# Connect Wasabi to WordPress

To offload WordPress media to Wasabi, install Offloft, create a bucket and a user that can reach only that bucket, then set up public access or a domain through Cloudflare. Wasabi restricts public files on newer accounts, so check that step first. Offloft tests everything before serving.

## 1. Create the bucket

In the Wasabi console, go to **Buckets** and select **Create Bucket**.

**Name:** lowercase letters, numbers and hyphens. If you plan to serve files through Cloudflare (see the domain step), the bucket name must be exactly your media domain, for example media.yoursite.com.

**Region:** pick the one closest to most of your visitors and enter the same region in Offloft.

Bucket name:

```
my-site-media
```

## 2. Create a user with access to this bucket only

Go to **Policies > Create Policy**, paste the policy below and save it, for example as offloft-my-site-media. It allows exactly what Offloft does, on "my-site-media" only.

Go to **Users > Create User**, tick **Programmatic (create API key)**, and attach the policy you just made.

Copy the **Access Key** and **Secret Key** into Offloft, or download them as a CSV file. *Wasabi shows the secret only once.*

Policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "OffloftListBucket",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my-site-media"]
    },
    {
      "Sid": "OffloftManageFiles",
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": ["arn:aws:s3:::my-site-media/*"]
    }
  ]
}
```

## 3. Let visitors read the files

Wasabi restricts public files. Only paid accounts created before March 13, 2023 can switch it on themselves: open the bucket, go to **Settings > Public Access Override** and select **Enable Public Access**. Then add the bucket policy below under **Settings > Policies**.

Accounts created on or after March 13, 2023 (and trial accounts) cannot make files public in the console. Ask Wasabi Support (support@wasabi.com) to enable public access for the bucket, or serve files through Cloudflare as described in the next step.

Bucket policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::my-site-media/*"]
    }
  ]
}
```

## 4. Serve files from your own domain through Cloudflare (optional)

This needs the bucket to be named exactly like the domain, for example media.yoursite.com.

In Cloudflare DNS, add a CNAME record for the domain pointing to your bucket's region host, s3.your-region.wasabisys.com, with the proxy (orange cloud) on.

In Offloft, use https://media.yoursite.com as the delivery address.

CNAME target:

```
s3.your-region.wasabisys.com
```

Delivery address:

```
https://media.yoursite.com
```

## 5. Allow your site to read files (CORS) (optional)

This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

Wasabi sets CORS through its S3 API. With the AWS CLI configured for this user, run the command below.

AWS CLI command:

```
aws s3api put-bucket-cors --bucket my-site-media --endpoint-url https://your-endpoint --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://yoursite.com"],"AllowedMethods":["GET","HEAD"],"AllowedHeaders":["*"],"MaxAgeSeconds":3600}]}'
```

## Permissions Offloft needs

A policy that allows s3:ListBucket on the bucket, and s3:PutObject, s3:GetObject, s3:DeleteObject and s3:AbortMultipartUpload on its files. The exact policy is in step 2.

## Serving your files

Wasabi restricts public files, and the guide's public access step explains who can switch them on. If you plan to serve through Cloudflare, the bucket name must be exactly your media domain, so decide that before you create it.

## Questions

### Why doesn't my bucket allow public files?

Wasabi restricts them. Only paid accounts created before March 13, 2023 can switch public access on themselves. The guide covers the options.

### Does my bucket name matter?

Yes, if you plan to serve files through Cloudflare. The bucket name must then be exactly your media domain.

### Which region should I pick?

The one closest to most of your visitors. Enter the same region in Offloft.

Source: https://www.offloft.com/setup/wasabi