Forum Discussion
How do I stop Storyline output being accessed directly without logging into my LMS?
Carl's right on the core point, and since you're asking for the standard approach, here's the why:
Published Storyline output is just a folder of static HTML/JS files. If those files sit at a public URL, anyone with the link can open the course directly — embedding it in an iframe on a restricted LearnDash topic page only protects the page, not the files themselves. And no, Storyline 360 has no built-in publish option for access control.
The fix is to move the protection up to the server level: keep the content folder outside the publicly browsable web root, or gate it with a WordPress plugin that only serves uploaded files to logged-in/enrolled users (the "prevent direct access" category — I haven't personally vetted a specific one, so test carefully). If the protection matters for compliance, the most robust route is importing the package into the LMS as SCORM instead of embedding raw files, so authentication is handled server-side.
One thing not to rely on: obscure file names or renaming story.html. That feels like security, but anyone who opens the page source finds the real URL in seconds.
Thanks both! This confirms what I'd found through testing (fresh, logged-out browser requests to the raw story.html path return the content directly, no auth check at all, exactly as you describe).
Going with the server-level fix: blocking direct access to the uploads folder and serving the content through an authenticated gateway that checks LearnDash enrollment before streaming the file. Good shout on not relying on obscure filenames - the real path is trivially visible in the page source regardless.
Will look into SCORM import as a longer-term option too, though re-publishing the whole content library is a bigger job than the server-level fix, so starting there. Appreciate the clear answer!