Where your videos can play

Domain rules control which websites may load your published players. They work alongside visibility and passwords, not instead of them.

Start with workspace rules

Open Customization and find Where videos can play. Choose Anywhere to allow websites unless another rule blocks them. Choose Only these domains to start with a restricted allowlist. Workspace allowed domains apply to every video.

Always blocked domains take priority over every allowed-domain rule. A per-video setting cannot override a workspace block.

Then apply video rules

Open a video and use its Visibility panel to add extra allowed domains or domains blocked for that video. Extra allowed domains extend the workspace allowlist. They do not replace it. Video blocks are evaluated after workspace blocks and before allowed domains.

How Playflow decides

1. If a workspace block matches, playback is blocked.
2. If a block for the video matches, playback is blocked.
3. If any workspace or video allowlist exists, playback is allowed only when one of those allowed rules matches.
4. If no allowlist exists, playback is allowed unless a block matches.

A top-level Playflow watch page remains allowed unless you switch off Allow the Playflow watch page. Framing a watch page does not bypass domain rules: the website embedding that frame must still pass the video's effective domain policy.

Allowed-domain checks use the outermost available ancestor. Explicit blocks are checked across every available ancestor, so a blocked intermediate frame cannot hide behind an allowed top-level website. When ancestor-origin information is unavailable, Playflow falls back to the referrer, which can identify only the immediate parent.

If a player cannot establish the website that requested it, Playflow allows the request only when the effective policy is unrestricted. With any allowlist in effect, an unknown origin is blocked.

Parent domains and subdomains

Enter a hostname such as example.com or *.example.com. Both forms are stored as example.com and match the parent plus every subdomain, including www.example.com and learn.example.com. Do not enter a scheme, path, port, or IP address.

What the video host receives

The video host receives one safe workspace-wide policy. Its allowed-domain set is the union of the workspace allowed domains and extra allowed domains from every video. Its blocked-domain set contains workspace blocks only. Playflow separately enforces the exact workspace and per-video policy on embed and player requests, including video-specific blocks.

Examples