Embed private video on your website—no ads, no borrowed player

To embed private video means to show a video inside your own page so that it has no public life anywhere else: no page on another platform, no spot in search or recommendations, no player that works on any site the code gets copied to.

It sounds obvious, but in practice people often confuse “private” with “hidden.” An unlisted YouTube video is hidden from search, but the link opens for anyone who has it, and the embed code works anywhere (more in our guide on how to share a private video on YouTube). Hidden isn’t private.

A private embed has three traits. First, the player plays only on your domains. Second, there’s no third-party platform around the video—no ads, no “watch next,” no logo linking away from your site. Third, the video has no public page that anyone can reach without going through your website.

Back to Tucson. The brokerage’s tours were “unlisted”—and still easy to find: their code was embedded on listing aggregators’ pages, and one tour even turned up on a competitor’s website, next to that competitor’s own ad. When the brokerage began to embed private video through VodSpot, its marketing coordinator added the main website, plus a *. wildcard for the agents’ personal pages, to the list of allowed domains. Copied code on someone else’s site now shows an empty frame, and in detailed analytics (Pro and above), the “Embedded on” line shows which sites the player actually played on.

Your video should play where you put it. And nowhere else.

YouTube is a great free way to build an audience. But its player on your website works for YouTube, not for you—and Google’s own documentation makes that clear.

You can’t turn off related videos at the end. Since September 25, 2018, rel=0 no longer removes them; per the YouTube IFrame Player API reference, “related videos will come from the same channel as the video that was just played.” And modestbranding, which used to hide the logo, “is deprecated and has no effect” as of August 15, 2023: the player now decides how much branding to show.

There’s a speed cost, too. In its Web Almanac 2022, HTTP Archive found that on phones, YouTube’s scripts block the browser’s main thread on 90% of the sites that embed it, with a median blocking time of more than 1.7 seconds. The main thread is what responds to taps and scrolling. While it’s busy with someone else’s player, your page doesn’t respond.

In Tucson, it played out like this. The brokerage’s web developer added rel=0, and the end of each tour started showing the brokerage’s own listings instead of other people’s—including homes that had sold long ago. The YouTube logo stayed in the corner, and the listing page still loaded slowly on phones.

Video embed hosting from VodSpot works differently. The player has no ad network and no recommendation feed: after the tour comes your own screen with a button (Pro and above), or a replay. The embed code already includes loading="lazy", so the browser loads the player only when the visitor scrolls to it. The lightbox option doesn’t load the player at all until a click: the page gets only a preview image with a ▶ button in your brand color and a small script, and the player opens over the page on click. We don’t quote numbers on player “weight”—run Lighthouse on your page before and after.

YouTube brings viewers to you. Your own player doesn’t hand them back.

It’s one of the most common WordPress questions: how to embed private video without anyone grabbing the file link. The short answer: you can’t hide the URL, but you can make it useless anywhere else.

If an MP4 file sits on the page, anyone who opens developer tools can see its URL. We covered script tricks for hiding it in our guide on how to embed a private video on a website: they’re an inconvenience for a developer, not a security measure.

When you embed private video through VodSpot, the page code has no file URL at all. It holds only the player’s URL, and that URL:

• doesn’t play anywhere except on your domains — not on someone else’s website, and not when opened in a separate tab;
• doesn’t lead to the original — storage has no public URLs, and the stream is served through signed links that last 3–4 hours; the player fetches a fresh one on its own, without reloading the page;
• can be on your domain — on Pro and above, the embed code is built on your address, for example video.yourbrokerage.com, not ours;
• changes with one click — Regenerate link gives the video a new URL, and every old code stops working.

Here’s the honest limit: anyone legitimately watching the video can record their screen, and no hosting service can stop that. VodSpot has no DRM. For work where a leak is costly, there are delivery pages with viewer email sign-in and a watermark showing the viewer’s email (Studio).

Everyone can see the URL. What matters is that it only works on your site.

An embedded player isn’t a picture. It’s someone else’s code running on your page, and it can send data back to its owner. And according to the Court of Justice of the European Union, that’s partly on you.

In 2019, the Court heard the case of Fashion ID, a German online clothing retailer that had embedded Facebook’s “Like” button. The button sent visitor data to Facebook even if the visitor never clicked it and had no Facebook account. The Court ruled that a website embedding such a plugin is a joint controller for the collection and transmission of that data—so it must inform visitors and, where required, get their consent.

Hence the banners that hide YouTube until the visitor consents. And consent is rare. That same year, Christine Utz and colleagues from Ruhr University Bochum and the University of Michigan tested consent banners on a German website with 82,890 visitors (presented at ACM CCS): when third-party services were off by default, fewer than 0.1% of visitors chose to allow them all. The Tucson brokerage saw this on its own pages: some visitors got a gray rectangle reading “Accept cookies to watch” instead of a tour.

YouTube’s Privacy Enhanced Mode (youtube-nocookie.com) softens the problem but doesn’t solve it. YouTube’s help page promises that views “will not be used to personalize the YouTube browsing experience,” and warns that if a viewer clicks out of the player, the site they land on “may track the viewer’s behavior.” What it doesn’t promise is that this mode sets no cookies.

The VodSpot player has no ad networks or third-party trackers, and the only thing it sends is basic viewing stats, to us. We don’t store viewers’ IP addresses. An anonymous viewer ID and the spot where the viewer stopped live in their own browser, so we can count views and resume playback where they left off. Your privacy policy should still mention the player. But when you embed private video through VodSpot, there’s far less to describe.

A good player doesn’t give your cookie banner extra work.

An embed isn’t really tested on your laptop. It’s tested on the viewer who struggles with it. Every year, WebAIM checks the home pages of the top million websites. Its 2026 report found accessibility errors on 95.9% of pages, 56.1 per page on average, and pages with embedded YouTube videos had 9.4 more errors than average. WebAIM doesn’t blame the player itself, but the takeaway is clear: an embedded video is part of your page, and its problems are yours too. We cover how to make video accessible in our guide to captions and accessibility.

What to ask any video embed hosting service:

• Can I block the player on other websites? And is that included in my plan? VodSpot allows up to 25 domains on all plans, including the trial. Vimeo’s “Specific domains” setting is “Available for all plans except Free and Basic,” with up to 50 domains per video, but “Wildcard characters are not supported.” Wistia’s restriction applies to the whole account, and only the Account Owner can turn it on.
• What will the viewer see after the last frame? Other people’s videos, or your screen and button?
• Are there subtitles in several languages, and chapters? VodSpot allows up to 20 tracks per video, SRT or WebVTT, and up to 100 chapters.
• Can I embed several videos at once? On Pro and above, a delivery page with an open link embeds as a playlist—say, the tour, drone footage, and a neighborhood walk-through for one house. Unpublish the page or let its expiry date pass, and the playlist stops playing on your site.
• Whose address is in the embed code? On Pro and above, it’s your domain.
• Can I see where the player is playing? Detailed analytics (Pro and above) shows the sites it’s embedded on, views, and completions. More on the video analytics page.
• What does the player send to third parties? Ad networks, trackers, viewer IPs?
• What does bandwidth cost? VodSpot plans are priced by storage, so a popular tour doesn’t run up a bill for its viewers.

In Tucson, the answers pointed to Pro: $59 a month, three seats for the team, 500 GB of storage, their own domain in the code, a “Book a Showing” button on every tour, and playlists for homes with several videos. Prices for all plans are on the pricing page. If you’re building a whole video website around videos like these, start with our guide on how to build your own video website.

The best player is the one your viewer never thinks about. They just watch.