Amazon S3 & CloudFront Integration


Sync Files Once Protected

Allow you automatically sync files to Amazon S3 bucket once they are protected by Prevent Direct Access (PDA) Gold.

Remove Files From Server

When you sync your media files to Amazon S3 bucket, the local files still remain in the server by default. It’s shown as “Synced“.

When this option is enabled, your local files will be automatically removed once synced to the bucket and labeled as “Offloaded“.

Expiration Time For Signed URLs

Set an expiration time for Amazon S3/CloudFront signed URLs generated by our plugin. This value applies to signed URLs used by WooCommerce or Private Download Links.


It’s strongly recommended that you create 2 CloudFront distributions then point them at your Amazon S3 bucket and website respectively (using origin domain). After that, set up 2 subdomains of your site to point at these CDNs.

Our plugin will rewrite your media and asset URL with the domains provided below. So if you don’t use a subdomain of your site in the following fields, it would affect your site’s overall SEO.

How to create a CloudFront distribution.

Custom Domain (CNAME) For Media Files

When your media files are offloaded to Amazon S3, their File URLs will be updated with the S3 raw URL format:‑content/uploads/...

This option allows you to rewrite these raw URLs to a CloudFront, a custom CDN domain or better yet a CNAME.

When creating a CloudFront distribution for media files, you should set the “Origin Domain Name” to the Amazon S3 bucket that you’ve input under “Storage” tab.

Custom Domain (CNAME) For Asset Files

Similarly, it’s highly recommended that you set up another CloudFront distribution whose “Origin Domain Name” is set to your WordPress website to serve all your asset files such CSS and JS, with CloudFront.

Another CloudFront distribution is necessary so that we can get new and uncached assets directly from your website on-demand. Performance wise, this method is much more efficient than actively scanning, uploading and serving assets from the S3 bucket.

Possible value for the option: CloudFront, other CDN domain, or a CNAME.


Search & Replace

This option comes in handy when there are a lot of media files embedded in content before you offload them to Amazon S3. Once offloaded, your file URLs are changed to Amazon S3 URLs. So by right, you will have to update their file URLs in your content as well, which is really painful if there are a lot of files of this type. Our plugin helps automate these “search & replace” process for you.

Best of all, our plugin will replace these outdated URLs with Amazon/CloudFront signed URLs adding another layer of protection to your files in content. You can adjust the expiration time of these auto-generated signed URLs as well.

Simply select which pages you want to apply this feature on for optimized performance of your website.

Access Denied for Offloaded File URLs

By default, no one will be able to access protected file URLs directly once they’re offloaded to your S3 bucket including the admins.

This URL always return "Access Denied" when accessing directly or
embedded on posts not selected under your Search & Replace option

It’s done for security reason so that no one can share the private file URLs without your permission.

Instead, when you embed the protected S3 files into your content, we will auto-generate an expiring link (preset on the option above) for authorized users to access them accordingly.

Lasted updated on July 4, 2021