Zloj S3 – Offload Media to Amazon S3 & S3-Compatible Storage

Zloj S3 moves your media library to cloud object storage. Store uploads in Amazon S3, Cloudflare R2, DigitalOcean Spaces, Wasabi, Backblaze B2, MinIO or any other S3-compatible service, serve them from your bucket or CDN domain, and free up disk space on your server. Features

• Automatic offload of new uploads and all image sizes
• Works with any S3-compatible storage, not only Amazon
• Serve media from a custom public host or CDN domain
• Bulk migration of existing uploads, with optional removal of local copies
• Objects removed from storage when attachments are deleted
• Lock credentials and settings with PHP constants
• One-click connection test
• Lightweight bundled AWS SDK (S3 client only)

Zloj S3 sends uploaded media to an S3-compatible bucket, rewrites attachment URLs, and removes objects when attachments are deleted. It is built for any S3-compatible endpoint (not only Amazon), can lock credentials with PHP constants, and can migrate existing uploads in AJAX batches with an optional cleanup of identical local copies. The plugin stays idle until the required settings are filled: API host, public host, bucket, access key, and secret key. You can lock any setting with a PHP constant. When a constant is defined it wins over the value on the settings screen, and that field becomes read-only. Access and secret keys are shown as asterisks in the admin, not as the real values. Constants

• ZLOJ_S3_ENABLED
• ZLOJ_S3_PRIVATE_UPLOAD
• ZLOJ_S3_TRASH (move the primary attachment to a trash prefix; default on)
• ZLOJ_S3_API_URL
• ZLOJ_S3_API_HTTPS (HTTPS for the API host; default on; ZLOJ_S3_HTTPS_URL is used if this is not defined)
• ZLOJ_S3_API_PATH_STYLE (set to path for path-style API URLs: host/bucket/key; default path)
• ZLOJ_S3_REGION (signing region; default us-east-1)
• ZLOJ_S3_PUBLIC_URL
• ZLOJ_S3_PUBLIC_HTTPS (HTTPS for public URLs; default on; ZLOJ_S3_HTTPS_URL is used if this is not defined)
• ZLOJ_S3_BUCKET
• ZLOJ_S3_ACCESS_KEY
• ZLOJ_S3_SECRET_KEY
• ZLOJ_S3_PUBLIC_PATH_STYLE (set to path for path-style public URLs: host/bucket/key)
• ZLOJ_S3_COMPAT_NO_CHECKSUM (skip CRC32 checksum headers)
• ZLOJ_S3_COMPAT_NO_TAGGING (do not send object tags)
• ZLOJ_S3_COMPAT_CANNED_ACL (send public-read / private ACL)
• ZLOJ_S3_COMPAT_NO_EXPECT (disable Expect: 100-continue)

AWS SDK If Aws\S3\S3Client is already loaded, that copy is used. Otherwise the plugin loads the trimmed AWS SDK bundled under vendor/ (S3 only, not the full 40+ MB package).

1.4.8

• New plugin name, description and tags for the plugin directory.

1.4.7

• Move the SDK trim script out of the plugin package into the separate builder repo.
• Drop vendor development files from the distribution, including format-check.py.

1.4.6

• Let WordPress.org load translations; do not ship locale files or call load_plugin_textdomain.
• Register settings with an explicit sanitize callback and check AJAX nonces via check_ajax_referer.
• Block direct HTTP access to the SDK trim script.

1.4.5

• Rewrite srcset, intermediate sizes, and MetaSlider crop URLs, not only wp_get_attachment_url.
• Upload MetaSlider custom crops that skip image_make_intermediate_size.

1.4.4

• Do not resume a bulk upload just because the settings page was opened.
• Clear a stale running flag when no sync lock is held.
• Do not stop a bulk upload when a step lock is still held; send the next request.
• Overwrite a sync lock older than twice the PHP max execution time.

1.4.3

• Lock public path-style with ZLOJ_S3_PUBLIC_PATH_STYLE, not ZLOJ_S3_PATH_STYLE.

1.4.2

• Retry failed sync batches with an idempotent request id and a single in-flight handler.
• Keep separate progress per mode and ask whether to continue or start over.
• Drop the 40-file batch cap; each request now uses most of the PHP time limit.
• Show a file progress bar counted once at job start when attachments change.
• Let the settings form, compatibility spoiler, and sync blocks use the full width.

1.4.1

• Do not treat a custom API endpoint as a bucket hostname.
• Drop empty request headers before signing.
• Show a fuller S3 error (headers, ArgumentName, which compatibility option to use).

1.4.0

• Load plugin classes via PSR-4 from src/ instead of WordPress-style includes/class-*.php files.
• Add a signing region setting and ZLOJ_S3_REGION (default us-east-1).
• Add optional compatibility workarounds behind a collapsed settings panel.
• Split API path-style into its own setting (ZLOJ_S3_API_PATH_STYLE, default on).
• Do not prepend the bucket as a subdomain when path-style is off; use the host field as entered.

1.3.3

• Rewrite attachment URLs when offload is enabled, without requiring the SDK.
• Build public URLs as host/key. Honor legacy ZLOJ_S3_HTTPS_URL.

1.3.2

• Optional object trash: checkbox and ZLOJ_S3_TRASH (default on). Off deletes objects immediately.

1.3.1

• Register media offload hooks even when idle.
• Primary attachment objects can be intercepted via zloj_s3_discard_object before delete.

1.3.0

• Split HTTPS into ZLOJ_S3_API_HTTPS and ZLOJ_S3_PUBLIC_HTTPS (default on). ZLOJ_S3_HTTPS_URL is ignored.
• Put the HTTPS toggles under the API and public host fields.
• Include the bucket in public URLs when path-style is enabled.

1.2.1

• Fix Find conflicts doing nothing when a cached script expected a separate Stop button.
• Turn the active job button into Stop; the current batch finishes, the next one does not start.

1.2.0

• Hide storage keys in the admin and encrypt them at rest.
• Document the configured S3 endpoint as an external service.
• Always verify TLS; tighten AJAX sanitization; keep Plugin Check notices on the settings screen.
• Add a find-conflicts scan that compares local files with storage without uploading.

1.1.0

• Add AJAX bulk upload of local uploads, with optional cleanup of identical local copies and a conflict resolver.

1.0.0

• Initial release.