Release notes / MediaShield
Free Plugin Plugin

MediaShield

You sell course videos, then watch them get downloaded and reshared for free. MediaShield burns the viewer name and IP onto every frame, blocks right-click and devtools, caps concurrent streams, and tracks who watched. Works with self-hosted, YouTube, Vimeo, Bunny, and Wistia.

3 releases
v1.2.0 latest
July 24, 2026 shipped

v1.2.0 Latest

July 24, 2026
New 1 Improve 9 Fix 6 Dev 2

New

  • Self-hosted videos are matched to their MediaShield entry by source URL, so automatic detection protects them instead of skipping them.

Improve

  • Ad rotation for in-video breaks is decided by WB Ad Manager instead of MediaShield, so the site's configured rotation model applies to video ads the same way it applies to banners.
  • Removed the Pro email gate coupling. The gate itself is gone from MediaShield Pro 1.2.0; the generic access-type extension point it used remains for other integrations.
  • Removed the Max Upload Size setting. WordPress already enforces the server upload limit before MediaShield sees the file, so the setting could only ever restrict uploads further, never allow more. Uploads now use whatever the site accepts, with no configuration.
  • An upload that exceeds the server limit now names the actual limit instead of reporting a size nobody configured.
  • A shortcode or block pointing at a missing, unpublished, or sourceless video now explains itself to anyone who can edit content, instead of rendering blank space. Visitors still see nothing.
  • Corrected the setup wizard, which said embeds pasted into a post are protected automatically. Only videos added to MediaShield are protected.
  • Removed the Custom URL Patterns setting. It asked for a regular expression, silently ignored any pattern containing a slash, and could not match a video in the first place.
  • The watermark Position Swap Interval no longer offers "0 = static", which was never honoured and produced a watermark that moved every second. The field now explains what the interval is for.
  • The Upload and Storage settings card is hidden when no cloud platform is connected, instead of rendering empty, and no longer claims that connecting a platform stops files being stored locally.

Fix

  • In-video ads no longer play past their Total Impressions limit. The break plan is now filled by WB Ad Manager, and the player checks with it immediately before each break, so a creative that runs out mid-video stops there instead of at the next page load.
  • In-video ads now count toward a visitor's per-ad Session Limit. That limit previously had no effect on this surface at any value.
  • Videos that MediaShield does not manage are no longer wrapped in the protection player. Regular YouTube, Vimeo, Bunny and Wistia embeds now pass through untouched instead of receiving a watermark and protection overlay.
  • Plain self-hosted video tags no longer lose their source and stop playing on pages where MediaShield is active.
  • Turning off Enable MediaShield now renders videos unprotected instead of an empty player. Shortcodes, blocks and playlists all play normally with protection off.
  • Self-hosted uploads no longer fail on a default install. The Max Upload Size setting was measured in megabytes everywhere except the check that enforced it, so a default install advertised a 500 MB limit and rejected anything over 500 bytes.

Dev

  • Added the mediashield_unprotected_player_html filter for the markup used while MediaShield is switched off.
  • Removed the unused data-ms-untracked attribute, which was written but never read.

v1.1.0

June 3, 2026
New 3 Improve 6 Fix 12 Dev 6

New

  • Search and filter the Videos admin list by title.
  • Complete customer and developer documentation set covering getting started, configuration, everyday use, and the developer guide.
  • Player container honors a data-access-type attribute so extensions can declare alternative gate flows, which powers the Pro email gate.

Improve

  • Login overlay aria-label now reads the configured Login Overlay Text so screen readers announce the visible message.
  • Migrated all admin SPA, block, and meta-box icons from Dashicons to inline Lucide SVGs.
  • Videos admin table is responsive at 782px and below so action buttons no longer clip.
  • Copy-shortcode and sticky-player close buttons now meet the 40px tap-target minimum.
  • Duration field has an honest "leave 0 if unknown" label with server-side validation.
  • Admin success and error toasts render above the WordPress admin bar instead of behind it.

Fix

  • Unknown-platform embed URLs now route through an iframe adapter instead of rendering a broken video element.
  • Per-video email gate now works end to end for anonymous visitors: the toggle saves, the gate fires, captures the email, sets the cookie, and unlocks playback.
  • Resume Playback per-video override is now honored on the frontend.
  • "Last Active" and "Reached At" relative times use UTC consistently so they no longer drift with the site timezone.
  • Protection Level tiers behave distinctly again: basic skips session, watermark, and tracker, while strict forces devtools detection and source hiding.
  • Recent Milestones no longer renders the username and video title as one concatenated string.
  • Thumbnail sideload now handles extensionless CDN URLs from Vimeo, Wistia, and self-hosted sources.
  • Creating a video through the REST API now attaches the platform thumbnail on the first save instead of the second.
  • Thumbnail attachment now surfaces a WP_Error on failure instead of silently continuing.
  • Permanent video delete drops orphan tag rows and purges per-user milestone-tag meta for the deleted video.
  • Trashed videos are excluded from Top Videos, Milestones, and User Detail analytics.
  • The dashboard period selector now also filters the Recent Milestones panel.

Dev

  • New filters mediashield_player_access_type and mediashield_session_allow_anonymous_start, plus new hooks for frontend config, empty-referer policy, privacy erase, and the upload lifecycle.
  • The mediashield:access-denied DOM event is now cancelable so listeners can suppress the default overlay and render their own gate.
  • Registered _ms_milestone_tags in the REST schema so the admin SPA can save milestone-tag configuration.
  • Cleared all PHPStan level 5 errors and reduced WPCS to zero errors; the bundled EDD licensing SDK is excluded from linting.
  • Bundled the Action Scheduler and symfony/yaml runtime dependencies so a fresh clone activates without composer install.
  • Added three critical regression journeys for playlist rendering, video-delete cascade, and GDPR export and erase.

v1.0.0

Note 20

Note

  • Initial release.
  • Video and Playlist custom post types with REST API support.
  • Dynamic watermark overlay with configurable opacity, color, and swap interval.
  • based watch session tracking with concurrent stream limits.
  • down.
  • Milestone tracking at 25%, 50%, 75%, and 100% completion.
  • platform video detection (YouTube, Vimeo, Bunny Stream, Wistia, self-hosted).
  • download protection (right-click blocking, devtools detection, source hiding).
  • speed, keyboard shortcuts, sticky player, end screen CTA.
  • Gutenberg blocks for Video, Playlist, and My Videos.
  • `[mediashield]` and `[mediashield_my_videos]`.
  • hosted video upload with .htaccess protection and streaming proxy.
  • Tag management system for video organization.
  • Login overlay, domain restriction, and role-based access control.
  • time configuration.
  • GDPR personal data exporter and eraser.
  • based cron for session cleanup and archival.
  • Full REST API with 22 routes across 6 controllers.
  • Output buffer video detection for automatic embed wrapping.
  • 8 actions and 8 filters for developer integrations.