Connect Amazon S3 to WordPress

1. 1

   Create the bucket

   Open the S3 console, choose General purpose buckets and select Create bucket.

   Region: pick the one closest to most of your visitors and enter the same region in Offloft. It cannot be changed later.

   Name: 3 to 63 lowercase letters, numbers and hyphens. Avoid periods: they break secure (https) addresses.

   Leave Object Ownership on Bucket owner enforced and leave Block Public Access on for now; the public access step explains when to change it.

   Bucket name

   my-site-media

   Copy

   Open Amazon S3's consoleAmazon S3's documentation

2. 2

   Create a user with access to this bucket only

   In the IAM console, go to Policies > Create policy, choose JSON and paste the policy below. It allows exactly what Offloft does, on "my-site-media" only. Name it, for example, offloft-my-site-media.

   Go to Users > Create user. Give it a name, choose Attach policies directly, pick the policy you just made and create the user.

   Open the user, go to the Security credentials tab and select Create access key. Choose Other, then Next, then Create access key.

   Copy the Access key and the Secret access key into Offloft (select Show, or Download .csv file). AWS shows the secret only once.

   IAM policy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "OffloftListBucket",
         "Effect": "Allow",
         "Action": ["s3:ListBucket"],
         "Resource": ["arn:aws:s3:::my-site-media"]
       },
       {
         "Sid": "OffloftManageFiles",
         "Effect": "Allow",
         "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
         "Resource": ["arn:aws:s3:::my-site-media/*"]
       }
     ]
   }

   Copy

   Open Amazon S3's consoleAmazon S3's documentation

3. 3

   Let visitors read the files

   New buckets block all public access, so visitors cannot see your images yet. Make the files readable here.

   Open the bucket, go to Permissions > Block public access (bucket settings), select Edit, clear Block all public access and save. If it still fails, the same setting at account level (Block Public Access settings for this account) is on.

   Then, under Bucket policy, select Edit and paste the policy below. It lets anyone read a file whose address they know; nobody can list, change or delete files.

   Offloft does not need object ACLs; keep Bucket owner enforced.

   Bucket policy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "PublicReadGetObject",
         "Effect": "Allow",
         "Principal": "*",
         "Action": ["s3:GetObject"],
         "Resource": ["arn:aws:s3:::my-site-media/*"]
       }
     ]
   }

   Copy

   Open Amazon S3's consoleAmazon S3's documentation

4. 4

   Allow your site to read files (CORS)Optional

   This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

   Open the bucket, go to Permissions > Cross-origin resource sharing (CORS), select Edit and paste the rule.

   CORS configuration

   [
     {
       "AllowedOrigins": ["https://yoursite.com"],
       "AllowedMethods": ["GET", "HEAD"],
       "AllowedHeaders": ["*"],
       "MaxAgeSeconds": 3600
     }
   ]

   Copy

   Open Amazon S3's consoleAmazon S3's documentation

5. 5

   Run the connection test and the delivery check

   In Offloft, paste your values and run the connection test. It checks your credentials, finds the bucket, uploads a test file, reads it back and deletes it. The delivery check then loads a small test image from your public address. Offloft serves nothing from the cloud until both pass.

The steps above match the guide inside the plugin, checked against Amazon S3's documentation on 2026-10-26. Example values are shown here; the plugin fills in your own.