Sidcraft Cloud Media Offload

Delivery & security

• Offloaded files get stable URLs on your own domain (for example https://example.com/cloud-media/2026/10/photo.jpg ) that mirror the uploads structure, so responsive images ( srcset ), the block editor and other plugins keep working.
• Secure mode (default): every request is redirected to a short-lived, signed link created by the provider. Cloud files stay private.
• Public mode : permanent “anyone with the link” shares for the fastest delivery (Dropbox, Google Drive, Box).
• Per-file access: restrict any attachment to logged-in users.
• Existing post content that still points to wp-content/uploads is rewritten to the cloud URLs.
• OAuth tokens and client secrets are encrypted at rest. Each site uses its own cloud apps – files never pass through a third-party relay.

Cloud modules (shortcode & block)

Show any folder of your cloud storage on a page with the Cloud Module block or the [sidcm_cloud] shortcode:

• File browser with breadcrumbs, search and sub-folder navigation (scope-locked to the configured folder)
• Image gallery with lightbox, and image carousel
• Download list and single download button
• Audio and video players with playlists, streamed from the cloud
• Document embed (Office and PDF previews where the provider supports it)
• Upload box with drag & drop; files go directly from the visitor’s browser to the cloud where the provider allows it (Dropbox up to 150 MB, OneDrive and Google Drive any size, Box up to 50 MB), otherwise in chunks through your server
• Personal folders : folder="Clients/%user_login%" shows every logged-in user only their own folder – ideal for client portals
• Role-based access, password protection, e-mail notifications on uploads and downloads

Integrations

• WooCommerce downloadable products and Easy Digital Downloads files are delivered from the cloud: after the store verifies the purchase, the customer is redirected to a short-lived cloud link. Store files are never public. A cloud file picker creates “store links” for any file in your cloud storage.
• Sidcraft Commerce: sell digital downloads from the cloud. Attach cloud files to products; when an order is paid, customers get secure links (with download limits and expiry) in their order e-mail and on a [sidcm_my_downloads] page. Links are revoked if the order is cancelled or refunded.
• Sidcraft Page Builder: a native “Cloud Module” unit with every module type.
• Contact Form 7, WPForms, Gravity Forms and Fluent Forms: files uploaded through forms are copied to the cloud automatically (with an optional e-mail containing the links).

Cloud Media dashboard

The plugin has its own dashboard (Cloud Media → Dashboard) with storage figures, one-click offloading of existing uploads, connected accounts, integrations, recent activity and quick links.

Activity log & statistics

Track offloads, uploads, downloads and errors; see the most downloaded files over the last 30 days. Logged data is included in WordPress’ personal data export and erase tools.

External services

This plugin connects to the cloud storage services that an administrator chooses to connect. Nothing is sent to any service until an administrator enters their own app credentials and clicks “Connect”. No data is sent to the plugin author.

What is sent and when:

• When connecting an account (OAuth): the administrator’s browser is sent to the provider’s sign-in page; the site then exchanges the returned authorization code for access tokens.
• When a file is uploaded to the Media Library (or moved with the Tools page / WP-CLI): the file and its generated image sizes, with their file names, are uploaded to the connected account.
• When an offloaded file is viewed or downloaded: the site requests a temporary download link from the provider, and the visitor’s browser downloads the file directly from the provider (which receives the visitor’s IP address and browser information). In Google Drive private mode the file is downloaded by the site and streamed to the visitor.
• When a Cloud Module is displayed or used: the site lists the configured folder; files are delivered as above; files uploaded by visitors through an upload box are sent to the configured folder.
• When a Media Library file is deleted (if enabled): a delete/trash request is sent for the cloud copy.

Services:

• Dropbox (Dropbox, Inc.) – API hosts api.dropboxapi.com, content.dropboxapi.com, www.dropbox.com. Terms of Service , Privacy Policy .
• Microsoft OneDrive / SharePoint via Microsoft Graph (Microsoft Corporation) – API hosts login.microsoftonline.com, graph.microsoft.com. Microsoft Services Agreement , Privacy Statement .
• Google Drive (Google LLC) – API hosts accounts.google.com, oauth2.googleapis.com, www.googleapis.com; files may be delivered from drive.usercontent.google.com. Google Terms of Service , Google Drive Terms , Privacy Policy .
• Box (Box, Inc.) – API hosts account.box.com, api.box.com, upload.box.com; files are delivered from Box download hosts. For direct uploads the site requests a down-scoped, folder-limited upload token that is given to the visitor’s browser. Terms of Service , Privacy Notice .
• iCloud via Apple CloudKit Web Services (Apple Inc.) – API host api.apple-cloudkit.com; files are uploaded to and delivered from Apple’s CloudKit asset hosts. Requests are signed with the server-to-server key you provide. iCloud Terms , Apple Privacy Policy .
• Amazon S3 / S3-compatible storage (Amazon Web Services, Inc., or the provider of the endpoint you enter) – the bucket’s regional API host (s3.{region}.amazonaws.com) or your custom endpoint, and the CDN address you enter. Requests are signed with your access key. AWS Customer Agreement , AWS Privacy Notice .
• DigitalOcean Spaces (DigitalOcean, LLC) – {region}.digitaloceanspaces.com and, with Spaces CDN on, {space}.{region}.cdn.digitaloceanspaces.com. Terms of Service , Privacy Policy .
• Bunny.net (BunnyWay d.o.o.) – the storage API host of the selected region ({region}.storage.bunnycdn.com) and the Pull zone hostname you enter. Terms of Service , Privacy Policy .
• Cloudinary (Cloudinary Ltd.) – api.cloudinary.com for uploads and management; files are delivered from res.cloudinary.com. Terms of Use , Privacy Policy .
• Cloudflare Stream (Cloudflare, Inc.) – api.cloudflare.com for uploads and playback tokens; videos play from your Stream customer subdomain (customer-….cloudflarestream.com) or iframe.videodelivery.net. Terms , Privacy Policy .
• Mux (Mux, Inc.) – api.mux.com for uploads; videos play from stream.mux.com and player.mux.com. Terms of Service , Privacy Policy .
• Vimeo (Vimeo.com, Inc.) – api.vimeo.com for uploads; videos play in player.vimeo.com. Terms of Service , Privacy Policy .
• YouTube (Google LLC) – accounts.google.com / oauth2.googleapis.com for sign-in and www.googleapis.com for uploads; videos play in the privacy-enhanced player at www.youtube-nocookie.com. YouTube Terms of Service , Google Privacy Policy .

When a page shows a video stored on a video platform, the visitor’s browser loads that platform’s player, which receives the visitor’s IP address and browser information.

Direct uploads: when a visitor uses an upload box and direct uploads are enabled, their browser sends the file straight to the provider listed above, using a short-lived upload session that this site creates for that single file.