Wolvy Video

Description

Wolvy hosts, encodes and DRM-protects your video. This plugin puts it on your WordPress site.

Once you have added your signing secret, every player it renders for a signed-in viewer carries a signed viewer token: an identifier for the person watching, signed with your Wolvy account’s secret so the viewer cannot edit it and watch as somebody else. Wolvy records that verified identifier against each playback session, which is what lets a copy found elsewhere be traced back to the account it came from.

You need a Wolvy account to use this plugin. It is a client for that service, not a standalone video host.

What it does

• Block, shortcode, Elementor widget and template tag — insert a video however you build pages.
• Library browser — search your Wolvy library, filter by folder and status, copy a shortcode, without leaving wp-admin.
• Signed playback — viewer tokens are generated on your server with your account’s signing secret. Signing itself never contacts Wolvy.
• Analytics — views, watch time, countries and per-video figures, plus recent viewer sessions resolved back to WordPress accounts.
• Health checks — a domain allowlist, a referrer policy, a rotated secret and page caching all break playback silently. This screen names the cause.
• Webhooks — optional. Wolvy tells the site when a video finishes encoding.

Who can watch

Anyone, by default. A signed-in visitor is identified by a signed token — once a signing secret is configured — so the on-screen watermark and your Wolvy session records name them; a visitor who is not signed in gets an unsigned embed, which Wolvy plays unless your account has watermark enforcement switched on.

If you want playback restricted, turn on Require visitors to sign in under Wolvy → Settings, and choose what everyone else sees. Developers can decide per video with the wolvy_can_view filter.

Privacy

Playing a video loads a player from Wolvy’s servers, so Wolvy receives your visitor’s IP address and user agent. When the viewer is signed in and a signing secret is configured, this site also sends Wolvy an identifier for them — by default a random code only your site can link back to a person, though you may configure it to be a username or email address instead. Visitors who are not signed in are not identified.

The plugin adds suggested text to Settings → Privacy, and registers the stored identifier with WordPress’s own personal-data export and erase tools.

External services

This plugin relies on the Wolvy video platform, a third-party service, and cannot work without it.

1. Wolvy Developer API — https://api.wolvy.net

Used in wp-admin only, and only when you have entered an API key. Called when you browse your video library, open the analytics or health screens, register a webhook, or verify your credentials.

Data sent: your API key, and the parameters of what you asked for — video identifiers, search terms, folder and status filters, date ranges. Requests carry a user-agent string containing your site’s address and its WordPress version. No visitor data is ever sent to this endpoint.

When: in wp-admin, whenever you load one of the plugin’s screens, open the Elementor panel, or press one of its buttons. On the front end, the plugin also looks up a video’s title and poster image the first time that video is rendered — the title becomes the player’s accessible name, and the poster is used in click-to-play mode. That lookup is cached (10 minutes by default), so it happens at most once per video per cache period, and it contains no information about the visitor.

2. Wolvy player embed — https://embed.wolvy.stream

The video player itself, loaded in an iframe on any page where you have placed a video.

Data sent: the visitor’s browser connects to Wolvy directly, so Wolvy receives their IP address, user agent and referring page, as any embedded media provider would. The embed URL also carries your Wolvy account number, the video identifier, and a signed identifier for the signed-in viewer (see Privacy above). Wolvy uses these to record a viewing session and, if you have enabled it, to draw a watermark.

When: whenever a visitor loads a page containing a video. In click-to-play mode, only once they click.

3. Wolvy CDN — https://*.wolvy-cdn.net

Video segments — and the poster images shown in click-to-play mode, in the WordPress admin library and in the block picker — are fetched from Wolvy’s CDN by the browser. Same data as above, by virtue of the connection.

If you enable webhooks under Wolvy → Settings, the plugin sends Wolvy this site’s REST endpoint address, and Wolvy then posts signed event notifications (video.ready, video.failed, video.deleted, caption.ready) back to it. Remove the endpoint on the same screen to stop them.

Wolvy’s terms of service: https://wolvy.net/legal/terms
Wolvy’s privacy policy: https://wolvy.net/legal/privacy

The plugin also makes one request to your own site’s home page on the Health screen, to read its Referrer-Policy header. Nothing leaves your server in that request.

define( 'WOLVY_API_KEY', 'wv_live_…' );
define( 'WOLVY_VIEWER_SIGN_SECRET', '…' );