Connect MinIO to WordPress

1. 1

   Create the bucket

   With the MinIO client (mc), add an alias for your server once; mc asks for the admin access key and secret key. Then create the bucket.

   Bucket names: lowercase letters, numbers and hyphens, 3 to 63 characters.

   Add the alias

   mc alias set offloft https://your-endpoint

   Copy

   Create the bucket

   mc mb offloft/my-site-media

   Copy

   MinIO's documentation

2. 2

   Create a user with access to this bucket only

   Save the policy below as offloft-my-site-media.json. It allows exactly what Offloft does, on "my-site-media" only.

   Create the policy, create a user (choose a new access key and a long random secret key), and attach the policy to the user with the commands below.

   Enter that access key and secret key in Offloft, with your server's address as the endpoint. Never give Offloft the admin keys.

   Policy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "OffloftListBucket",
         "Effect": "Allow",
         "Action": ["s3:ListBucket"],
         "Resource": ["arn:aws:s3:::my-site-media"]
       },
       {
         "Sid": "OffloftManageFiles",
         "Effect": "Allow",
         "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
         "Resource": ["arn:aws:s3:::my-site-media/*"]
       }
     ]
   }

   Copy

   Create the policy

   mc admin policy create offloft offloft-my-site-media offloft-my-site-media.json

   Copy

   Create the user

   mc admin user add offloft NEW_ACCESS_KEY NEW_SECRET_KEY

   Copy

   Attach the policy

   mc admin policy attach offloft offloft-my-site-media --user NEW_ACCESS_KEY

   Copy

   MinIO's documentation

3. 3

   Let visitors read the files

   MinIO buckets are private. The command below lets anyone download a file whose address they know; it does not let them upload, change or delete anything.

   Run it once for "my-site-media".

   Allow downloads

   mc anonymous set download offloft/my-site-media

   Copy

   MinIO's documentation

4. 4

   Give the files a public https address

   Visitors need to reach the files over https. Put a reverse proxy such as nginx in front of MinIO on media.yoursite.com, with a certificate for that domain, passing requests to the MinIO server.

   With path-style addresses, files live at https://media.yoursite.com/my-site-media/…; use that as the delivery address in Offloft.

   Delivery address

   https://media.yoursite.com/my-site-media

   Copy

   MinIO's documentation

5. 5

   Allow your site to read files (CORS)Optional

   This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

   MinIO answers cross-origin requests from any site unless told otherwise. To allow only your site, set the environment variable below on the MinIO server and restart it.

   Server setting

   MINIO_API_CORS_ALLOW_ORIGIN=https://yoursite.com

   Copy

   MinIO's documentation

6. 6

   Run the connection test and the delivery check

   In Offloft, paste your values and run the connection test. It checks your credentials, finds the bucket, uploads a test file, reads it back and deletes it. The delivery check then loads a small test image from your public address. Offloft serves nothing from the cloud until both pass.

The steps above match the guide inside the plugin, checked against MinIO's documentation on 2026-10-26. Example values are shown here; the plugin fills in your own.