Referrer policy and Player embedding (Web)

Referrer Policy and Player Embedding

When embedding the Dailymotion player on your website, make sure your page sends a referrer to Dailymotion. Dailymotion uses the Referer header to verify that playback requests come from an authorized domain. If the referrer is missing, the player will block video playback.

Why this matters

Browsers send a Referer header with every request, but this behavior can be restricted by a Referrer-Policy set at the server or page level. If your site applies a policy that strips the referrer on cross-origin requests, playback will fail.

Policies to avoid

The following policies will prevent the referrer from reaching Dailymotion and must not be set on the embedding page:

Policy	Why it breaks the player
`no-referrer`	Never sends any referrer, to anyone
`same-origin`	Only sends the referrer to same-domain requests; strips it for all cross-origin requests including Dailymotion

How to fix it

There are two approaches. We recommend Option 1 as it is more targeted and does not affect the referrer policy for other third parties on your page.

Option 1 — Set the policy scoped to Dailymotion only (recommended)

Each embedding method exposes a referrerPolicy parameter that applies only to the Dailymotion player, leaving the rest of your page's referrer behavior unchanged.

Iframe

<iframe
  src="https://geo.dailymotion.com/player/{Player ID}.html?video=VIDEO_ID"
  referrerpolicy="strict-origin-when-cross-origin">
</iframe>

Player Embed Script (PES)

<script
  src="https://geo.dailymotion.com/player/{Player ID}.js"
  data-video="VIDEO_ID"
  referrerPolicy="strict-origin-when-cross-origin">
</script>

Player Library

<script src="https://geo.dailymotion.com/libs/player/{Player ID}.js"></script>
<div id="player-lib"></div>
<script>
  dailymotion.createPlayer('player-lib', {
    video: 'VIDEO_ID',
    referrerPolicy: 'strict-origin-when-cross-origin',
  });
</script>

Option 2 — Set the policy at the server or page level

If you prefer a global configuration, make sure your server sets a Referrer-Policy header that is compatible with cross-origin requests. The following values all work correctly with the Dailymotion player:

strict-origin-when-cross-origin (recommended — browser default since 2021)
strict-origin
origin
no-referrer-when-downgrade

Nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

Caddy

header Referrer-Policy "strict-origin-when-cross-origin"

If you cannot modify server headers, you can also set the policy at the page level by adding the following tag inside the <head> of your embedding page:

<meta name="referrer" content="strict-origin-when-cross-origin">

Note: If you are unsure what policy your server currently applies, you can inspect the response headers of your page using your browser's DevTools (Network tab) and look for the Referrer-Policy header.