How to protect a VSL from piracy: the threat model, the layers that work and their honest limits

To protect a VSL from piracy, never expose a downloadable file, stream it as AES-128 encrypted HLS with short-lived signed keys, lock embeds to your own domains, watermark the video so copies carry your mark, and monitor for copies you can take down. Nothing stops screen recording, so the realistic goal is to make theft slow and copies short-lived.

What can you protect, and what can't you?

Start with what the law and the technology can actually protect. The U.S. Copyright Office says copyright "does not protect facts, ideas, systems, or methods of operation", although it may protect the way these things are expressed (Copyright Office FAQ). For a VSL, that splits your assets into two groups.

What copyright covers in a VSL

And the practical protection for each asset

CoveredProtected by copyright

• The video file and its footage. Yes, as your expression. Practical protection: encryption, domain lock, watermark, takedowns.
• Script and page copy, word for word. Yes. Practical protection: monitoring and takedowns.

Not coveredNot protected by copyright

• Your angle, mechanism or big idea. No, ideas aren't covered. Practical protection: speed — keep testing new angles.
• Offer structure and price points. No. Practical protection: compete on execution.
• Product names, slogans, short phrases. Not by copyright; they may qualify as trademarks. Practical protection: trademark advice, if it matters to you.

Registration isn't required for protection, since copyright exists from the moment a work is created and fixed. The Copyright Office does note that you must register before you can sue over a U.S. work (Copyright Office FAQ).

How do you protect a VSL from piracy? Start with a threat model

VSLs get stolen in six different ways, and each needs its own defense. Map them before you buy or build anything.

Protection is one of the ten requirements in the VSL hosting guide, and the layers below work best together.

Layer 1: Why a downloadable MP4 is the first thing to remove

A progressive MP4 is one file at one URL. To play it, the browser downloads it, so anyone who can watch it can save it: from the network tab, from the page source or with a one-click browser extension. Hiding the download button or blocking right-click changes nothing about that URL. It only annoys honest viewers.

HLS changes the shape of the problem. The video is cut into short segments listed in a playlist, so there's no single file to grab (RFC 8216). On its own, though, HLS only adds effort: tools that read a playlist can fetch every segment and stitch them back together. That's what encryption is for.

Layer 2: What does AES-128 HLS encryption actually do?

The HLS specification defines an encryption method called AES-128. Each media segment is "completely encrypted" with AES using a 128-bit key, in CBC mode with PKCS7 padding, and the playlist's EXT-X-KEY tag carries a URI that tells the player where to fetch the key (RFC 8216). Without the key, downloaded segments are noise.

That makes the key URL the real lock. If it's long-lived and public, a ripper fetches it once and decrypts everything at leisure. If key URLs are signed and expire quickly, the key link inside a copied playlist stops working soon after it's taken, so the copy can't be decrypted later or passed around as a working stream.

Be clear about the limit. The player has to receive the key to play the video, so someone with the skills to capture it during a live session can still decrypt that session's segments. AES-128 HLS raises the cost of theft from one click to real effort; it isn't DRM.

Put together, the chain looks like this:

From playlist to playback: where AES-128 HLS puts the lock

1. 1A playlist of short segmentsThe video is cut into short segments listed in a playlist, so there's no single file to grab.
2. 2Every segment encryptedEach media segment is completely encrypted with AES using a 128-bit key, in CBC mode with PKCS7 padding. Without the key, downloaded segments are noise.
3. 3EXT-X-KEY points to the keyThe playlist's EXT-X-KEY tag carries a URI that tells the player where to fetch the key.
4. 4A signed, short-lived key URLThe real lock. If key URLs are signed and expire quickly, the key link inside a copied playlist stops working soon after it's taken.
5. 5Playback, and the limitThe player has to receive the key to play the video, so someone with the skills to capture it during a live session can still decrypt that session's segments. It isn't DRM.

DRM systems such as Apple's FairPlay Streaming add a key server and protected playback on the device (FairPlay Streaming), which makes sense for content people pay to watch, like a course library. For a sales video that every visitor is meant to see, encryption plus a watermark is usually the proportionate choice, because a phone pointed at the screen gets around any system.

If you self-host, apply the same idea at the CDN. Amazon CloudFront, for example, recommends signed cookies when you need to grant access to multiple restricted files, such as "all of the files for a video in HLS format" (CloudFront documentation). In RevvyScales, every stream is AES-128 encrypted with short-lived, signed key URLs, and the page never exposes a downloadable MP4.

On a VSL's Settings tab in RevvyScales, the video protection card shows whether that protected version is ready:

12

1. 1Video protectionShows whether the protected version of the video is ready. Here it is still being prepared, and the VSL plays in standard quality until then.
2. 2Scheduled visibilitySets a time for the page to go live or expire, so a leaked link to a retired version stops showing your VSL.

Layer 3: How do you stop other sites from embedding your VSL?

Hotlinking is the quiet theft. Another site embeds your player or points at your stream, so your video plays on their page while your bandwidth pays for it. A domain allowlist tells the player to refuse to play anywhere except the domains you list.

List every domain your funnel touches: the VSL domain, presell and advertorial domains, staging and any page builder you embed on. Wildcards cover every subdomain of a domain you own. The failure to watch for is a missing domain, where the video quietly stops working on a presell nobody re-checked after a domain change. RevvyScales restricts each VSL to the domains you list, with wildcard support, and adds connected custom domains automatically (embed security).

Retire old URLs too. Test versions and expired promotions can keep circulating in forums and swipe files. Scheduled visibility lets a page expire at a set time, so a leaked link to a retired version stops showing your VSL (scheduled visibility).

Layer 4: Can you stop someone from screen recording your VSL?

No. On the open web, any video a screen can show can be captured by recording software or filmed with a phone. What you control is what the copy looks like. An image laid over the video, such as your logo, your brand's web address or a compliance mark like "Paid advertisement", appears in every recording. It tells viewers of the copy where it came from and makes the copy less useful to anyone who wants to pass it off as theirs.

Where you place the mark is a trade-off:

• Corner marks are unobtrusive but easy to crop out.
• Marks closer to the subject survive cropping but compete with your presenter or product for attention.
• Timed marks split the difference: show the mark through key stretches, such as the demo and the pitch, rather than every second.
• Keep it small and semi-transparent. Honest viewers come first; the mark should be legible in a copy, not loud in the original.
• Use a compliance mark if your claims depend on a disclaimer, so a re-upload carries that context with it. What a disclaimer has to do is covered in the VSL compliance guide.

RevvyScales' video watermark (Growth plan and up) is an image overlay you position, size and time (video watermark). Protection is also one item on the VSL player checklist, next to the features that sell.

Layer 5: How do you find copies and get them taken down?

A 15-minute weekly monitoring routine

• Search the web for two or three distinctive sentences from your headline and script, in quotation marks.
• Search public ad libraries for your product name, brand and key phrases.
• Run a reverse image search on your poster and a few key frames.
• Check your web analytics referral reports for traffic from domains you don't own.
• Keep dated originals: master files, script drafts and captures of the published page. They're your evidence.

How to send a DMCA takedown notice

Under U.S. law, a hosting provider keeps its safe harbor only if it has designated an agent to receive notices and "responds expeditiously" to valid ones by removing or disabling access to the material (17 U.S.C. 512). Find the agent in the Copyright Office's DMCA Designated Agent Directory, or use the platform's own form. A valid notice contains six elements:

The six elements of a valid DMCA notice

• Your physical or electronic signature, or that of someone authorized to act for the owner.
• Identification of the copyrighted work, for example your VSL and its original URL.
• Identification of the infringing material, with enough information to locate it, such as exact URLs.
• Your contact information: address, phone number and, if available, email.
• A statement that you believe in good faith the use isn't authorized by the owner, its agent or the law.
• A statement that the notice is accurate and, under penalty of perjury, that you're authorized to act for the owner.

0 of 6 done

Two more rules matter. If the uploader files a counter-notice, the provider restores the material 10 to 14 business days later unless you notify it that you've filed a court action against the uploader. And anyone who knowingly and materially misrepresents infringement is liable for damages, so don't file against reviews, commentary or other uses that may be fair use.

Platforms add their own processes. YouTube accepts removal requests through YouTube Studio or by email, fax or mail, lets you schedule a removal to take effect in seven days so the uploader can act first, and warns that misusing the process can get your account terminated (YouTube copyright removal). Google says it complies with DMCA notices and asks for a separate notice for each product where the content appears (Google legal help).

What does VSL protection cost you?

Every measure has a cost to someone. Good protection puts nearly all of it on the thief.

What each measure costs, and the verdict

UseBaseline

• Encrypted HLS with short-lived keys. Cost to honest viewers: nothing visible. Cost to a thief: high for casual copying. Verdict: baseline.
• Domain allowlist. Cost to honest viewers: nothing, if every funnel domain is listed. Cost to a thief: blocks embedding elsewhere. Verdict: baseline; audit after domain changes.

SometimesAdd when it matters

• Watermark. Cost to honest viewers: slight visual clutter. Cost to a thief: every copy carries your mark. Verdict: add when copies appear or a compliance mark matters.

SkipSkip for a sales VSL

• Right-click and keyboard blocking. Cost to honest viewers: annoyance. Cost to a thief: next to none. Verdict: skip.
• An email gate before the pitch. Cost to honest viewers: fewer viewers reach the offer. Cost to a thief: little. Verdict: wrong tool for theft.
• Full DRM. Cost to honest viewers: more setup and device testing. Cost to a thief: highest, though camera copies remain. Verdict: for paid content, not sales videos.

When you compare hosts, put protection questions on the list: whether an MP4 is ever exposed, how keys are delivered and whether playback can be locked to your domains. The full vendor question list is in the guide to choosing VSL hosting software.

A 20-minute VSL protection checklist

Work through it with your VSL open; the ticks are kept in this browser:

A 20-minute VSL protection checklist

• Play the VSL with the browser's network tab open and confirm you see a playlist and segments, not an .mp4 file.
• Open the playlist response and look for an EXT-X-KEY line with METHOD=AES-128.
• Copy the key URL from that line, try it again the next day and confirm it fails.
• Paste your embed code on a domain you haven't allowed. It shouldn't play.
• List every domain in your funnel and compare the list with your allowlist.
• Choose a watermark (logo, web address or compliance mark), then set its position and timing.
• Expire old test pages you no longer use.
• Save dated copies of your master files, script and published page.
• Book a weekly 15-minute monitoring slot.
• Draft a takedown notice covering the six elements, ready to fill in with URLs.

0 of 10 done