Key Takeaways
- A dynamic watermark pasted into an LMS lesson editor shows the same text to every student, because a static embed cannot pass viewer identity into the player.
- Kajabi, Teachable, and Thinkific keep lesson videos view-only by default, so the download toggle most creators worry about is usually already set correctly.
- Teachable and LearnWorlds let students download entire courses through their official mobile apps, which is a separate setting from anything on the web player.
- Swapping a native player for a protected embed costs you that platform's video analytics and any completion rule built on them.
- Skool documents no route for an arbitrary protected embed, so a Skool community cannot add an external DRM layer.
- Delivering lessons from a member-only channel on your video host skips the LMS entirely, at the cost of quizzes, certificates, and checkout.
If you are trying to prevent students from downloading course videos, the setting you are about to change is probably already correct.
Kajabi's help documentation states that course videos hosted on Kajabi are view-only inside the platform and cannot be downloaded unless you turn that option on. Teachable ships a ‘Show download link’ toggle that stays off until you switch it on, and Thinkific hides the download option entirely unless you check ‘Make this video downloadable’ in lesson settings.
The download button is the one control nearly every creator already has right. It is also the control that stops the fewest leaks.
Three problems hide inside one question. You can prevent a direct file download, make a copied link stop working, and encrypt the stream so download tools come back empty. You cannot prevent a camera pointed at a screen, and on desktop browsers you cannot fully prevent screen recording either.
This article covers the six ways course videos actually leave a platform, which layer stops each one, two delivery setups worth choosing between, and the tests that tell you whether any of it worked.
Can You Actually Stop Students From Downloading Course Videos?
You can stop the visible download, the forwarded link, and the raw file. You cannot stop a screen recording on a desktop browser, or a phone pointed at a laptop.
The realistic goal is to make copying slow enough that almost nobody bothers, and traceable enough that the few who do can be identified.
Turning off a download link is a platform setting, stopping a copied embed from playing elsewhere is a delivery-layer control, and making a stream unreadable to download software requires encryption.
A creator who flips one toggle and assumes the other two are handled is the most common failure pattern in course video security.
Gumlet is an all-in-one video hosting platform that sells several of the layers described below, including Widevine and FairPlay DRM, signed URLs, and dynamic watermarking, so that interest is worth stating plainly. The platform-neutral sections hold whichever host you pick, and the walkthroughs are one worked example rather than the only route.
How Do Students Download Course Videos?
Course videos leave a platform in six recognizable ways, and only two involve anything a student would call hacking. Most leaks run through tools that are a free browser extension away.
Four of these matter for an LMS setup, because the other two are decided by your video host rather than your course platform. The full attack map, including stream-ripping and credential sharing, is in our breakdown of course video piracy methods.
| Method | How it works | What stops it | Who controls it |
|---|---|---|---|
| Download button or right-click save | The platform exposes a download link or serves a plain MP4 that the browser offers to save. | Turn off the download setting and stop attaching the lesson video as a file. | Your LMS |
| Browser extensions and download managers | An extension watches network traffic, detects the player, and rebuilds the stream into an MP4. | DRM encryption, since LMS toggles have no effect here. | Your video host |
| Sharing the video link or embed | A student copies the iframe or playback URL and pastes it on another site. | Domain restriction and signed URLs with short expiry. | Your video host, pointed at your LMS domain |
| The official mobile app | Teachable and LearnWorlds let students download whole courses for offline viewing inside their apps. | Nothing, this is a feature. Decide whether to turn it off. | Your LMS |
Two of these surprise people:
- The first is the official mobile app. Teachable's creator documentation describes students downloading entire courses and individual lessons for offline viewing in its iOS and Android apps, with Teachable stating that its anti-piracy tooling keeps that content inside the app rather than on the device's file system. LearnWorlds offers the same through a branded app. Offline access is a feature students genuinely want. It is also a copy of your lesson sitting on a phone.
- The second is that extensions target the player underneath your course page, not the page itself, which is why one extension covers several unrelated platforms. Changing your theme or disabling right-click does nothing to them.
For a deeper breakdown of how paid video gets taken and redistributed, our guide to course video piracy methods covers the attack patterns in more detail.
Which Protection Layers Stop Which Methods?
Seven controls do the real work of preventing students from downloading course videos, and each closes a different door. What matters below is less what each layer does than what each layer leaves open.
| Layer | What it does | Stops | Does not stop | Survives an LMS embed? |
|---|---|---|---|---|
| Adaptive streaming, no MP4 files | Splits video into short segments over HLS or DASH instead of one file. | Right-click save and direct file downloads. | Stream-ripping tools that reassemble the segments. | Yes, the host controls output format. |
| Disabled download or right-click | Removes the visible download affordance in the player or lesson. | Casual saving by students not looking hard. | Anything that reads network traffic. | Partly, the LMS toggle and the host player are separate controls. |
| Domain restriction | Plays only on domains or app bundle IDs you list. | A copied embed playing on another website. | A logged-in student on your own domain. | Yes, set your LMS domain as the allowed referrer. |
| Password protection | Puts a shared secret in front of playback. | Casual forwarding of a link. | A forwarded password, which travels just as easily. | Yes, though it duplicates the LMS login. |
| Signed URLs | Issues a cryptographically signed playback link that expires after a set time. | Permanent link reuse and link resale. | Capture during the window the link is valid. | Yes, but expiry must be shorter than a lesson sitting open in a tab. |
| DRM: Widevine and FairPlay | Encrypts the stream and releases a playback license per device and session. | Download managers, stream rippers, and screen recording on Android and iOS. | Desktop screen recording and cameras pointed at a screen. | Yes, the encryption travels with the stream. |
| Dynamic watermarking | Burns a viewer identifier, such as an email, into the playing video. | Anonymous redistribution, by making a leak traceable. | Recording itself; it also does not render during native iOS playback. | No, not per student. A static embed cannot pass viewer identity. |
One row deserves more than a table cell. DRM works only with HLS and DASH streams, and it cannot be applied to MP4 videos, so serving MP4 files rules out the strongest layer available. It carries side effects: DRM blocks frame extraction, so custom thumbnail selection stops working, and casting is unavailable once DRM, dynamic watermarking, or domain whitelisting is on.
Encrypting the stream does not retire the MP4 URL. Gumlet's video FAQs note that MP4 output URLs can still exist for download or API use, in the form https://video.gumlet.io/{workspace_id}/{asset_id}/main.mp4, and advise sharing the embed or HLS and DASH playback URL instead. Protecting the stream while the direct file address stays reachable protects nothing.
The mechanics behind each layer are covered at length in our four-layer protection stack guide. This article assumes you want to know what to configure instead.
One of those seven layers behaves differently inside an LMS than it does on a standalone page, and it is the one most course creators are paying extra for.
Does Dynamic Watermarking Work Inside an LMS?
A dynamic watermark works inside an LMS only if the embed can pass each student's identity into the player, and a lesson editor's code block cannot do that. Pasted as static HTML, the watermark renders identical text for every viewer, so a leaked recording traces back to nothing.
Gumlet's documentation is specific about how dynamic watermarking works: turn it on in player settings, then pass watermark_text in the embed URL, as in https://play.gumlet.io/embed/{id}?watermark_text=EMAIL. Gumlet's player documentation adds that the watermark renders only where the embed code is used, not on raw MP4, M3U8, or MPD URLs.
A custom code block inside Teachable, Kajabi, or Thinkific is static HTML. It does not know who is viewing the page, and it cannot substitute that student's email into the URL before the player loads.
Paste one embed code into a lesson and every student sees an identical watermark. When a recording surfaces in a Telegram group, it traces back to nothing.
Two honest ways to handle it. Generate per-student embed URLs through your LMS's templating or an API integration, which is real development work. Or accept that the watermark deters casual sharing without identifying the source, and lean on DRM and signed URLs for enforcement.
Apple adds one more constraint. Custom overlays, including watermarks, do not render during native iOS playback. DRM already blocks screen recording there, so the watermark matters less, but the gap should not be sold as coverage.
Best for: Creators who need quizzes, certificates, drip scheduling, and checkout in one place, and will trade some native video reporting for encryption.
How Much Protection Does Your Course Need?
Spend on preventing students from downloading course videos in proportion to what a leak costs you, not to how worried you feel. A $49 mini-course and a $3,000 certification program do not face the same threat. Three tiers cover almost every course business.
1. Low-Ticket Courses, Roughly Under $200
Stream instead of uploading files, and restrict playback to your course domain. On Gumlet, domain restriction starts on the Creator plan at $6 per month billed annually, and Creator accounts are limited to the embed code and player with HLS and MP4 URLs unavailable, which removes an entire category of link-sharing problem before you configure anything.
2. Mid-Ticket Courses, Roughly $200 to $1,000
Add signed URLs so any forwarded link expires, and a watermark so a leaked recording points back at an account. Dynamic watermarking on Gumlet starts on the Business plan at $99 per month billed annually.
High-ticket, certification, and exam-prep programs. Add DRM, sold as a $99 per month add-on on any paid plan with 100,000 DRM views included monthly and $1 per 1,000 views after that, and included on Enterprise.
For $198 per month, you get both dynamic watermarking plus DRM add-on at $99 per month billed annually. Watermarking is not the budget alternative to DRM; the two sit at the same tier. Decide which problem you are solving, traceability or encryption, before assuming you need both.
Gumlet's live streams support none of the protection options available for on-demand video: no geo-blocking, domain restriction, password protection, DRM, signed URLs, dynamic watermarks, or expiry URLs. For a cohort program, the live class is unprotected even when every recorded lesson is locked down. Record the session, process it as on-demand video, and protect the replay.
Older advice on this question is now wrong. Guides written before 2025 told small creators to settle for signed URLs, because multi-DRM meant an enterprise contract and a developer to maintain it. As of October 2026, Gumlet sells Widevine and FairPlay DRM as a $99 per month add-on on any paid plan, so a solo creator with a $900 course can buy the same encryption layer a streaming service uses.
Option 1: Keep Your LMS and Embed Protected Video From a Video Host
This is the right way to prevent students from downloading course videos if your platform earns its keep through quizzes, certificates, drip schedules, and checkout. You keep all of that and swap out only the video layer.
Upload lessons to a secure video host, turn on the protection layers you picked above, and paste the host's embed code into the lesson editor where the native video used to sit.
With Gumlet, the configuration order is: add your course domain under ‘Access Allowed Referrers’, set video privacy to private or unlisted, turn on signed URLs for paid lessons, switch on the DRM add-on in processing settings, and add a dynamic watermark in player settings. DRM setup is one click with no code, and new accounts receive both credential sets automatically.
What Each LMS Platform Actually Gives You
1. Kajabi
Kajabi keeps lesson videos view-only by default and makes only files attached under a lesson's Downloads section available. Its product builder accepts HTML embed codes, so a protected player drops in without a plugin. The practical rule: never put the lesson video itself in the Downloads section as a bonus.
2. Teachable
Teachable gives you a per-file ‘Show download link’ toggle covering video, audio, PDF, and banner image blocks, and external players go into the Custom Code block under Advanced Tools.
One caveat worth planning for: Teachable's reporting documentation states that the Video Stats report only covers videos uploaded through its own file uploader, and embedded video in a code block is excluded.
Moving to an external host costs you Teachable's native video reporting and its video-completion compliance, both built on the native player. Your host's analytics replace them, but the swap is not invisible.
3. Thinkific
Thinkific controls student downloads with ‘Make this video downloadable’ in lesson settings, and keeps attachments separate through the Downloads block or the Downloads lesson type.
Externally hosted video goes in through the Video block's embed option in the new builder, or a Multimedia lesson in the classic builder, since classic Video lessons accept uploaded files only.
4. LearnWorlds
LearnWorlds sets its video provider globally at Settings, then Video, then Provider. Offline downloads exist only through a branded mobile app, a paid add-on, and files stay inside it.
5. Tutor LMS
Tutor LMS adds two WordPress-layer controls at Settings, then Advanced, then Content Security: Prevent Hotlinking and, on Pro, Copy Protection. Neither reaches your video host, so configure domain-restricted playback on the CDN side as well.
6. Skool
Skool is the one platform in this list where the setup does not work. Its help center documents native uploads plus four video hosting partners: YouTube, Vimeo, Loom, and Wistia. There is no documented route for an arbitrary protected embed.
A Skool community cannot add an external DRM layer the way a Teachable or Kajabi course can. If your paid content lives in Skool and protection is a requirement, the options are to move the lessons to a platform that accepts embeds, or to deliver them from your video host directly, which is Option 2 below.
What the Swap Costs You on Every Platform
Replacing a native player with an embed has the same three costs everywhere, and they are worth pricing before you start.
You lose native video analytics, because every platform's reporting is built on its own player. You lose any completion or progress rule that depends on watch time, which matters if you issue certificates. And you take on a second subscription and a second dashboard.
Your video host's analytics replace the first two, and on Gumlet that means user-level reporting on who watched what. The replacement is not automatic, though, and any certification logic tied to native video completion needs rebuilding before launch.
Option 2: Deliver Your Course Directly From Your Video Host
Skip the LMS layer. Put the lessons in a private, member-only channel on your video host and invite students directly.
Gumlet's channel membership works like this. Each video workspace holds one channel, public or private, and playlists control which videos appear on it. Invitations go out by name and email, individually or in bulk through a CSV upload, each carrying a per-user access token. The invited person joins by creating a Gumlet account or signing in, and if they cannot verify the same email address the invitation went to, they cannot view the content.
That email-verification step is the access control. Enrollment need not be manual either: the Zapier integration includes an action to invite channel members, documented through a template that fires an invitation from a new form response. Point that trigger at whatever tool collects your enrollments.
Protection is simpler here because there is no embed to copy. The privacy matrix is explicit: a private video on a member-only channel plays inside the channel and nowhere else.
The limitations matter more than the features here, so take them first. A channel delivers video, playlists, member access, and user-level analytics showing which members watched what. That covers a fitness membership or a cohort program cleanly. It does not cover a course where students expect a progress bar, a quiz score, and a certificate at the end, and retrofitting those is not a small project.
It does not document quizzes or certificates, and members cannot comment on videos, since comments there are built for internal pre-publish review. Payments sit outside it too, since the video FAQs state the player does not support pay-per-view or Stripe today.
Collect payment with a separate checkout tool and trigger the invitation from it.
| Option 1: LMS plus Secure Host | Option 2: Host Delivers Directly | |
|---|---|---|
| Best for | Structured courses with assessments and certification. | Video-only programs, cohorts, memberships, and fitness. |
| Protection layers | Full stack, though the watermark is usually generic per lesson, not per student. | Full stack, with private videos that will not play outside the channel. |
| Quizzes, certificates, checkout | Handled by the LMS. | Not available; checkout runs through a separate tool. |
| Student login | LMS account, with video access inherited from the embed. | Video host account, with email verified against the invited address. |
| Setup effort | Embed code per lesson, with protection configured once on the host. | Channel and playlists configured once, with invitations automated via Zapier or webhooks. |
| Cost | LMS subscription plus host plan, starting at $6 per month when billed annually. | Growth plan at $19 per month when billed annually, where private channel subscription starts. |
Choose Option 1 when your course sells on assessment: quizzes, graded modules, certificates, or a drip schedule tied to completion. The LMS earns its subscription there, and the embed closes the protection gap without touching any of it.
Choose Option 2 when the lesson sequence is the product and students pay for access rather than credentials. You get per-student access control without the watermark workaround, because there is no embed to make static.
Neither option fits a platform that will not accept an arbitrary embed, which today means Skool. And neither solves live cohort sessions, which need recording and reprocessing as on-demand video before any of this applies.
Best for: Video-first programs where the lesson sequence is the product, and where quizzes and certificates are not part of what students are paying for.
Weighing the two against a specific course, the course creator protection setup page goes deeper on configuration.
How to Check Your Videos Are Really Protected
Protection you have not tested is a guess. Run these five checks from a student account, in a browser you are not logged into as an admin, before you enroll anyone.
Run them in this order. The first two tell you whether the stream is protected at all, and there is no point testing the later layers until those pass.
- Look for MP4 files in the network tab: Open developer tools, filter for mp4, and play a lesson. A .mp4 request returning the full video is a failure. A long run of short segment requests means the lesson is streaming.
- Run a download extension against a lesson: Install one of the common course-video download extensions and open a lesson. If a download button appears and produces a working file, your stream is unencrypted and only DRM changes that.
- Paste the embed code on another domain: Create a blank HTML file on a different domain, drop the embed in, and load it. A playback error means domain restriction works. Successful playback means your embed is portable, and so is your course.
- Open an expired signed link: Generate a signed URL with a short expiry, wait for it to lapse, then open it. A playable video after expiry means signing is not enforced on that asset.
- Screen-record on Chrome and on Safari, then check the watermark: Record a lesson on both. Expect the recording to succeed; what you are checking is whether the watermark appears and whether it identifies the viewer. If every student's recording carries identical text, see the watermark section above.
A longer version, covering the hosting and response surfaces this article does not, lives in our pre-launch security checklist.
What to Do if Your Course Videos Leak
Move in this order, before drafting angry messages.
- Trace the source: If your watermark carries a per-viewer identifier, pull it from the leaked file and match it to an account. If it does not, check user-level analytics for access patterns that do not look like one student watching lessons in sequence.
- Revoke that account's access: Remove the student from the channel or the LMS, and let outstanding signed URLs expire rather than assuming removal is instant.
- File takedown notices: Send DMCA notices to the host of the site or the platform distributing the file. Most large platforms have a standard reporting route.
- Close the layer that failed: A clean MP4 in circulation points at the stream. A copied embed playing elsewhere points at domain restriction. A recording points at the limits of what any of this can prevent.
Disclaimer: This section is for general informational purposes only and does not constitute legal advice. Laws and regulations change over time; the information above reflects publicly available sources as of the article's publish date. Consult a qualified professional before making compliance decisions.
Mistakes That Leave Course Videos Downloadable
- Attaching the lesson video as a downloadable file: On Kajabi and Thinkific, the Downloads section exists to hand students a copy. Worksheets belong there; lesson videos do not.
- Pasting one embed code into every lesson: The embed is static, so every student sees the same watermark. Pass viewer identity per lesson or accept that the watermark deters rather than identifies.
- Protecting lessons and forgetting the mobile app: Teachable and LearnWorlds offer offline downloads through their apps. Protection configured on the web player does not reach that setting.
- Setting domain restriction to your video host instead of your LMS: The allowed referrer must be the domain the student's browser is on, which is your course platform, not the host serving the stream.
- Leaving the MP4 output URL reachable: Protecting the embed while the direct file address resolves guards the front door and leaves the back one open.
- Promising students that screen recording is blocked: DRM blocks it on Android and iOS. On a desktop browser it does not, and a promise you cannot keep is worse than the honest version.
Frequently Asked Questions
1. Why does my watermark show the same text to every student?
Because the embed is static. A lesson editor's code block is plain HTML that does not know who is viewing the page, so it cannot substitute a student's email into the player URL before the video loads. Every viewer gets an identical overlay. Fixing it requires per-student embed
URLs generated through your LMS templating or an API integration.
2. Can you stop screen recording of course videos?
On Android and iOS devices, DRM blocks screen recording during playback. On desktop no platform reliably prevents it, because the operating system controls screen capture and the browser cannot override it.
Dynamic watermarking is the realistic answer there: it burns a viewer identifier into the frame so a leaked file points back at one account. Treat desktop recording as traceable, not preventable.
3. Do I need DRM for my online course?
Use DRM when a single leaked copy costs more than the protection does. Certification programs, exam prep, and courses above roughly $500 usually clear that bar. On Gumlet, DRM is a $99 per month add-on on any paid plan, including 100,000 views monthly.
Below that, encrypted streaming with domain restriction and signed URLs stops most casual copying far more cheaply. Buy DRM when the content justifies it, not by default.
4. How do watermarks help stop piracy?
Dynamic watermarking burns a viewer-specific identifier, usually an email address, into the playing video. It does not block recording or downloading. What it changes is accountability: a leaked file carries the identity of the account it came from, which deters sharing that would otherwise feel consequence-free.
Confirm your setup passes per-student data into the player, because a watermark showing identical text to everyone traces nothing.
5. Can I sell a course without an LMS?
Yes, if your course is genuinely video-first. A private member-only channel delivers lessons in playlists, controls access by invitation, and reports who watched what, without an LMS subscription.
What you give up is assessment infrastructure: channels of this kind do not document quizzes or certificates, and the player does not support pay-per-view, so checkout runs through a separate tool. Choose this when the lessons are the product.
Start With One Lesson
Configure one lesson end-to-end before touching the rest of the library. Pick your highest-value module, stream it instead of uploading a file, lock playback to your course domain, add signed URLs, and decide on DRM based on what a stolen copy of that lesson is worth.
Then run the five tests against it. Most creators who set out to prevent students from downloading course videos find that two of the five fail on content they assumed was secure, and learning that before enrollment opens costs nothing.
Gumlet's video protection features are configured from the dashboard, and the first lesson takes less time to secure than it took to record.