Connect any S3-compatible storage to WordPress

1. 1

   Create the bucket

   In your provider's console, create a bucket for this site. Use lowercase letters, numbers and hyphens; avoid periods, which break secure (https) addresses.

   Note the S3 endpoint your provider gives for the bucket's region (for example https://s3.example.com) and enter it in Offloft.

   If the provider's documentation says to use path-style addresses, turn that option on in Offloft.

   Bucket name

   my-site-media

   Copy

   S3-compatible storage's documentation

2. 2

   Create an access key for this bucket

   Create an access key that can list "my-site-media" and read, write and delete files in it, and nothing else.

   If your provider accepts IAM-style policies, the policy below allows exactly what Offloft does.

   Copy the access key and the secret key into Offloft. Most providers show the secret only once.

   Policy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "OffloftListBucket",
         "Effect": "Allow",
         "Action": ["s3:ListBucket"],
         "Resource": ["arn:aws:s3:::my-site-media"]
       },
       {
         "Sid": "OffloftManageFiles",
         "Effect": "Allow",
         "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
         "Resource": ["arn:aws:s3:::my-site-media/*"]
       }
     ]
   }

   Copy

   S3-compatible storage's documentation

3. 3

   Let visitors read the files

   Visitors must be able to open each file. Offloft marks every file it uploads as public when the provider supports that; the delivery check tells you whether it worked.

   If it did not, make the bucket readable with the bucket policy below, or with the provider's own "public bucket" setting. Never allow public listing or writing.

   Bucket policy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "PublicReadGetObject",
         "Effect": "Allow",
         "Principal": "*",
         "Action": ["s3:GetObject"],
         "Resource": ["arn:aws:s3:::my-site-media/*"]
       }
     ]
   }

   Copy

   S3-compatible storage's documentation

4. 4

   Choose the address visitors use

   Enter the https address where a visitor's browser can open the files in the bucket. Your provider documents it, often as a public or CDN address.

   To use your own domain, follow the provider's custom domain guide, point media.yoursite.com at it with a CNAME record, and use https://media.yoursite.com as the delivery address.

   Delivery address

   https://media.yoursite.com

   Copy

   S3-compatible storage's documentation

5. 5

   Allow your site to read files (CORS)Optional

   This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

   If your provider has no CORS screen, run the command below with the AWS CLI configured for this key.

   AWS CLI command

   aws s3api put-bucket-cors --bucket my-site-media --endpoint-url https://your-endpoint --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://yoursite.com"],"AllowedMethods":["GET","HEAD"],"AllowedHeaders":["*"],"MaxAgeSeconds":3600}]}'

   Copy

   S3-compatible storage's documentation

6. 6

   Run the connection test and the delivery check

   In Offloft, paste your values and run the connection test. It checks your credentials, finds the bucket, uploads a test file, reads it back and deletes it. The delivery check then loads a small test image from your public address. Offloft serves nothing from the cloud until both pass.

The steps above match the guide inside the plugin, checked against S3-compatible storage's documentation on 2026-10-26. Example values are shown here; the plugin fills in your own.