Direct Upload
Direct Upload is a Pro-only, opt-in workflow for uploading supported files from a browser directly to your configured storage bucket. The file parts do not pass through the WordPress server. After the bucket and WordPress verify the completed upload, WordPress creates the Media Library attachment and its generated image sizes.
It is intentionally disabled by default. It is not part of Free, and it does not replace the normal WordPress uploader: use the normal uploader for every file type outside the released Direct Upload scope.
Released scope
The current released scope is deliberately explicit:
- Providers: Amazon S3 and Cloudflare R2.
- Files: PNG, JPG, JPEG, WebP, PDF, ZIP, MP3, MP4, and DOCX.
- Destination: the active writable storage profile.
- Result: the remote original is verified, then the attachment and WordPress image derivatives are available in the Media Library.
The listed non-image formats are supported by the released Pro workflow. Other file types outside this list still use the normal WordPress uploader.
The release matrix was verified in real-browser E2E runs against real Amazon S3 and Cloudflare R2 buckets. Direct Upload remains Pro-only; Free continues to use the normal WordPress uploader.
Before enabling
- Install and activate both Free and Pro, and activate a Pro license. Pro 1.2.5 requires Free 1.2.5 or newer.
- Configure and test an Amazon S3 or Cloudflare R2 profile in Universal Storage → Storage. The profile must be writable.
- Configure bucket CORS for the exact WordPress admin origin. The browser, not the WordPress server, sends the file parts to storage.
- In Universal Storage → Direct Upload, review the preflight and explicitly confirm that you tested browser CORS for this site. Only then enable the feature.
KAZCODE never changes your bucket CORS policy automatically. The preflight can validate the local configuration, but only a real browser request to your provider proves CORS.
Bucket CORS requirements
Allow the exact admin origin shown on the Direct Upload page. Do not use a broad wildcard origin for an authenticated production dashboard unless that is an intentional, reviewed security decision for your infrastructure.
The bucket policy needs these browser-facing permissions:
| Setting | Required value |
|---|---|
| Allowed origin | Your exact WordPress admin origin, for example https://example.com |
| Allowed methods | PUT, GET, HEAD |
| Allowed headers | Content-Type (or * if appropriate for your policy) |
| Exposed headers | ETag |
The Direct Upload page repeats these values for the current site. If the browser reports a CORS or preflight error, correct the provider policy and retry; enabling the feature does not change CORS on your behalf.
Upload and verify
- Open Universal Storage → Direct Upload.
- Choose a supported image or non-image file (PNG, JPG, JPEG, WebP, PDF, ZIP, MP3, MP4, or DOCX) and select Upload.
- Wait for the success message; do not close the browser while a multipart upload is in progress. If it is interrupted, return to the page with the same file to resume the recorded upload, or choose Cancel and start over.
- Open Media → Library and confirm the image is present. Check the original and a generated thumbnail from the configured delivery host before relying on the workflow in production.
The service verifies the remote multipart upload before it finalizes the WordPress attachment. A successful bucket write alone is not treated as a ready Media Library item.
Troubleshooting
The page is unavailable or the enable control is blocked — confirm that Free and Pro are active, the Pro license permits premium operations, and the default storage profile is writable. Read every failed preflight item before enabling.
The browser reports a CORS or preflight error — compare the exact origin, methods,
allowed request headers, and exposed ETag header with the table above. Also confirm
that the provider clock and presigned URL lifetime are valid.
An unsupported file type is rejected — confirm it is one of PNG, JPG, JPEG, WebP, PDF, ZIP, MP3, MP4, or DOCX. Types outside this released matrix must use the standard WordPress uploader.
The upload completed but the image does not display — first confirm the attachment is ready in Media Library, then check the provider’s delivery/CDN URL and follow Missing / broken files.