# Connect DigitalOcean Spaces to WordPress

To offload WordPress media to DigitalOcean Spaces, install Offloft, create a Spaces bucket and a limited access key for it, then copy the key into Offloft. Offloft marks each file it uploads as public, so there is nothing to switch on. It tests delivery before serving.

## 1. Create the bucket

In the DigitalOcean control panel, go to **Spaces Object Storage** and select **Create Spaces Bucket**.

**Region:** pick the datacenter closest to most of your visitors and enter the same region (for example nyc3) in Offloft.

**Name:** lowercase letters, numbers and hyphens, unique within the region. Leave the **CDN** off for now.

Bucket name:

```
my-site-media
```

## 2. Create an access key for this bucket

Go to **Spaces Object Storage**, open the **Access Keys** tab and select **Create Access Key**.

Choose **Limited Access**, pick "my-site-media" and set its permission to **Read/Write/Delete**. **Full Access** also works, but reaches every bucket on your account.

Copy the **Access Key ID** and the **Secret Key** into Offloft. *DigitalOcean shows the secret only once.*

## 3. Let visitors read the files

Spaces keeps every file private unless the file itself is marked public. Offloft marks each file it uploads as public; the delivery check confirms it works. There is nothing to switch on.

Keep the bucket's **File Listing** setting on **Restricted**, so visitors can open a file but cannot list them all.

Files uploaded to the bucket by other tools stay private until you mark them public in the control panel.

## 4. Turn on the CDN and use your own domain (optional)

Open the bucket, go to **Settings > CDN**, select **Edit** and **Enable CDN**. Files are then also served from my-site-media.your-region.cdn.digitaloceanspaces.com.

To use media.yoursite.com instead, choose **Add a New Subdomain**. If your domain's DNS is managed by DigitalOcean, it can issue a free Let's Encrypt certificate; otherwise upload your own certificate.

In Offloft, use https://media.yoursite.com (or the CDN address) as the delivery address.

CDN address:

```
https://my-site-media.your-region.cdn.digitaloceanspaces.com
```

Delivery address:

```
https://media.yoursite.com
```

## 5. Allow your site to read files (CORS) (optional)

This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

Open the bucket, go to **Settings > CORS Configurations** and select **Add**. Enter your site's address below as the origin, allow **GET** and **HEAD**, and save.

Origin:

```
https://yoursite.com
```

## Permissions Offloft needs

A Limited Access key with Read/Write/Delete on this bucket. Full Access also works, but it reaches every bucket on your account.

## Serving your files

Spaces keeps every file private unless the file itself is marked public. Offloft marks each file it uploads as public, and the delivery check confirms it works. You can turn on the CDN, and use your own domain, in the bucket's settings.

## Questions

### Do I need to make the bucket public?

No. Offloft marks each file it uploads as public. Keep File Listing on Restricted, so visitors can open a file but can't list them all.

### What about files uploaded by other tools?

They stay private until you mark them public in the control panel.

### Should I turn on the CDN?

You can, in the bucket settings. Leave it off while you create the bucket, then follow the optional domain step.

Source: https://www.offloft.com/setup/digitalocean-spaces