Content protection

Open VidCellar → Content Protection. Lite protects the files. Pro decides who is allowed to receive a playback session.

Settings

• Encrypted HLS. New uploads can be encrypted with AES-128 before they are published. Each rendition has its own key, issued only with a valid signed link. Encrypt all existing HLS videos converts the library in the background without stopping current viewers. Encrypted stream only refuses the downloadable MP4 once a ladder is encrypted.
• Signed links. The page does not contain a raw video URL. Play asks for a session and receives HMAC-SHA256 links that expire (default 10 minutes) and refresh in the background. Optional network binding ties a link to the viewer’s network. Safari receives a longer link because it cannot swap links mid-stream.
• Anti-hotlinking. An Origin and Referer allow-list, CORS, and Cross-Origin-Resource-Policy. This site is always allowed. Add partner domains one per line.
• Watermark. A canvas overlay can show email, username, display name, IP, live time, a session ID, and the site domain. It moves and changes opacity. You can show it on protected videos (Pro), on every video for logged-in viewers, on every video, or turn it off. Picture-in-picture can be disabled on watermarked videos, and playback can pause if the overlay is removed with developer tools. On iPhone, fullscreen stays inside the page so the watermark remains visible.
• Delivery. Optional clean /vcstream/ URLs, and X-Accel-Redirect, X-Sendfile, or LiteSpeed handoff after PHP has checked the link. Turn accelerated delivery on only after the matching server rule is installed.
• Viewer sessions. Log the session ID, account, IP, and time so a leaked recording can be traced from the watermark. Say so in your privacy policy. You can also revoke every link in circulation by rotating the signing secret. Viewers who are watching reconnect.

Server rules

The Server rules tab checks whether the private folder answers over HTTP and prints nginx and Apache snippets. On Apache, the plugin’s .htaccess covers 2.2 and 2.4. On nginx, add the deny rule and reload nginx. Until that rule is in place, a guessed file name in vidcellar-private could be downloaded.

Who-can-watch rules are not on this screen in Lite 2.3. They are under Membership when Pro is active.