Not completely. A browser must request a playable media resource, so a determined viewer can usually discover or capture that request. PHP can, however, keep the original file path private and require authorization before serving the video. That protects the origin file and can reduce unauthorized reuse; it does not make the media URL secret.
What “hide the video URL” can mean
There are three different goals, and PHP addresses them differently:
As an Amazon Associate I earn from qualifying purchases.
- Hide the filesystem path: store the video outside the public document root so the web server cannot serve it through an ordinary static URL.
- Control access: send the browser to a PHP endpoint that checks a login, session, entitlement, or other authorization before reading the file.
- Make the browser’s request invisible: this cannot be guaranteed. Playback requires a request that the browser can inspect, and a viewer can potentially copy, capture, or share it.
The practical target is therefore access control and origin-path protection, not absolute URL secrecy.
What the 2016 SitePoint thread demonstrates
The original discussion starts with relax3.mp4 beside test.php and an HTML5 <source> URL containing a session identifier and an MD5 value. Replies move the file into a directory outside the public web root, then use a public PHP script to look up the requested media and return it. A final example places that endpoint in a <video controls> element.
#1 Best Overall
This is a useful illustration of the architecture, not a current, production-ready streaming implementation. The thread explicitly leaves PHP streaming functions as “another topic.” It does not verify modern PHP behavior, web-server configuration, range requests, caching, authorization design, or deployment performance. Treat the session/hash pattern as historical sample code, not as a security scheme to copy unchanged.
The safer architecture for self-hosted video
- Keep the media outside the document root. The public web directory should contain the PHP endpoint, not the original MP4. This only works if your server is actually configured so that the private directory cannot be mapped to a public URL.
- Require authorization in the endpoint. Check the logged-in user, permission, subscription, or other rule before opening the file. Reject unauthorized requests before any media bytes are sent.
- Use an opaque resource identifier. The browser can request an ID or token that your application maps to a server-side path. Do not trust a user-supplied filesystem path.
- Return the media through a delivery method your host supports. A real implementation may need correct content type, byte-range handling for seeking, cache behavior, and efficient file delivery. Confirm these details in your current PHP and hosting documentation rather than relying on the short forum snippet.
- Consider expiry and session binding. A temporary or session-linked URL can make a copied link less reusable. It still cannot prevent someone from obtaining the playable response while authorized, and it is not foolproof against capture or sharing.
What this setup does and does not stop
| Measure | What it helps with | What it cannot guarantee |
|---|---|---|
| Private storage outside the public root | Direct requests to the ordinary origin file path | Protection if server aliases, backups, or another public route expose the file |
| PHP authorization endpoint | Checking access before serving bytes | Preventing an authorized browser from saving or recording the response |
| Session- or time-linked token | Reducing the useful lifetime or reuse of copied links | Absolute secrecy or prevention of capture and sharing |
| Renaming or disguising the file | Little more than obscurity | Meaningful access control when the file remains publicly reachable |
Why renaming, hashes and right-click blocking are not enough
Changing video.mp4 to an unpredictable name does not help if anyone who learns that name can request it. A hash in a URL is only useful when the server treats it as a short-lived, authorized capability; a static hash is not protection by itself. The SitePoint example’s MD5/session construction is old and should not be represented as a current security design.
Rank #2
Disabling the context menu is not a security boundary. JavaScript can be disabled, and the browser’s network and media tools remain available to a determined viewer.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →When managed video hosting is the better fit
If you do not want your application to handle media delivery, a managed video service may provide an alternative. A related forum participant mentioned Vimeo Pro in a 2014 discussion, but that historical suggestion does not establish the product’s current features, terms, pricing, bandwidth model, or suitability. Compare a current provider against your actual requirements for authorization, playback, bandwidth responsibility, embedding controls, and download policy.
Self-hosting gives you control over application-level decisions but leaves you responsible for storage, bandwidth, server configuration, and correct streaming behavior. Managed hosting can shift delivery responsibilities, but its access controls and policies must be checked against your present needs.
A practical decision checklist
- Is the file genuinely outside every public web path?
- Does the endpoint authorize each request before opening the file?
- Can a request parameter ever select an arbitrary filesystem path?
- Does the delivery method support the seeking behavior your player requires?
- Are tokens scoped, expiring, and invalidated when access should end?
- Have caching, logs, referrers, backups, and alternate hostnames been considered?
- Have you tested the configuration on your current PHP version and hosting stack?
The bottom line
Use PHP to protect the video’s origin path and enforce authorization, not to promise an invisible URL. A browser that can play the video can generally obtain the media request. The old SitePoint discussion captures the basic private-storage-plus-endpoint pattern, but its sample is incomplete and historical; production use requires current security review, server configuration, and streaming support.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
