01
List your sites.
Choose Only these domains and type each site, like example.com, with no http:// and no path. Up to 20 to a list.
Restrict video embeds to your domain: Your video plays on the sites you choose.
List the domains where a video may be embedded, for the whole library or one video at a time. Embed code copied onto any other site shows a blocked screen instead of your video, and your analytics name the site that tried. Your share pages and channels keep playing. Every plan.
How to restrict where a video can be embedded
02
Embed as usual.
Paste the same embed code on your site. It plays there. Copied onto a site you did not list, it shows a blocked screen.
03
See who tried.
Each video lists the sites it loaded on and the sites it refused. If a refused site looks like yours, add it in one click.
Allowed domains is on every plan, Solo included. It applies to embeds on other sites. Your share pages, channel pages and the console play the video whatever the list says.
Lock embeds for the whole library, or one video
One default for every video
In Settings, under Allowed domains, an admin sets the rule your whole library follows: Only these domains with a list, or Anywhere. Every video follows it until someone gives that video a rule of its own.
Override it on a single video
Each video's Embeds section offers Same as account default, which says what the default is right now, Only these domains with a list of its own, which starts as a copy of the account's so you add to it rather than replace it, or Anywhere. Editors and admins can change it. Press Save allowed domains.
Allow a domain and all its subdomains
An entry like *.example.com covers example.com, www.example.com and every other subdomain. Type a bare domain or a www. one and the console offers Use *.example.com, because many sites move visitors between the two and the one you left out would be blocked.
What happens when an embed is blocked
The viewer sees a quiet screen
A calm, branded panel that reads This video can't play here. and The owner limits where it can be embedded. It does not link to your share page, so a site you did not allow cannot use your refusal to send its visitors somewhere the video plays.
The Blocked list on the video
The video's Analytics tab lists, under Blocked, every site that was refused. The blocked screen tells the viewer nothing, so this is where the record lives.
A one-click fix for your own site
When a refused site is one small change away from your list, such as www.example.com where you listed example.com, the row says This looks like your site. Press Add *.example.com and the entry is added and saved in one step. A video that followed the account default keeps the account's sites and adds this one.
See which sites your videos are embedded on
Sources, on each video's Analytics tab, lists the sites it loaded on over the last 30 days and how many of those loads turned into plays. The dashboard shows the top sources across the account.
Admins get Source activity: a day-by-day log of every Loaded, Played and Blocked event by video and site, over the last 30 or 60 days. New blocks appear within seconds, so you can fix a list and reload the page to check. (direct) is your share page or another Stillhaven page, and (hidden) is a browser that did not say where the embed was.
Only the website's name is recorded. Nothing about the viewer is kept.
Embeds in Notion, HubSpot and WordPress
Allow embeds through Iframely
Notion, HubSpot and many editors show a pasted link through Iframely, so the embed arrives from Iframely's servers rather than from your site, and a locked video is refused. Tick Allow embeds through Iframely and those embeds play without listing Iframely's hosts yourself.
Viewers whose browser hides the site
Some privacy tools and editors hide which site an embed is on. Those viewers can watch unless you tick Block viewers whose browser hides where the embed is. It is the strictest setting and can turn away real viewers, so leave it off unless you need it.
The WordPress plugin warns you first
With an API key, the Stillhaven plugin warns in the block editor and its Library when a video is locked to domains that leave your WordPress site out, and its settings page shows the exact host to add. Every paid plan includes a key.
Pasted links and the API
A pasted share link still turns into a player in editors that use oEmbed. The check happens when the player loads, on the site showing it. Changing allowed domains through the API is Creator and up.
How the check works, step by step, is in the embed docs.
Which plans include allowed domains
Every plan, Solo included: the account default, per-video lists, the Iframely switch, the Blocked list and the one-click fix. Changing allowed domains through the API is Creator and up. See every plan side by side on compare plans, or the rates on pricing.
Vimeo restricts embeds by domain too. What Stillhaven adds is the per-video setting beside the account default, and the report of the sites that were refused. Read Stillhaven vs Vimeo, Stillhaven vs Wistia or Stillhaven vs YouTube.
What it is not
Allowed domains controls where your videos can be embedded, not who can download or screen-record them. It is not DRM. If you need DRM-level anti-piracy, we are not the right tool yet.
It is not a password either. The check reads the site a viewer's browser reports, which a page on someone else's site cannot fake, and that is what stops a copied embed code. It does not keep a video private, and it does not touch your share page. To control who can watch, use a share-page password, an expiring link, or turn the share page off: see private sharing.
If you need embeds locked to your domains, no ads, and your own branding, see how we compare with Wistia, Vimeo, YouTube and others.
Questions people ask
How do I stop other sites from embedding my videos?
Open the video's Embeds section in the console, choose Only these domains, list your sites and save. Or set it once for the whole library in Settings, under Allowed domains. Embed code pasted anywhere else shows a blocked screen instead of the video. Every plan.
Do I need to list www and every subdomain?
No. An entry like *.example.com covers example.com, www.example.com and every other subdomain. Type example.com or www.example.com on its own and the console offers the wildcard, so the other form is not left blocked.
Will my share page and channels still work if I lock a video?
Yes. Allowed domains governs embeds on other sites. Your share pages, channel pages and the console play the video either way. To keep the share page from playing it, turn the share page off or give it a password.
Why is my video blocked in Notion or HubSpot?
Notion, HubSpot and many editors show pasted links through Iframely, so the embed arrives from Iframely rather than from your site. Tick Allow embeds through Iframely under the video's allowed domains, or in the account default, and those embeds play.
How do I find out where a video was blocked?
The Analytics tab on the video lists the sites that were refused under Blocked. When a refused site looks like yours, it offers to add it in one click. Admins can also see every load, play and block, by video and day, in Source activity.
Does Allowed domains stop people downloading or screen-recording my videos?
No. It controls where a video can be embedded, not who can download or screen-record it. It is not DRM. If you need DRM-level anti-piracy, Stillhaven is not the right tool yet.
Which plans include allowed domains?
Every plan, Solo included. Changing allowed domains through the API is Creator and up.
Lock your first embed in a minute.
Upload a video, list your site, paste the embed. 14 days free on any monthly plan.
Start 14 days free