statistics after the block.

4. Access for signed-in users

Level of protection: strong

The stream is available only to users who have signed in at rtsp.me and been given the right to view it.

You create the streams in your own account and grant access to the users you choose. They can watch the cameras in the rtsp.me interface itself.

This option suits staff, contractors and regular customers: access is tied to an account rather than to a shared password or a public player code.

5. Protection through PHP code

Level of protection: strong

PHP integration lets you place the stream on your website with stronger protection from copying. A unique link is created for each visitor, and it stays valid for 10 minutes.

Your site must run PHP version 5.3 or above. The integration's secret parameters are held on the server and are not published in HTML or JavaScript.

1. The site checks the user and their right to view.
2. The PHP code builds a personal, temporary link.
3. The player receives the link only once the check has passed.
4. After 10 minutes the link that was issued stops working.

The steps for placing the player in the ordinary way and the principles behind PHP integration are described on the page “How to embed a stream on your website”.

6. Whitelist on the router

Protecting the original stream

Add the IP addresses of the rtsp.me streaming servers to your router's whitelist and allow connections to the camera's RTSP port from those addresses only.

Ask rtsp.me technical support for the current list of servers. Do not use addresses from older instructions: the infrastructure may change.

1. Get the current list of IP addresses from support.
2. Create allow rules for those addresses.
3. Block all other incoming connections to the RTSP port.
4. Check that the stream works once the rules are in place.

How to choose your protection

• Public websiteAllowed domains and keeping an eye on the statistics
• Private eventA password and allowed domains
• Staff and customersSigned-in rtsp.me users
• Account areaPHP code with unique 10-minute links

For the greatest practical effect, combine the layers. For example, restrict the player to a domain, issue temporary links through PHP, keep an eye on the statistics and allow only the rtsp.me servers to reach the camera.

Frequently asked questions