Amazon S3 wordpress setup is the most established way to offload a WordPress media library in 2026. This guide walks through bucket creation, IAM permissions, CORS, CloudFront, and the WordPress side without skipping the steps everyone gets stuck on.
Step one: create a bucket the right way
Create the bucket in a region close to your audience. Block all public access for a private bucket, or allow specific access via a CloudFront distribution if you plan to serve files publicly. Versioning is optional but useful for recovery.
Name the bucket something predictable. The bucket name becomes part of every URL if you skip the CDN step, so pick something you would be happy to see in a sitemap.
Step two: lock down IAM
Create a dedicated IAM user just for WordPress with programmatic access. Attach a policy that allows only the operations your offload plugin actually needs. Read, write, list, and delete on the specific bucket. Nothing else.
Generate access keys, store them in your WordPress secrets manager, and never paste them into wp-config.php in a public repo.
Step three: CORS so the browser plays nicely
If you ever fetch images from JavaScript or use canvas operations on them, set a CORS policy on the bucket. Allow GET from your site origin. Most static delivery does not need CORS, but it is good to have configured before you discover you need it.
CloudFront has its own CORS settings that override the bucket if you serve through CloudFront. Configure both for consistency.
Step four: wire WordPress to S3
Install Defyn Media Offload and paste in the bucket name, region, and the IAM access keys. The plugin verifies the connection, runs a small upload test, and reports back any permission problems clearly. From there, every new upload streams to S3 automatically.
For existing media, the Defyn Media Offload plugin ships with a resumable WP-CLI command. Run it once to migrate everything you have already uploaded. The migration survives dropped SSH sessions.
Step five: CloudFront in front of S3
Direct S3 URLs are fine for prototypes. For production, put CloudFront in front. It caches files at the edge, terminates TLS quickly, and lets you serve from your own custom hostname.
Update the plugin CDN URL setting to point at the CloudFront distribution. WordPress will now serve every image, srcset variant, and product photo through the CDN.
Frequently asked questions
Is amazon s3 wordpress setup expensive?
No. A typical WordPress media library costs a few dollars a month on S3 plus CloudFront. The bigger the library, the better the per-gigabyte rate.
Do I need a Route 53 hosted zone?
No. You can point any DNS provider at CloudFront. Route 53 is the AWS-native option but not required.
What about server-side encryption?
Enable it. SSE-S3 is free and standard. SSE-KMS is more secure but adds cost and complexity.
How long does migration take?
A library of ten thousand images typically migrates in an hour or two depending on bandwidth. The plugin is resumable, so you can leave it overnight.
Related reading
- WordPress hosting bandwidth costs explained
- The real cost of storing WordPress images on your origin
- Defyn Media Offload on WordPress.org – the plugin behind these techniques.
