Protecting an Online Course from Piracy: What Works and What Is Security Theatre

Sooner or later everyone selling an online course finds their lesson in someone else's Telegram channel for a few dollars, or in a 40-person group buy. The first reaction is panic and a search for the «most protected player». In reality, 80% of leaks are closed by three settings you can implement in a single evening. The remaining 20% is a question of economics, not technology.

First, calculate what a leak actually costs

Before spending a month on protection, size the damage. A $120 course in a 40-person group buy looks like $4,800 of lost revenue. The real loss is smaller: most group-buy participants would never have paid full price. A practical rule is to count 15–25% of those accesses as genuinely lost. That number is your protection budget. If a DRM solution costs $300 a month and your leaks amount to $500 a year, you are financing paranoia.

One more thing worth remembering: watching a pirated video almost never converts into a result. Without feedback, assignments and a community, that person quits at lesson two.

Layer 1: access. This is where 80% of the problem hides

The most common «leak» is not a hacker with a torrent — it is three friends sharing one login. Basics that close it:

• One person, one account, tied to an email or phone number. Log in with a magic link or a Telegram code instead of a password that is trivially forwarded into a chat.
• A concurrent-session limit. Two or three sessions are normal (phone, laptop, tablet). Five sessions from different cities within an hour is a shared account.
• Login logs: time, IP region, device. Not for punishment, but for a conversation. An email saying «we see logins from three different cities — do you need family access?» works better than an automatic ban.
• A soft response instead of a hard one. Auto-blocking hits ordinary students who simply changed phones. Start with a warning and a forced logout from all sessions; block only after that.

This set of settings usually cuts «one payment, four students» several times over and costs nothing but an evening of work.

Layer 2: video. Never hand out direct links

The main technical mistake is putting an mp4 file in public storage and embedding it as a direct link on the lesson page. That file is downloaded in two clicks by any browser extension.

1. Streaming instead of a file. An HLS stream cut into segments instead of a single mp4. It can still be captured, but that is a deliberate exercise, not «save as».
2. Signed links with a short TTL. The video URL lives 5–15 minutes and is bound to a specific student's session. A link forwarded into a chat simply dies.
3. Domain restriction. The video plays only on your domain.
4. A dynamic watermark. The student's email or ID is overlaid on the video and moves every 30–60 seconds. The leak becomes personally attributable — often one email saying «every video carries your address» is enough to kill the urge to share.
5. DRM (Widevine, FairPlay) only if the numbers justify it. It is expensive to maintain and breaks playback on some student devices. It makes sense for high-ticket programmes or licensed content you cannot afford to lose.

For PDFs and workbooks: stamp the buyer's name and email into the header when the file is generated. A personalised PDF spreads far less than an anonymous one.

Layer 3: legal and social pressure

• A public offer and a copyright block in every lesson. State that access is personal and non-transferable, and that violation is grounds for blocking without a refund.
• Platform complaints. Telegram, YouTube and Google accept rightsholder complaints. A channel reselling your course is usually removed within days once you submit proof of authorship.

What does not work: security theatre

• disabling right-click — bypassed with PrintScreen;
• blocking DevTools — bypassed by turning off JavaScript;
• «screenshot protection» in a browser — it does not exist, there is no such API;
• complex passwords instead of proper authentication — passwords get forwarded even more eagerly than links.

The general rule: if the protection damages the honest student's experience more than it inconveniences the pirate, do not ship it.

A one-evening checklist

1. Check whether your video sits in public storage as a direct mp4 link.
2. Turn on session limits and review the last month of login logs.
3. Add a dynamic watermark with the student's email.
4. Personalise your PDF materials.
5. Put personal, non-transferable access into your terms.
6. Tell students once that every material carries their identifier.

The best protection is what cannot be copied

Video copies. What does not copy: assignment reviews by a tutor, live breakdowns, the community, points and levels for progress, a certificate you can show an employer. Schools holding 70–80% completion rates rarely have the best DRM — they have the strongest support around the content, and piracy hurts them less because a stolen archive of lessons does not deliver what people actually pay for.

At CREO we are building the platform around exactly that: gamification that pushes completion to 70–80%, Telegram funnels, a sales-page builder, a CRM, WayForPay and Stripe payments — and MCP-based school management that beta testers get first. The beta starts in August 2026. Join the early list at platform.creo.ua — beta seats are limited.