# Connect any S3-compatible storage to WordPress

To offload WordPress media to any S3-compatible storage, install Offloft, create a bucket and an access key for it, then enter your provider's endpoint in Offloft. Offloft runs a real connection test and a public delivery check, so you find out right away whether your provider works.

## 1. Create the bucket

In your provider's console, create a bucket for this site. Use lowercase letters, numbers and hyphens; avoid periods, which break secure (https) addresses.

Note the S3 endpoint your provider gives for the bucket's region (for example https://s3.example.com) and enter it in Offloft.

If the provider's documentation says to use path-style addresses, turn that option on in Offloft.

Bucket name:

```
my-site-media
```

## 2. Create an access key for this bucket

Create an access key that can list "my-site-media" and read, write and delete files in it, and nothing else.

If your provider accepts IAM-style policies, the policy below allows exactly what Offloft does.

Copy the access key and the secret key into Offloft. *Most providers show the secret only once.*

Policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "OffloftListBucket",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my-site-media"]
    },
    {
      "Sid": "OffloftManageFiles",
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": ["arn:aws:s3:::my-site-media/*"]
    }
  ]
}
```

## 3. Let visitors read the files

Visitors must be able to open each file. Offloft marks every file it uploads as public when the provider supports that; the delivery check tells you whether it worked.

If it did not, make the bucket readable with the bucket policy below, or with the provider's own "public bucket" setting. *Never allow public listing or writing.*

Bucket policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::my-site-media/*"]
    }
  ]
}
```

## 4. Choose the address visitors use

Enter the https address where a visitor's browser can open the files in the bucket. Your provider documents it, often as a public or CDN address.

To use your own domain, follow the provider's custom domain guide, point media.yoursite.com at it with a CNAME record, and use https://media.yoursite.com as the delivery address.

Delivery address:

```
https://media.yoursite.com
```

## 5. Allow your site to read files (CORS) (optional)

This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

If your provider has no CORS screen, run the command below with the AWS CLI configured for this key.

AWS CLI command:

```
aws s3api put-bucket-cors --bucket my-site-media --endpoint-url https://your-endpoint --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://yoursite.com"],"AllowedMethods":["GET","HEAD"],"AllowedHeaders":["*"],"MaxAgeSeconds":3600}]}'
```

## Permissions Offloft needs

An access key that can list this bucket and read, write and delete files in it, and nothing else. If your provider accepts IAM-style policies, the guide has the exact policy.

## Serving your files

Enter the https address where a visitor's browser can open files in the bucket. Your provider documents it, often as a public or CDN address. Offloft marks every file it uploads as public when the provider supports that, and the delivery check tells you whether it worked.

## Questions

### How do I know if my provider works with Offloft?

Run the connection test. It uses your real bucket: it checks your credentials, finds the bucket, uploads a test file, reads it back and deletes it.

### What are path-style addresses?

A way of writing storage addresses with the bucket name in the path. If your provider's documentation says to use them, turn that option on in Offloft.

### Should bucket names have periods?

No. Periods break secure (https) addresses. Use lowercase letters, numbers and hyphens.

Source: https://www.offloft.com/setup/s3-compatible