Your HTML5 or WebGL game is on someone else's website. What to do about it.
You search your game's name and find it on a site you have never heard of. It plays. Your title screen is there, but your name is not, and there are ads above, below and sometimes in the middle of it. Then you find a second site, and a tenth.
A game we shipped was taken apart, rebuilt and sold by someone else, so we know the jolt of seeing your work under another roof. Web games get this more than any other kind, because a web build is a folder of files a browser already knows how to run. It happens to jam games, to free browser games, and to the web demo of a paid game that was meant to send players to its store page. This page covers how to tell what kind of copy you are looking at, who can stop each kind, what the law says about embedding, how to word notices, and what to change before the next build. It is not legal advice, and the places where a lawyer is worth paying are marked.
The short answer
- Find out where the game files load from. If the game still loads from your host, such as itch.io or your own domain, the site is embedding it. If it loads from their domain, they copied the files.
- An embed is fixed at your host. On itch.io, report it to support and delete old builds; itch says deleted files leave its delivery network generally within a day or so. On your own server, a frame-ancestors rule tells browsers which pages may embed it.
- A copy is removed through its hosting company. Write once to the site, then send a copyright notice to whoever hosts it. If it is on GitHub Pages, use GitHub's copyright form and list every repository and fork.
- Then cut off the money and the search traffic. Google's ad network takes copyright notices about the sites that show its ads, and a removal from Google Search stops new players finding the copy.
- Make the next build show players the way home. A domain check that shows a link to your real page, instead of a blank screen, turns each copy into an advertisement for you.
1. Work out what kind of copy it is
Save the evidence first: the full address of every page, a dated screenshot of each, and a note of which version of your game it runs. Then open the page and find out where the game itself comes from. Your browser's developer tools show the address of each frame and file the page loads; you are looking at your own game, so this is reading, not breaking anything. Most cases fall into one of four kinds.
| What you see | What it means | Who can stop it |
|---|---|---|
| The game frame loads from itch.io, your domain or another host you chose | An embed, sometimes called hotlinking. They copied nothing; your host is serving the game to their visitors. | Your host, and you. See section 2. |
| The game files load from their domain or a storage service they use | A copy. They downloaded your build and put it on their own server. | Their hosting company, their ad network, search engines. See section 4. |
| The game is on a large portal, uploaded under an account that is not yours | An unauthorized upload to a legitimate service. | The portal itself. See section 5. |
| The game is on many small sites at once, all with the same wrapper | Possibly a distribution deal you or a partner signed, which places games on a network of partner sites. | Check your agreements first. See below. |
The last row matters. Some web distributors pay developers a share of ad revenue in exchange for placing their games on many partner sites at once; one such offer to developers promised "2000+ publishers". If you, a co-developer or a former publisher ever signed one, the copies may be licensed. Read your agreements and ask your partners before sending a single notice. A notice sent about a licensed copy is a sworn statement you cannot stand behind, which the first page on writing a takedown notice explains.
Also note whether the site removed your name, credits or links, whether it shows ads, and whether it asks players for money. Those facts decide how much time this deserves and they belong in every notice.
2. If it is an embed, fix it at the host
An embed is the easier case, because the game is still on a server you control or rent. The site is borrowing it.
On itch.io. Itch.io announced in November 2019 that it had added a sitelock to every HTML5 game on its servers: when a game from its delivery network is loaded from a page outside itch.io, it shows a warning and a link to the game's itch.io page instead. Its staff said then that this traffic shows up in your referrer analytics as an itch.io/embed-hotlink/ address. If you find an embed that still plays, email support with the addresses; itch.io's admin has asked developers to send offending sites to support. When you upload a new build, the old build's files can stay reachable for a while. Itch.io said deleted files are purged from its delivery network generally within a day or so, and that support can purge a particular file immediately on request. If you want to place your own game on another site, itch.io asks you to use the embed tool on your dashboard, not the direct file address.
On your own server. A web page can tell browsers which other pages are allowed to frame it. The Content-Security-Policy frame-ancestors directive names the parents that may embed a page with a frame, iframe, object or embed element; setting it to 'none' refuses all of them. List every address that should be allowed: your own site, and every portal you have an agreement with. A rule like this stops a page from framing your game. It does nothing about someone who downloads the files and puts them on their own server, which is the next section's problem.
The other host's problem. If you placed the game on a portal and a third site is embedding the portal's copy, tell the portal. It is their bandwidth and their players being borrowed, and they have more reason than anyone to act.
3. What the law says about embedding
Developers often ask whether embedding a game from someone else's server is infringement at all. The honest answer is that it depends on where you are, and that the cases so far are about photos and video, not games.
- In the U.S. Ninth Circuit, which covers California and much of the West, the court of appeals held in Hunley v. Instagram (2023) that sites embedding photos and videos stored on Instagram's servers did not display a copy of them, applying what it calls the Server Test from a 2007 case against Amazon. The same opinion notes that several district courts in New York and Texas have rejected or limited that test, including in a case over an embedded tweet.
- In the European Union, the Court of Justice held in VG Bild-Kunst (2021) that framing a work which is freely available on another site is a communication to the public, needing the owner's consent, where the framing circumvents measures the owner adopted to protect against framing. The court added that an owner can only limit consent this way through effective technological measures, not by other means (paragraph 46).
Our reading, for what it is worth: an anti-framing measure on your build does two jobs. It stops most embeds outright, and in the EU it can change the legal position of a site that works around it. How either rule applies to an embedded game, as opposed to a photo, has not been tested in the cases above. If an embedding site is making real money from your game and will not stop, that is a question for a lawyer in the country where the site operates.
In practice the question rarely needs answering. Stopping the embed at your host is faster and cheaper than any argument about whether it was lawful.
4. If they copied the files: site, host, ad network, search
A copied build lives on their server, so the people who can remove it are the site, the company that hosts it, and to a lesser extent the companies that pay for it and send it visitors.
Write to the site once. Many game portals are run by one or two people who took games from elsewhere without much thought. When the makers of one browser game had copies removed from GitHub Pages in 2024, one portal owner told TorrentFreak that they had removed everything related to it and apologized. Others never answer: one developer whose game appeared on dozens of sites wrote to them and only one replied. A short, polite message with your original page, the copy's address and a date costs you five minutes. If it gets no answer, move on.
Send a notice to the host. The earlier page on finding who hosts a site covers looking up the hosting company, the domain registrar, and what to do when a site sits behind Cloudflare. The notice itself has the same six elements as any copyright notice, set out in the first page in this journal. For a web game, include three addresses for each copy: the page that shows it, the address the game files load from, and your own original page. Add the date you first released the game, and a screenshot of your title screen or credits next to theirs.
If it is on GitHub Pages. Many game portals are built as GitHub repositories and published through GitHub Pages, and the address usually ends in github.io. GitHub's guide asks for complaints "as specific as possible": say whether the whole repository infringes or list the files, and list every fork separately, because GitHub treats each fork as its own repository. GitHub's guide says plain-text email to its copyright address gets a much faster answer than a PDF or a letter. These notices are published: GitHub posts each one to its public notice archive, which is also a good place to read real examples. The web game portal Poki has filed 60 notices there between September 2024 and October 2026; this one, from March 2026, covers copies of HTML5 games it licenses.
A note on circumvention claims. If the copy removed a domain check or other lock from your game, it is tempting to claim that too. U.S. law separately prohibits circumventing a technological measure that controls access to a copyrighted work, and GitHub's guide asks for detailed statements of what the measure is, how it controls access, and how the accused project gets around it. In the Poki notice and the 2024 YoHoHo notice, GitHub wrote that it did not find enough information for a valid anti-circumvention claim, and removed the games on the ordinary copyright claim instead. Build your notice on the copying, which you can show. Talk to a lawyer before leaning on circumvention.
Then the ad network. Sites like these exist for ad revenue. Google's publisher policies say it does not allow content that infringes copyright on sites that show its ads, and its ad network has its own copyright notice process, and Google says its response can include disabling access to the material and terminating accounts. If you can tell which network serves the ads, a notice there removes the reason the copy exists, even when the host ignores you. If the ads come from a smaller network, look for its publisher policy or abuse address.
Then search. A copy that ranks for your game's name takes players who were looking for you. Removing it from Google results works the same way as for any pirate page, covered in the search section of the pirate-site page.
5. If it was uploaded to a real portal
Sometimes the copy is not on a scraper site but on a large, legitimate portal, uploaded by a stranger who claims it as theirs. That is usually the quickest case to resolve, because the portal has terms that require uploaders to own what they upload. CrazyGames, for example, tells developers it accepts games already published elsewhere "as long as you hold the distribution rights". Write to the portal through its developer contact or legal address, with your original page, your release date, and anything that shows the build is yours: source files, earlier builds, your name in the credits. If the uploader earned a revenue share, say so; the portal may be able to stop the payments.
If the portal is one you would actually like to be on, you can ask in the same message whether it will take the game from you instead. Several large portals publish their own requirements for developers, and a copy that was already popular there is evidence the game fits.
If someone uploaded your game to itch.io under their own account, itch.io's terms describe the notice it needs. The same six elements apply.
6. Decide how much this deserves
One developer described the real cost well on itch.io's forum: the copies did not bother them much, but "my connection with the player is cut". A player who loves your game on a copy cannot find your next one, your store page or the place to report a bug.
So sort the copies by what they take from you. Our suggestion: three kinds are worth a notice every time: a copy that ranks above your page when someone searches your game's name, a copy that removed your name or claims someone else made it, and a copy that charges players or sells anything. A small site with no traffic that kept your credits is near the bottom of the list. The earlier page on how much time a pirate copy deserves goes through the same trade-off in more detail.
7. Before the next build goes up
Nothing stops a determined person from copying files a browser has to download to run. The aim is to make the casual copy stop working, to make every surviving copy point back to you, and to have your proof ready.
- Put your name and your link inside the game. A title screen with your name and your page address travels with every copy and is the cheapest protection there is.
- Check where the game is running, and fail kindly. A sitelock is a check, inside the game, that the page it runs on belongs to a list of domains you approve. When the check fails, show a message and a link to your real page rather than a blank screen. That is what itch.io chose for its own sitelock, and it turns each copy into a signpost.
- List every legitimate place. Your allowlist has to include every address a real player might load the game from. Itch.io asked developers who write their own lock to also allow its *.itch.zone domain. CrazyGames' sitelock guide lists the origins its iOS and Android apps use, which are not ordinary web addresses. Miss one and you break the game for the players you want.
- Do not expect a lock to hold. In its own notice to GitHub, Poki wrote that its experiments with site-locking and obfuscation "only hurt legitimate players" without stopping people who copy games. Treat a lock as a speed bump and a legal signal, not a wall.
- Serve the build with an embedding rule. If you host it yourself, set frame-ancestors as in section 2, listing your own site and your partners.
- Keep dated proof. Keep every released build, its release date and its store or portal page. If the game matters commercially, registering it with the U.S. Copyright Office keeps statutory damages and fees available against copies that start after registration.
- Think about what the web build is for. If it is a demo for a paid game, the demo's job is to send players to the store. A demo that ends on a clear link to the store page keeps doing that job even on a site you never approved.
8. When it is more than a copy on a website
Web copies sometimes become something worse. If the copy is being sold, see what to do when someone is selling your game. If it has been wrapped as a phone app, see copies on Google Play and the App Store. If someone rebuilt it rather than copying it, see what to do about a clone. If the site is abroad and nobody answers, see a game copied in another country.
Common questions
Someone put my HTML5 game on their website. Is that illegal?
If they copied your files onto their own server without permission, it is generally copyright infringement in the U.S. and the EU, and hosting companies act on notices about it. If they only embed it from your host, the answer depends on the country; stopping it at your host is usually faster than finding out.
How do I know if a site copied my game or is just embedding it?
Look at where the game's files load from. If the game frame loads from itch.io, your domain or another host you chose, it is an embed. If the files come from their domain, they copied it.
Does itch.io stop other websites from embedding my game?
Itch.io added a sitelock to HTML5 games on its servers in November 2019. When the game is loaded from outside itch.io, it shows a link to your itch.io page. If an embed still plays, report it to itch.io support and delete old builds.
Can I stop people downloading my web game and hosting it themselves?
Not completely. A browser has to download the files to run them. A domain check that shows a link to your real page, your name inside the game, and fast notices to hosts and ad networks keep most copies from doing much harm.
The copy is on GitHub Pages. Where do I report it?
Use GitHub's copyright claims form or its copyright email address. List each repository and each fork separately, and expect your notice to be published in GitHub's public archive.
Should I claim the site circumvented my sitelock?
Base the notice on the copying. GitHub has declined anti-circumvention claims about web game copies for lack of detail and removed them on ordinary copyright grounds. Ask a lawyer before making a circumvention claim.
Do I need a lawyer?
Not to report copies to hosts, ad networks, portals or search engines. For a site that makes real money from your game and ignores notices, or for any claim about circumvention or embedding, a lawyer is worth it.
This page describes itch.io's terms; two itch.io forum threads in which its staff described CDN purges, hotlink protection and the *.itch.zone domain (2019); itch.io's sitelock announcement of 23 November 2019; MDN's frame-ancestors reference; CrazyGames' sitelock guide and developer FAQ; GitHub's DMCA takedown policy and its guide to submitting a notice; GitHub's public notice archive, where the count of 60 notices from Poki covers files dated 23 September 2024 to 14 October 2026; Google's AdSense copyright page and publisher policies; section 1201 of title 17; the Ninth Circuit's opinion in Hunley v. Instagram (17 July 2023); and the Court of Justice's judgment in VG Bild-Kunst, C-392/19 (9 March 2021), all as read on 20 October 2026. The YoHoHo account is TorrentFreak's report of 10 July 2024. The remark about distribution deals, the triage in section 6, the reading of the embedding cases in section 3 and the advice in section 7 are our own and are marked as such. It is general information, not legal advice about your situation.