CPW Media Offload for Cloudflare R2

CPW Media Offload for Cloudflare R2 copies your WordPress Media Library to a Cloudflare R2 bucket and rewrites the media URLs of your site so visitors download images, videos and documents from Cloudflare instead of your web server.

The Cloudflare R2 free tier includes 10 GB of storage and, when the bucket is served through a custom domain, no egress fees. That makes it a practical way to keep a small hosting plan fast: your server stops sending megabytes of images on every page view and stops filling its disk with thumbnails.

What it does

• Uploads new media, and every generated thumbnail size, to your R2 bucket.
• Optionally deletes the local copy after a successful upload, so the uploads folder stops growing.
• Rewrites attachment URLs, srcset sources, post content, widgets and blocks to the public bucket URL.
• Bulk tool that offloads an existing library in small batches, with progress and a stop button.
• Copy files back to the server at any time, per file or for the whole library.
• Usage bar tuned for the 10 GB free tier, measured directly on the bucket.
• Optional WebP and AVIF conversion on delivery, done by Cloudflare itself, so no image is ever encoded on your server.
• Optional WebP conversion on upload, for sites that would rather store the smaller file.
• Cloudflare R2 column and per file actions inside the Media Library, including sending a changed file again.
• Rebuild tool that restores the offload index by checking the bucket, without uploading anything.
• Activity log so upload or permission problems are visible without server access.
• Files sent again get a new version in their URL, so browsers and the Cloudflare cache never keep showing the old content.
• Optional Cloudflare cache purge, so a file deleted from the bucket stops being served by the edge right away.

WebP and AVIF without loading your server

Image conversion normally costs CPU: the server decodes the upload and re-encodes it, which is slow on shared hosting and simply unavailable where PHP was built without WebP support.

This plugin can hand that work to Cloudflare instead. Turn on Convert on delivery and your media URLs are served through Cloudflare Image Transformations, which converts each image to AVIF or WebP according to what the visitor’s browser accepts, resizes it to the width actually needed, and caches the result on the edge.

• Nothing is encoded on your web server, at upload time or afterwards.
• The originals on the bucket are never modified, so the change is fully reversible.
• Images already in your library are covered too: there is nothing to reprocess and nothing is rewritten in your database.
• Optionally, WordPress stops generating thumbnails altogether and Cloudflare produces every responsive size from the original. That is where the real saving on the 10 GB allowance comes from.

This requires a custom domain connected to your bucket, because transformations are served by the Cloudflare zone that answers for that domain. The r2.dev development address cannot do it. The Cloudflare free plan includes 5,000 unique transformations per month; repeat visitors are served from the cache and cost nothing.

Page builder and theme compatibility

Media URLs stored inside page builder data are rewritten as well, so background images, galleries and sliders keep working after an offload:

• Elementor and Elementor Pro, including generated CSS files and background images.
• Divi, Beaver Builder and WPBakery Page Builder.
• Block themes, classic themes, the block editor and any theme that uses the standard WordPress media functions.

Elementor’s CSS cache is cleared automatically after an offload so its generated files point at the new URLs.

Page cache plugins

When media URLs change, because an existing library is offloaded, a file is copied back to the server or sent again, or delivery from R2 is switched on or off, the page cache is cleared so visitors never get pages that still point at the old addresses. Supported: WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, WP Fastest Cache, SiteGround Speed Optimizer, Cache Enabler, Comet Cache, Breeze, Hummingbird, WP-Optimize, Swift Performance, Autoptimize, Nginx Helper, Kinsta, WP Engine and Pantheon. During a bulk run the cache is cleared once, a couple of minutes after the changes stop, and new uploads never clear it.

Languages

The plugin is fully internationalised. Translations are provided through translate.wordpress.org, where Brazilian Portuguese and any other language can be contributed.

Security

• The secret access key is encrypted with your WordPress security keys before it is stored.
• Credentials can be defined as constants in wp-config.php and kept out of the database entirely.
• Every form is protected with nonces and capability checks.
• No third party SDK is bundled: requests are signed with AWS Signature Version 4 and sent through the WordPress HTTP API.

External services

This plugin connects to the Cloudflare R2 storage service, which is the whole purpose of the plugin, and, only if you set up the optional cache purge, to the Cloudflare API. It does not connect to any other external service and it sends no analytics or telemetry anywhere.

Cloudflare R2 (S3 compatible API)

• When: whenever a file is offloaded, restored, deleted or listed, and when you use the Test connection or Recalculate storage usage buttons.
• Where: https://<your-account-id>.r2.cloudflarestorage.com (or the EU or FedRAMP jurisdiction endpoint you select, or a custom endpoint you enter).
• What is sent: the media files you choose to offload, their file names and content types, your R2 access key id, a request signature generated from your secret access key, and a user agent string containing the plugin version and your site address.
• What is received: the storage responses of the service, including object listings and sizes used by the usage bar.

Files served to your visitors are additionally requested from the public bucket URL you configure (an r2.dev address or your own custom domain).

Cloudflare API (optional cache purge)

• When: only when a zone ID and an API token are filled in, whenever a file is deleted from the bucket or sent to it again, and when you click Test cache purge.
• Where: https://api.cloudflare.com/client/v4/zones/<your-zone-id>.
• What is sent: your API token, and the public URLs of the files whose cached copy must be cleared.
• What is received: whether the request succeeded.

Cloudflare terms of service: https://www.cloudflare.com/terms/
Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/