How to Protect Online Courses from Piracy and Leaks

Search for how to protect online courses and you get two kinds of answer. The first is a list of settings that do almost nothing — disable right-click, add a "do not share" notice. The second is a platform claiming content is "100% protected", which nobody can honestly claim.

This article takes the harder position: what each control actually achieves, what it does not, and where the money is best spent. Some of it is uncomfortable, because the honest answer to the most common question is no.

Start with who is actually leaking your course

Most protection advice imagines an attacker — someone technical, breaking in. For course businesses that is almost never what happens.

The real sources, in rough order of frequency:

1. A paying student sharing their login. One seat, a group chat, several people watching. Usually not malicious; they do not think of it as theft.
2. A paying student recording lessons and passing the files on, or reselling them cheaply.
3. A group buying one seat deliberately, treated from the start as a discount.
4. A competitor buying access. Rare, and the case where knowing which account leaked matters most.

Notice what is absent: nobody is attacking your server. That matters, because it tells you where to spend. Infrastructure security is table stakes your platform should already handle. What protects your revenue is control over accounts, devices and playback.

The thing that cannot be prevented

One problem no technology solves: someone points a phone at the screen and records.

Once video is visible to a human eye, it can be captured. No encryption or system setting prevents that, because being seen is the entire purpose of the video. Everyone serious about content protection accepts this. Every vendor claiming "unbreakable" protection is either uninformed or hoping you are.

Accepting it is not defeatism — it is what lets you spend sensibly. Once you stop trying to buy the impossible, the question becomes: given that a determined person can always capture this, what makes the copy useless or dangerous to them?

That question has a good answer.

The controls that work, ranked

1. Per-student watermarking

The individual student's details, drawn into the video as it plays, ideally moving so they cannot be cropped away.

This is the only control that survives everything on the list above, including the camera, because the watermark is part of the picture rather than a layer over it.

What it stops is not the copy — it is the anonymity of the copy. Every leaked file identifies the account it came from.

Why that is worth more than it sounds: it changes behaviour before anything leaks. A student who can see their own name over a lesson understands immediately that sharing traces back to them. Most casual sharing simply stops. The people it does not stop, you can identify and remove.

The watermarking guide covers how to configure it properly.

2. Device limits and activity monitoring

A cap on how many devices one account can use, plus monitoring that separates normal viewing from sharing.

This addresses the most common leak directly: one login, many people. It will not turn a small determined group into several separate customers — but it converts "share with everyone" into "share with very few, with effort", and that is a very different number.

The account-sharing guide covers how to set limits that stop sharing without punishing the student who legitimately owns a phone, a laptop and a tablet.

3. Secure video delivery

Your video should not sit at a fixed public address. It should be served to an authorised viewing session through links that expire, so there is nothing durable to save, forward, or hand to another tool.

This is invisible when it works and expensive when it is missing. When you evaluate a platform, ask whether video delivery is session-bound and short-lived — as a yes-or-no question.

4. Screenshot and recording protection

What this stops is the convenient path. Most people who record a course reach for whatever is already on their device; remove that and a meaningful share give up. It is strongest inside a mobile app, where the phone's own system enforces it.

It cannot stop a camera pointed at the screen. Treat it as valuable friction, not as the thing you rely on. The honest version is here.

5. Warnings before bans

A graduated response: warn on the first signal, restrict on the second, ban on the third.

This belongs in a list of technical controls because most sharing is thoughtless rather than deliberate. A clear warning converts a large share of casual sharers into compliant customers. Banning immediately loses the revenue and the goodwill.

Where DRM actually fits

DRM is the encryption-and-licensing system streaming services use for film and television. It is strong at exactly one job — stopping the file and the stream from being copied — and that job overlaps heavily with what secure delivery already achieves, at a fraction of the cost.

Meanwhile it contributes nothing to the two problems that actually cost course businesses money: recording and sharing. It also carries ongoing licence fees and can cause playback failures on older devices, each of which is a student who paid you.

For a large streaming service with studio contracts, DRM is mandatory. For a course business, watermarking and device control are simply better value. The detailed comparison works through the trade-off.

Protection theatre

Be honest about these so you do not count them as security:

• Disabling right-click. Stops nobody, annoys everyone, and does not touch video at all.
• An "unlisted" link. Unlisted is not private. One share and it is public.
• A copyright notice in the footer. A legal position, not a control. Useful for takedowns, useless for prevention.
• Splitting videos into many small files. Changes nothing meaningful about how easily a library is copied.

None of these are harmful. They are just not protection, and treating them as protection is how people end up surprised.

What to do in your first hour

1. Turn watermarking on before you enrol a single student. It is the highest-value control, and it only helps content that already carried it.
2. Set a device limit that fits a real student — a phone, a laptop, maybe a tablet.
3. Confirm video delivery is session-bound and expiring. Ask your platform directly.
4. Enable recording protection where offered, and accept it as friction rather than a wall.
5. Turn on warnings before bans. You want compliance, not churn.

If you have already been leaked

Work in this order.

Identify the source. If your videos carry per-student watermarks, the leaked copy names the account. This is the moment the watermark pays for itself — and the moment its absence is most expensive, because without it everything below is guesswork.

Close the account and keep the evidence. File takedowns with whoever hosts the copy; most platforms act on a clear copyright claim from the real owner. Then turn on what was off, because leaks recur through the same open door.

And re-price your expectations. Some leakage is a cost of doing business online, in every market. The instructors who do well are not the ones with zero leaks. They are the ones who made leaks traceable, kept casual sharing to a manageable level, and kept selling.