How to make videos private on WordPress: members-only, domain-locked and password-protected

October 8, 2026

“Private” means different things depending on the video. A product demo might only need to stay off search engines; a paid lesson should only play for students who bought the course. Here are the four levels, from lightest to strictest, and what each one really protects against.

1. Unlisted

The video isn’t listed or indexed, but anyone with the link or embed code can watch it. Good for videos you’re happy to have shared, not for anything paid.

2. Password-protected

Viewers have to enter a password before playing. Simple, but passwords get shared, and everyone has the same one. Good for a client preview or a one-off internal video.

3. Domain-locked

The video only plays when it’s embedded on sites you allow (your own domain, for example). A copied embed code doesn’t play on someone else’s site. This is the minimum for course content, but anyone who can see the page on your site can still watch.

4. Members-only (signed per viewer)

The strictest: the video plays only for logged-in members, because your WordPress site signs each playback for the person viewing it. There’s nothing to copy that works elsewhere, and with Pellio the signature carries the member’s ID, so you also see who watched.

Setting it up with Pellio

Domain lock: in Pellio, add your domains under the workspace’s allowed domains and turn on the restriction for the video.
Password: set a viewer password in the video’s settings.
Members-only: make the video private and embed it with the Pellio WordPress plugin. Private videos play only through signed embeds from your connected site, and work with membership and LMS plugins (MemberPress, Paid Memberships Pro, Restrict Content Pro, WooCommerce Memberships, LifterLMS and others).

Step by step: Privacy and access and Members-only videos.

What no setting can stop

Someone with access can always screen-record. For training, Pellio’s Advanced plan can add a viewer watermark with the viewer’s name or email, which makes leaks traceable and discourages them.