Protecting a live stream: who sees your camera, where and when
Putting a camera on your website does not mean everything is open to everyone. Here is every control you have over who watches, on which site and at what hours — and what you must do on the camera side yourself.
Three modes: public, password, email
Every stream has an access mode. You pick it once and can change it at any time without touching the embed code. Choose the one that matches what the camera is for:
| Mode | How it works | When to use it |
|---|---|---|
| Public | Anyone who opens the site or link sees the video straight away | Sea views, ski slopes, city panoramas — anything that works as marketing |
| Password | The viewer enters a password before watching | Construction progress for a client, an internal team, temporary access |
| Email verification | The viewer confirms their email address before watching | When forwarding the link alone must not be enough: partners, investors, parents |
Allowed domains: the embed only works on your sites
Anyone can copy an embed code; all it takes is viewing your page source. To stop other people putting your camera on their sites, list your allowed domains in the stream settings, for example example.ge and www.example.ge. Our server tells the browser through the frame-ancestors header which sites may show the player, and on every other site the browser simply refuses to load it. This is enforced by the browser itself, so code on someone else's site cannot get around it.
- List every address your site opens on: with and without
www, plus subdomains such asbooking.example.ge. - If you have a staging copy of the site, add it too, or the player will not appear there.
- The domain list restricts embedding. A direct link that you share separately still opens in any browser, so when only specific people should watch through a link, use password or email mode.
For putting the player on a page, see embedding a camera on your website; on WordPress, use the WordPress plugin.
Viewing hours
A schedule makes the stream available only during the hours you set: a restaurant terrace from 10:00 to 23:00, or a building site only during the working day when crews and machinery are there. Pick the time zone (Georgia is UTC+4 all year, with no daylight saving), then the start and end time. If the end is earlier than the start, the schedule runs overnight, for example 22:00–06:00. Outside those hours the stream is not shown, while the embed code stays on your site unchanged.
Revoking and rotating a link
If a link or embed code ends up where it should not — on social media, a forum, a former employee's phone — revoke or rotate it from the dashboard. The old one stops working at once. After rotating, put the new code or link on your site; in WordPress, update the id in the shortcode.
What viewers never see
- Your camera's real IP address and port. The viewer's browser connects to our server, never to your camera. We take one stream from the camera and serve every viewer from our side.
- The camera username and password. They are stored encrypted on the server and never reach the browser.
- A permanent video address. Viewing tokens are short-lived and signed: a stream address copied out of the player expires quickly, and a modified or forged token is rejected.
The Live switch: stop it now
Every camera has a Live switch in the dashboard. Turn it off and delivery stops; viewers see the change within seconds. Use it when the frame shows something it should not: repairs, an incident, a private event. Turning it back on is one click, and the link and embed code stay the same.
The camera side is your job
Everything above protects the viewing side. You are the one putting the camera on the internet, so these five rules are not optional:
- Create a separate view-only user on the camera and enter that in the dashboard. Never admin. Where to create it is in each brand's guide: Hikvision, Dahua, Uniview.
- Change the default password on every account, including the recorder's.
- On the router, forward only the RTSP port (usually 554). The camera's web admin ports — 80, 443, 8000 — must never be open to the internet. See port forwarding.
- Keep camera and recorder firmware up to date; old versions have known vulnerabilities.
- Never send a camera password over chat or a messenger. Enter it only in the dashboard, where it is stored encrypted.
Can someone embed my camera on another website?
Not if you have set allowed domains in the stream settings: on any other site the browser will not load the player. If you leave the list empty, the code works anywhere.
My link leaked. What should I do?
Revoke or rotate it in the dashboard; the old link stops working at once. Then put the new code on your site. If it is urgent, switch Live off first.
Can viewers see my camera's IP address or password?
No. Viewers only ever connect to our server, and the camera credentials are stored encrypted and never sent to the browser.
Can the camera be visible only during business hours?
Yes. Set a time zone, start and end time in the viewing schedule. Overnight schedules such as 22:00–06:00 work too.
Password or email verification — which should I choose?
A password is simple and suits a small group you know. With email verification each viewer has to confirm their own address first, so forwarding the link alone is not enough.