Domain restrictions are an account-level setting that controls which websites can display your embedded content. When enabled, your embedded media will only display on domains you approve, preventing unauthorized embedding on other sites.
Note
Domain restrictions apply to your entire account, and they can't be enabled for a single video, folder, or Channel.
Set up the domain allowlist
Note
You must be an Account Owner to enable domain restrictions and manage the domain allowlist.
If your account is a sub-account, domain restrictions are managed from the parent account. The setting won't appear in a sub-account's settings, even for its Account Owner. Ask the parent account's Owner to update the allowlist.
To access domain restrictions, open up your account's dropdown menu and select "Settings," then "Account." From your Account page, scroll down to the Domain restriction section.
Before enabling this feature, list all domains where you have embedded content and add them to the allowlist.
Note
For security purposes, Channels can't be accessed via a share link when the domain restrictions setting is enabled. This is intentional and prevents viewers from bypassing your allowlist with a direct link. Adding fast.wistia.net, fast.wistia.com, or wistia.com to the allowlist won't change this, and Channels must be embedded on an allowed domain instead. Channels on an active custom domain don't need to be added to your allowlist.
Domain formatting rules
Enter domains without the
http://orhttps://prefixSpecific pages or paths are not supported (for example,
wistia.com/supportwill be treated aswistia.com)Entering a domain covers all subdomains (for example,
wistia.comallowssupport.wistia.com,lenny.wistia.com, etc.)Subdomains are supported (for example,
support.wistia.comwill only approve this specific subdomain)Separate multiple domains with commas (for example,
example.com, help.example.com, partner-site.com)You don't need to include
www.or wildcards like*.example.com. Enteringexample.comalready covers all of its subdomains.For staging or preview environments that use changing subdomains, enter the parent domain (for example,
vercel.app). Keep in mind this allows any site on that domain.
Note
wistia.com is always included in your allowlist, so media will display on your Wistia account pages. Channel share links are the exception. They won't open when domain restrictions are enabled, even on your wistia.com account URL.
Enable domain restrictions
Once you've configured your domain allowlist, set domain restrictions to “Enabled” and click "Save Changes."
If the domains are formatted correctly and everything works as expected, your embeds will continue to display without issue. From there, you should only need to update the allowlist when embedding on a new domain.
Tip
After enabling domain restrictions, we strongly recommend checking your embeds to make sure they still display on your allowlisted domains. Embed formatting issues or on-page conflicts can sometimes interfere with domain detection.
Note
Domain restrictions may interfere with Apple AirPlay on certain devices.
Embedding requirements for domain restrictions
Domain restrictions rely on specific elements within the Wistia embed code to function properly. Issues can occur if the embed codes are modified, whether intentionally or unintentionally.
Note
Whenever possible, use the embed codes Wistia provides without modification. The only modifications we support are official features, like our Embed options or Player API.
There are a few important components here, included by default with every Wistia embed code:
The embed must have
class=”wistia_embed”for our legacy embed code orwistia-player[media-id='hashedid']for the Aurora embed code.Our
E-v1.js(legacy embed code) orplayer.jsscript (Aurora embed code) must be included on the same webpage.If you're using an iframe (fallback) embed code,
E-v1.jsorplayer.jsmust be on the page outside of the iframe (it will always load inside the iframe).
When your embeds load on a page, the player first tries to match the parent page's domain against the domains in your allowlist, then either embeds or restricts the media. It does this by checking the page’s referrer value.
Tip
If your video is embedded inside a non-Wistia iframe (like a page builder or within edit/preview mode), the player may see that iframe's domain and block the video. Allowlist the iframe's source domain and test on the live published page rather than in a builder preview.
Note
Domain restrictions rely on the browser sending the page's referrer, so some referrer policies will block your embeds.
Compatible:
no-referrer-when-downgrade,origin,origin-when-cross-origin,strict-origin,strict-origin-when-cross-origin,unsafe-urlNot compatible:
no-referrer,same-origin
Check out this developer documentation for a full breakdown.
The most common explanation for seeing the “video is not authorized to be embedded here” message on a domain you’ve added to the allowlist is modification or removal of the E-v1.js or player.js scripts, depending on your embed code. If one of these scripts is removed, modified, delayed, or self-hosted, domain restrictions will not work as expected.
Troubleshooting
"This video is not authorized to be embedded here."
If you embed media on a webpage that isn't on your domain allowlist, you’ll see an error message where the video should display: This video is not authorized to be embedded here.
If you see this message on a domain that is on the allowlist, there may be an issue with domain detection on the page. Make sure you're using the embed code Wistia provides without any modifications.
If nothing changed on your site or allowlist, check that your Wistia account is still active. A canceled or suspended account can show this same message.
Still seeing the error? Reach out to Wistia Support with the URL of a page where the error appears and your Wistia account URL, so we can check the page and your allowlist.