Connect Cloudflare R2 to WordPress

1. 1

   Create the bucket

   In the Cloudflare dashboard, go to Storage & databases > R2 > Overview and select Create bucket.

   Name: lowercase letters, numbers and hyphens, 3 to 63 characters, not starting or ending with a hyphen.

   Location: leave it on Automatic, or pick the region closest to most of your visitors.

   Choose Specify jurisdiction only if your files must stay in the European Union, FedRAMP or United States jurisdiction. It cannot be changed later, and you must pick the same jurisdiction in Offloft.

   Bucket name

   my-site-media

   Copy

   Open Cloudflare R2's consoleCloudflare R2's documentation

2. 2

   Create an API token for Offloft

   On the R2 Overview page, under Account Details, select Manage next to API Tokens.

   Select Create Account API token. An account token keeps working if the person who made it leaves your Cloudflare account; a User API token does not.

   Permissions: choose Object Read & Write. Offloft never needs Admin permissions.

   Under Specify bucket(s), choose Apply to specific buckets only and pick "my-site-media", so the token cannot touch your other buckets.

   Select Create API Token. Copy the Access Key ID and the Secret Access Key into Offloft together with your account ID. Cloudflare shows the secret only once.

   Account ID

   your-account-id

   Copy

   S3 endpoint (Offloft fills this in for you)

   https://your-account-id.r2.cloudflarestorage.com

   Copy

   Open Cloudflare R2's consoleCloudflare R2's documentation

3. 3

   Connect your own domain

   R2 buckets are private until you connect a domain. Open the bucket, go to Settings > Custom Domains and select Add.

   Enter media.yoursite.com, select Continue, then Connect Domain. The domain must be a zone in this same Cloudflare account.

   Wait until the status changes from Initializing to Active, usually a few minutes.

   In Offloft, use https://media.yoursite.com as the delivery address.

   Domain

   media.yoursite.com

   Copy

   Delivery address

   https://media.yoursite.com

   Copy

   Open Cloudflare R2's consoleCloudflare R2's documentation

4. 4

   Or: turn on the r2.dev address for testingOptional

   Without a domain you can try things out with Cloudflare's r2.dev address. It is rate-limited and not cached, so do not use it for a live site.

   Open the bucket, go to Settings > Public Development URL and select Enable. Type "allow" to confirm.

   Copy the address it shows (https://pub-….r2.dev) into Offloft as the delivery address.

   Open Cloudflare R2's consoleCloudflare R2's documentation

5. 5

   Allow your site to read files (CORS)Optional

   This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

   Open the bucket, go to Settings > CORS Policy, select Add CORS policy, choose the JSON tab and paste the rule.

   CORS policy

   [
     {
       "AllowedOrigins": ["https://yoursite.com"],
       "AllowedMethods": ["GET", "HEAD"],
       "AllowedHeaders": ["*"],
       "MaxAgeSeconds": 3600
     }
   ]

   Copy

   Open Cloudflare R2's consoleCloudflare R2's documentation

6. 6

   Check Cloudflare rules on your domainOptional

   Your domain runs through Cloudflare, so its rules apply to your files too. If the delivery check says files come back changed or with the wrong type, look at the rules on the zone for media.yoursite.com:

   Rules > Overview (Transform Rules, Cache Rules, Redirect Rules), Workers routes, and Speed settings that rewrite content.

   A cache rule that caches everything on media.yoursite.com is fine and makes files faster.

   Open Cloudflare R2's consoleCloudflare R2's documentation

7. 7

   Run the connection test and the delivery check

   In Offloft, paste your values and run the connection test. It checks your credentials, finds the bucket, uploads a test file, reads it back and deletes it. The delivery check then loads a small test image from your public address. Offloft serves nothing from the cloud until both pass.

The steps above match the guide inside the plugin, checked against Cloudflare R2's documentation on 2026-10-26. Example values are shown here; the plugin fills in your own.