Skip to content

Credentials in wp-config.php

You can define any provider field as a constant in wp-config.php instead of saving it in Settings. This keeps secrets out of the database, out of database backups and out of site exports.

  • Each constant is named OMNIOFFLOADER_{PROVIDER}_{FIELD}, in capital letters.
  • A constant always wins over a value saved in Settings.
  • In Settings, a field set by a constant is locked and shows Locked by the … constant in wp-config.php.
  • Every field can be a constant, not only the keys. You can mix: for example, keep the key and secret in wp-config.php and enter the bucket and domain in Settings.
  • Secrets are never sent back to the browser, whether they come from a constant or from the database.

Add the lines to wp-config.php above the line that says /* That's all, stop editing! Happy publishing. */. Then reload the Settings page.

define( 'OMNIOFFLOADER_CLOUDFLARE_R2_KEY', 'your-access-key-id' );
define( 'OMNIOFFLOADER_CLOUDFLARE_R2_SECRET', 'your-secret-access-key' );
define( 'OMNIOFFLOADER_CLOUDFLARE_R2_ENDPOINT', 'https://your-account-id.r2.cloudflarestorage.com' );
define( 'OMNIOFFLOADER_CLOUDFLARE_R2_BUCKET', 'my-site-media' );
define( 'OMNIOFFLOADER_CLOUDFLARE_R2_DOMAIN', 'https://media.yourdomain.com' );
Provider Constant prefix Fields
Cloudflare R2 OMNIOFFLOADER_CLOUDFLARE_R2_ KEY, SECRET, ENDPOINT, BUCKET, DOMAIN
Amazon S3 OMNIOFFLOADER_AMAZON_S3_ KEY, SECRET, BUCKET, REGION, DOMAIN
DigitalOcean Spaces OMNIOFFLOADER_DIGITALOCEAN_SPACES_ KEY, SECRET, ENDPOINT, REGION, BUCKET, DOMAIN
Backblaze B2 OMNIOFFLOADER_BACKBLAZE_B2_ KEY, SECRET, ENDPOINT, REGION, BUCKET, DOMAIN
Wasabi OMNIOFFLOADER_WASABI_ KEY, SECRET, BUCKET, REGION, DOMAIN
Any S3-Compatible Storage OMNIOFFLOADER_S3_COMPATIBLE_ NAME, KEY, SECRET, ENDPOINT, REGION, PATH_STYLE, BUCKET, DOMAIN