Forum Discussion
How do I stop Storyline output being accessed directly without logging into my LMS?
I'm publishing Storyline 360 content as HTML5 and embedding it into topic pages on a WordPress + LearnDash site (via a third-party WP embed plugin). The LearnDash pages themselves are correctly gated behind login/enrollment — but I've found that the published Storyline output itself sits at a static, predictable file path once uploaded, and can be opened directly with a plain URL, with no login required at all, completely bypassing the LMS.
Is there a standard/recommended way to publish or host Storyline output so it's only ever served to an authenticated, currently-enrolled learner.
Specifically interested in: Whether Storyline/Articulate 360 has a built-in output option for this (vs. plain "Web" publish)
Any guidance from others who've solved this would be much appreciated!
Thank you!
Alice
4 Replies
That doesn't seem very possible. An actual LMS (e. g. Moodle or Success Factors) doesn't have that predictable path.
Carl's right on the core point, and since you're asking for the standard approach, here's the why:
Published Storyline output is just a folder of static HTML/JS files. If those files sit at a public URL, anyone with the link can open the course directly — embedding it in an iframe on a restricted LearnDash topic page only protects the page, not the files themselves. And no, Storyline 360 has no built-in publish option for access control.
The fix is to move the protection up to the server level: keep the content folder outside the publicly browsable web root, or gate it with a WordPress plugin that only serves uploaded files to logged-in/enrolled users (the "prevent direct access" category — I haven't personally vetted a specific one, so test carefully). If the protection matters for compliance, the most robust route is importing the package into the LMS as SCORM instead of embedding raw files, so authentication is handled server-side.
One thing not to rely on: obscure file names or renaming story.html. That feels like security, but anyone who opens the page source finds the real URL in seconds.
Thanks both! This confirms what I'd found through testing (fresh, logged-out browser requests to the raw story.html path return the content directly, no auth check at all, exactly as you describe).
Going with the server-level fix: blocking direct access to the uploads folder and serving the content through an authenticated gateway that checks LearnDash enrollment before streaming the file. Good shout on not relying on obscure filenames - the real path is trivially visible in the page source regardless.
Will look into SCORM import as a longer-term option too, though re-publishing the whole content library is a bigger job than the server-level fix, so starting there. Appreciate the clear answer!
This is a well-known issue when hosting Articulate content on WordPress, as anyone with the direct URL to the story.html file can bypass your site's authentication. One effective solution is to use the GrassBlade xAPI Companion plugin, which includes content security features to ensure that only logged-in users can access the hosted modules.
