Connect Backblaze B2 to WordPress
To offload WordPress media to Backblaze B2, install Offloft, create a public bucket and an application key for that bucket, then copy the endpoint and keys into Offloft. The master key does not work with the S3 API. Offloft tests the connection and delivery before serving anything.
What you'll need
- A Backblaze account
- A WordPress admin login
- Offloft installed (WordPress 6.5 or later and PHP 8.1 or later with the cURL extension)
- 1
Create the bucket
Sign in to Backblaze, go to B2 Cloud Storage > Buckets and select Create a Bucket.
Name: unique across all of Backblaze, at least 6 characters, letters, numbers and hyphens.
Files in Bucket: choose Public so visitors can see your images (see the next steps).
After creating it, copy the Endpoint shown on the bucket (s3.<region>.backblazeb2.com). The part between "s3." and ".backblazeb2.com" is the region to enter in Offloft.
Bucket namemy-site-media
- 2
Create an application key for this bucket
Go to Application Keys and select Add a New Application Key. The master application key does not work with the S3 API, so a new key is needed.
Allow access to Bucket(s): choose "my-site-media". Type of Access: choose Read and Write.
Select Create New Key. In Offloft, the keyID is the Access Key ID and the applicationKey is the Secret Access Key. Backblaze shows the applicationKey only once.
- 3
Let visitors read the files
Backblaze makes files readable per bucket, not per file. Open Buckets, select Bucket Settings on "my-site-media" and set Files in Bucket to Public.
If Public is not offered, Backblaze first asks you to verify your email address and to have a payment history on the account.
- 4
Serve files from your own domain through CloudflareOptional
Find your bucket's download host: open any file in the bucket and look at its Friendly URL, for example https://f004.backblazeb2.com/file/my-site-media/….
In Cloudflare DNS, add a CNAME record for media.yoursite.com pointing to that host (f00x.backblazeb2.com), with the proxy (orange cloud) on. Set SSL/TLS to Full (strict).
Under Rules, create a URL Rewrite Rule: when the hostname equals media.yoursite.com, rewrite the path dynamically with the expression below, so visitors do not see /file/my-site-media in addresses.
In Offloft, use https://media.yoursite.com as the delivery address.
Rewrite expressionconcat("/file/my-site-media", http.request.uri.path)Delivery addresshttps://media.yoursite.com
- 5
Allow your site to read files (CORS)Optional
This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.
Open Bucket Settings on "my-site-media", go to CORS Rules, choose Share everything in this bucket with one origin, enter your site's address below and apply the rule to the S3 Compatible API.
Originhttps://yoursite.com
- 6
Run the connection test and the delivery check
In Offloft, paste your values and run the connection test. It checks your credentials, finds the bucket, uploads a test file, reads it back and deletes it. The delivery check then loads a small test image from your public address. Offloft serves nothing from the cloud until both pass.
Permissions Offloft needs
An application key limited to this bucket, with Read and Write access. The master application key does not work with the S3 API.
Serving your files
Backblaze makes files readable per bucket, so set Files in Bucket to Public. You can also serve files from your own domain through Cloudflare, which the guide covers. The delivery check loads a small test image from the address you enter.
If the test fails
Backblaze B2 questions
Why can't I use my master application key?
The master application key does not work with the S3 API. Create a new key limited to this bucket.
What if Public isn't offered for my bucket?
Backblaze first asks you to verify your email address and to have a payment history on the account.
Which values go where in Offloft?
The keyID is the Access Key ID, and the applicationKey is the Secret Access Key.
Ready to connect your bucket?
Install Offloft free. Nothing moves until the connection test passes.