---
title: "Origin protection for video"
description: "How to keep adult video origins private and unbypassable: signed playback, hotlink and leech prevention, stopping range-based egress theft, cache-key hygiene, and takedown purges."
url: "https://adultinfra.com/docs/video/origin-protection-for-video/"
dateModified: "2026-09-12"
---

[Home](https://adultinfra.com/) / [Docs](https://adultinfra.com/docs/) / Video and live 

# Origin protection for video

How to keep adult video origins private and unbypassable: signed playback, hotlink and leech prevention, stopping range-based egress theft, cache-key hygiene, and takedown purges.

LAST REVIEWED 2026-09-13

ON THIS PAGE

- [Private origins](https://adultinfra.com/docs/video/origin-protection-for-video/#private-origins)
- [Signed playback](https://adultinfra.com/docs/video/origin-protection-for-video/#signed-playback)
- [Hotlink and leech prevention](https://adultinfra.com/docs/video/origin-protection-for-video/#hotlink-and-leech-prevention)
- [Preventing range-based egress theft](https://adultinfra.com/docs/video/origin-protection-for-video/#preventing-range-based-egress-theft)
- [Keeping auth out of the cache key](https://adultinfra.com/docs/video/origin-protection-for-video/#keeping-auth-out-of-the-cache-key)
- [Purge on takedown](https://adultinfra.com/docs/video/origin-protection-for-video/#purge-on-takedown)
- [Where AdultInfra fits](https://adultinfra.com/docs/video/origin-protection-for-video/#where-adultinfra-fits) 

Video is the most expensive thing you serve and the easiest thing to steal. If an origin is publicly reachable, every cache, token, and access rule you configured at the edge can be bypassed by hitting the origin directly. **Origin protection** is the set of controls that keep the origin private, make playback URLs non-transferable, and stop egress theft before it becomes a bill.

## Private origins

An origin should accept traffic only from your edge, never from the open internet. Common approaches:

- **IP allow-listing** the edge egress ranges at the origin firewall or object-storage policy.

- **A shared secret header** that the edge injects and the origin requires, with the origin rejecting requests that lack it.

- **A private network path** between edge and origin so no public route exists at all.

If the origin must stay reachable, at minimum require the secret header and reject anything else with a `403` rather than serving it. Verify protection by requesting an origin URL from a machine outside the edge and confirming it fails; an unprotected origin is the single most common cause of a sudden egress spike.

## Signed playback

A signed URL or token proves that a specific viewer is entitled to a specific object for a limited time. Good signing has four properties:

- **Scope:** the signature covers the exact path and any binding parameters, not a whole domain.

- **Expiry:** short enough that a leaked URL is useless quickly, long enough to cover a full viewing session including seeks.

- **Viewer binding:** where feasible, tie the token to a session or device so it cannot be pasted elsewhere.

- **Edge validation:** the edge verifies the signature and rejects tampering before any cache or origin lookup.

Because manifests reference segment URLs, sign the manifest and the segments consistently. If segments are unsigned but the manifest is signed, a viewer can extract segment URLs and share them; if segments are signed per-request, confirm the player re-signs each one or that tokens cover the whole session.

## Hotlink and leech prevention

Hotlinking and leeching are third parties embedding or proxying your media to serve their own audiences on your bandwidth. Defences stack:

- **Referer allow-listing** at the edge for browser playback, with a documented fallback for players that strip it.

- **Origin binding and signed tokens** so a copied URL is not reusable from another context.

- **Rate and concurrency limits per viewer** so one session cannot fan out into many.

- **User-agent and behavioural rules** for automated scraping, applied as signals rather than sole gates.

No single signal is trustworthy on its own; combine them and log the decisions so false positives can be tuned without weakening the policy.

## Preventing range-based egress theft

Byte-range requests are essential for seeking, but they are also an egress-theft vector. An attacker can request tiny ranges across a huge catalogue to reconstruct files while defeating naive per-request accounting, or exploit a cache that forwards each range to origin. Controls:

- Ensure the edge serves `206 Partial Content` from cache and does not refetch the whole object per range. See [Cache control and cache keys](https://adultinfra.com/docs/cdn/cache-control/).

- Normalise, order, and cap the number of ranges per request so a single request cannot walk an entire file.

- Apply per-session byte budgets, not request counts alone, so slow-drip scraping is bounded by volume.

- Watch for patterns of many distinct ranges across many objects from one identity.

## Keeping auth out of the cache key

This is the most common self-inflicted wound. If a signed token, session ID, or viewer parameter is part of the cache key, every request is unique, the cache becomes a pass-through, and origin egress scales with viewers. Validate entitlement at the edge, then derive the media cache key from the path and genuinely object-defining fields only. Keep authentication out of the key. See [Cache control and cache keys](https://adultinfra.com/docs/cdn/cache-control/) for key composition and [secure tokens](https://adultinfra.com/docs/cdn/secure-token/) for the validation model.

## Purge on takedown

When content must be removed (rights, consent withdrawal, or a lawful order), deletion has to propagate through every layer: origin storage, edge caches, and any derived artifacts such as thumbnails, sprites, and manifests. A hard purge of hot objects can itself cause an origin stampede, so invalidate rather than stampede where the object is still live, and confirm the origin no longer serves the bytes. See [Purge, invalidation, and prefetch](https://adultinfra.com/docs/cdn/purge-and-prefetch/).

## Where AdultInfra fits

AdultInfra keeps origins unreachable from the public internet, binds playback to short-lived signed tokens, and profiles range and session behaviour so egress theft is caught early. Content rights, consent, and takedown obligations remain the customer’s responsibility. Bring one hostname and an origin-egress target to [contact us](https://adultinfra.com/contact/).

**Need this configured for your platform?** [Get a test plan](https://adultinfra.com/contact/) and an engineer will map the resource, cache, and delivery design to your workload.

```json
{"@context":"https://schema.org","@graph":[{"@type":"TechArticle","headline":"Origin protection for video","description":"How to keep adult video origins private and unbypassable: signed playback, hotlink and leech prevention, stopping range-based egress theft, cache-key hygiene, and takedown purges.","url":"https://adultinfra.com/docs/video/origin-protection-for-video/","dateModified":"2026-09-13","keywords":"video origin protection, signed playback URL, hotlink prevention, range request egress theft, adult video cache key","author":{"@id":"https://adultinfra.com/#organization"},"publisher":{"@id":"https://adultinfra.com/#organization"},"inLanguage":"en"},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://adultinfra.com/"},{"@type":"ListItem","position":2,"name":"Documentation","item":"https://adultinfra.com/docs/"},{"@type":"ListItem","position":3,"name":"Origin protection for video","item":"https://adultinfra.com/docs/video/origin-protection-for-video/"}]}]}
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://adultinfra.com/#organization","name":"AdultInfra","url":"https://adultinfra.com","logo":"https://adultinfra.com/favicon.svg","description":"Luxembourg-based specialist infrastructure for adult platforms.","slogan":"Already behind the adult internet.","areaServed":"Worldwide","knowsAbout":["Adult video CDN","Porn tube site infrastructure","Adult live-cam streaming","Creator subscription platforms","Byte-range video caching","Origin shielding","Player quality of experience","DDoS protection","GPU infrastructure","Adult-capable AI inference"],"location":{"@type":"Place","name":"Luxembourg","address":{"@type":"PostalAddress","addressCountry":"LU"}},"contactPoint":{"@type":"ContactPoint","contactType":"sales","url":"https://adultinfra.com/contact/"}},{"@type":"WebPage","@id":"https://adultinfra.com/docs/video/origin-protection-for-video/#webpage","url":"https://adultinfra.com/docs/video/origin-protection-for-video/","name":"Origin protection for video","description":"How to keep adult video origins private and unbypassable: signed playback, hotlink and leech prevention, stopping range-based egress theft, cache-key hygiene, and takedown purges.","isPartOf":{"@id":"https://adultinfra.com/#website"},"about":{"@id":"https://adultinfra.com/#organization"},"primaryImageOfPage":{"@type":"ImageObject","url":"https://adultinfra.com/og-default.png"},"inLanguage":"en","mainEntity":{"@id":"https://adultinfra.com/docs/video/origin-protection-for-video/#article"},"dateModified":"2026-09-13"},{"@type":"WebSite","@id":"https://adultinfra.com/#website","url":"https://adultinfra.com","name":"AdultInfra","description":"Luxembourg-based specialist infrastructure for adult platforms.","publisher":{"@id":"https://adultinfra.com/#organization"},"inLanguage":"en","potentialAction":{"@type":"ContactAction","target":"https://adultinfra.com/contact/"}}]}
```