Hot-linking protection and domain locking

Wmsauth_flow_hotlinking-250w Hotlinking-workflow-250w Paywall-structure-250w

Go back to paywall features or check this feature for Nimble Streamer.


Hot-linking (or hotlinking) is a process of re-streaming of the streaming media. This is critical for any business which has premium access to their assets. It you have any exclusive content, you're loosing money in case of hot-linking.

What can we do?

WMSPanel provides a token-based authorization to check each incoming connection signature against original published signature. The following Wowza entities may be protected: entire server, virtual host, application, application instance, separate stream. The protection consists of 3 parts - an agent on Wowza server side, a code snippet on a web page which generates a signature for the streaming media and a control interface to enable the protection.

This protects from links re-publishing and allows performing domain lock for published links.
Supported protocols: RTMP, RTSP, HLS, HDS, SmoothStreaming, MPEG-DASH, DVR streams.

Re-streaming protection is integrated in two steps. They are:

  1. Modify media player web page to have a signature of media URL.
  2. Set up and enable protection via web control panel.

1. Make media signature

To sign media URL for further recognition and handling, the web page with media player must be slightly modified.

As example, you have this URL for your live stream:
rtsp://ec2-test-ip.compute.amazonaws.com:1935/live/Stream1
The modified URL would be:
rtsp://ec2-test-ip.compute.amazonaws.com:1935/live?wmsAuthSign=c2VydmVyX3RpbWU9NS80LzIwMTIgODozMzowNSBBTSZoYXNoX3ZhbHVlPXE3MjN6aEVmdGFUOUJoWjBQTmw1TVE9PSZ2YWxpZG1pbnV0ZXM9MjA2/Stream1

To generate signature you need to modify your front-end source to include code snippet.

Click here to see the sample code.

In this sample key means the password which will be used later for setting up rule in control panel and validminutes means number of minutes while this signed link will be valid to let people read the page and start the playback.

You can find more samples in WMSAuth samples github repository and adapt them for your use case.

2. Set up control panel settings

After the code is set on web server side, the agent must be notified about protection settings. Re-streaming protection is provided as part of WMSAuth feature set.

Top-menu-half

2.1 WMSAuth group

In WMSAuth, every restriction may be applied to a group of servers. So the first thing to do is to create a group and assign one or more Wowza servers to it.
Groups-list-half
2_server_selection-half

2.2 WMSAuth rule

Within a group, there may be several rules, each working with its set of Wowza entities. Just click on "Add rule" to enter rule creation page. Check this screenshot to see how you can specify Wowza vHost, application, instance or stream regular expression.

5_wowza_entities-half

The last thing to specify is a key, or password, which was inserted into the media signature on web server side in section "Make media signature" above.
After you save the rule, it will be applied to the server within a few seconds.
Hot-link-protection-half

You can also see WMSAuth group description in this blog post.

Is that all I need?

Yes. Now when your media is signed with WMSAuth signature, the agent will be checking each incoming request against its media signature. Immediately after that the connection will be either allowed or denied, it takes just several milliseconds.

You may also combine this functionality with geo-location and IP ranges restriction as well as connections and bandwidth limitation. This is also a basis for pay-per-view feature set.

Questions or problems?

What if WMSPanel is not accessible? Hot-linking protection works regardless of WMSPanel availability. If your server can't connect to WMSPanel for some reason, the protection will still work perfectly. Once the rules are set up, the control panel is not used anymore.

Hotlink protection does not work? Check the FAQ.

Also, check company forum to see common questions and answers from other companies reagrding hotlinking protection.


Works perfectly for Nimble Streamer

The hot-linking protection functionality is also available in Nimble Streamer, including stream-based signature.
Nimble Streamer is a light-weight freeware media server for RTMP, HLS and other protocols. You can use it as efficient edge and origin server for live and VOD streaming.
Read this article to see how hot-linking protection is set up in there.