Zloj S3

Description

Zloj S3 sends uploaded media to an S3-compatible bucket, rewrites attachment URLs, and removes objects when attachments are deleted.

It is built for any S3-compatible endpoint (not only Amazon), can lock credentials with PHP constants, and can migrate existing uploads in AJAX batches with an optional cleanup of identical local copies.

The plugin stays idle until the required settings are filled: API host, public host, bucket, access key, and secret key.

You can lock any setting with a PHP constant. When a constant is defined it wins over the value on the settings screen, and that field becomes read-only.

Access and secret keys are shown as asterisks in the admin, not as the real values.

Constants

• ZLOJ_S3_ENABLED
• ZLOJ_S3_PRIVATE_UPLOAD
• ZLOJ_S3_TRASH (move the primary attachment to a trash prefix; default on)
• ZLOJ_S3_API_URL
• ZLOJ_S3_API_HTTPS (HTTPS for the API host; default on; ZLOJ_S3_HTTPS_URL is used if this is not defined)
• ZLOJ_S3_API_PATH_STYLE (set to path for path-style API URLs: host/bucket/key; default path)
• ZLOJ_S3_REGION (signing region; default us-east-1)
• ZLOJ_S3_PUBLIC_URL
• ZLOJ_S3_PUBLIC_HTTPS (HTTPS for public URLs; default on; ZLOJ_S3_HTTPS_URL is used if this is not defined)
• ZLOJ_S3_BUCKET
• ZLOJ_S3_ACCESS_KEY
• ZLOJ_S3_SECRET_KEY
• ZLOJ_S3_PUBLIC_PATH_STYLE (set to path for path-style public URLs: host/bucket/key)
• ZLOJ_S3_COMPAT_NO_CHECKSUM (skip CRC32 checksum headers)
• ZLOJ_S3_COMPAT_NO_TAGGING (do not send object tags)
• ZLOJ_S3_COMPAT_CANNED_ACL (send public-read / private ACL)
• ZLOJ_S3_COMPAT_NO_EXPECT (disable Expect: 100-continue)

AWS SDK

If AwsS3S3Client is already loaded, that copy is used. Otherwise the plugin loads the trimmed AWS SDK bundled under vendor/ (S3 only, not the full 40+ MB package).

External services

This plugin is an interface to the S3-compatible object storage you configure. It does not send files or credentials to the plugin author.

When offload is enabled, or when you run a connection test or a bulk upload, the plugin contacts the API host and public host you entered. It sends media file contents and the access key / secret key needed to authenticate to that storage.

If you use Amazon S3:

• Service: https://aws.amazon.com/s3/
• Terms of Service: https://aws.amazon.com/service-terms/
• Privacy Policy: https://aws.amazon.com/privacy/

If you use another S3-compatible provider, read that provider’s terms of service and privacy policy before saving credentials. An account with the storage provider is required.

Copyright

Zloj S3, Copyright 2026 zloj.ru.

Free to use. Copies and modifications must keep this license and all copyright notices. Licensed under GPLv2 or later; see license.txt. Third-party libraries keep their own GPL-compatible licenses and copyright files.

Technical details