Alios Media Offload

Alios Media Offload moves your WordPress and WooCommerce media to Cloudflare R2 (or any S3-compatible bucket: Wasabi, Backblaze B2, DigitalOcean Spaces, MinIO, and more) and rewrites your site’s media URLs to serve from your CDN domain.

It signs AWS Signature V4 requests itself and sends them through the WordPress HTTP API — no bundled SDK, tiny footprint, works on PHP 7.4 through 8.3+.

Features:

• Cloudflare R2 and generic S3-compatible storage (endpoint / region / path-style).
• Automatic offload of new uploads, with HEAD verification before marking complete.
• Two-layer URL rewriting: per-attachment filters (always safe) plus an optional, opt-in full-page output-buffer rewrite for theme and page-builder embedded images.
• Bulk migration of existing media (browser progress UI plus WP-CLI: wp r2mo migrate).
• Guided 5-step setup wizard and one-click connection test.
• Optional deletion of local copies after a verified upload.
• Credentials can be set as wp-config.php constants (overriding the database).
• Best-effort cache flush for popular cache plugins.
• Optional, dismissible reminder to leave a review after a week of active use.

External services

This plugin uploads and manages your media files on an S3-compatible object storage service that you configure with your own credentials. It does not connect to any service operated by the plugin author, and it sends no analytics, tracking, or telemetry.

What it connects to: the storage endpoint you enter in the plugin settings — for example Cloudflare R2, Amazon S3, Wasabi, Backblaze B2, DigitalOcean Spaces, or a self-hosted MinIO server. No connection is made until you save your own credentials and a bucket.

What data is sent, and when:

• Your media files (the original file and the image sizes WordPress generates) are uploaded to your bucket when you add a new attachment (if automatic offload is enabled) or when you run a migration.
• For each file, a HEAD request is sent to confirm the upload succeeded, and a DELETE request is sent when you delete the attachment (if it was offloaded).
• Each request is signed with your access key using AWS Signature V4. Your secret key is never transmitted; it is only used locally to compute the request signature.

Because the endpoint is the provider you choose, please review that provider’s terms and privacy policy. For the two most common providers:

• Cloudflare R2 — Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/
• Amazon S3 — Service Terms: https://aws.amazon.com/service-terms/ — Privacy: https://aws.amazon.com/privacy/

For other S3-compatible providers (Wasabi, Backblaze B2, DigitalOcean Spaces, MinIO, etc.), consult that provider’s own terms of service and privacy policy.