Hetzner Object Storage
Hetzner Object Storage is an S3-compatible object storage service from Hetzner Cloud, based in Europe. It is a strong option for sites that require data residency within the EU or want low-cost storage from a GDPR-compliant provider. WP Media Cloud connects to Hetzner Object Storage using S3-compatible credentials.
Before you start#
You will need:
- A Hetzner Cloud account.
- A Hetzner Object Storage bucket in your chosen location.
- An S3-compatible access key and secret key for Hetzner Object Storage.
Step 1: Create an Object Storage bucket#
Log in to the Hetzner Cloud console at console.hetzner.cloud. Select your project and go to Object Storage in the left sidebar. Click Create Bucket. Choose a location and give the bucket a name. Hetzner Object Storage is currently available in Falkenstein (fsn1), Nuremberg (nbg1), and Helsinki (hel1).
Click Create Bucket to confirm.
Step 2: Create access keys#
In the Hetzner Cloud console, go to Security in the left sidebar and select the S3 Credentials tab. Click Generate Credentials. Give the credentials a description and click Generate.
Copy and save the Access Key and Secret Key before closing the dialog — the secret key is only shown once.
Hetzner S3 credentials are account-level and grant access to all buckets within your account. There is currently no option to restrict credentials to a single bucket.
Step 3: Set bucket permissions for public access#
Hetzner Object Storage buckets are private by default. To serve files publicly, you need to apply a bucket policy that allows public reads or set individual file ACLs to public when uploading. WP Media Cloud sets uploaded files to public-read by default.
To apply a public read policy to the entire bucket, use the Hetzner console or an S3-compatible client to attach the following bucket policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::your-bucket-name/*"
}
]
}Replace your-bucket-name with your actual bucket name.
Step 4: Connect Hetzner Object Storage in WP Media Cloud#
You have two options for connecting Hetzner to WP Media Cloud. Use whichever suits your setup.
Option A: Setup wizard
Go to WP Media Cloud > Setup Wizard. The wizard walks you through provider selection, credential entry, and CDN configuration. This is the recommended option for most users.
Option B: wp-config.php constants
Add the following constants above the /* That's all, stop editing! */ line in wp-config.php:
define( 'WPMC_PROVIDER', 'hetzner' );
define( 'WPMC_HETZNER_REGION', 'fsn1' );
define( 'WPMC_HETZNER_ACCESS_KEY', 'your-access-key' );
define( 'WPMC_HETZNER_SECRET_KEY', 'your-secret-key' );
define( 'WPMC_HETZNER_BUCKET', 'your-bucket-name' );
define( 'WPMC_HETZNER_CDN_TYPE', 'custom' );
define( 'WPMC_HETZNER_CDN_URL', 'https://your-cdn.com' );Set WPMC_HETZNER_REGION to the location code for your bucket: fsn1 for Falkenstein, nbg1 for Nuremberg, or hel1 for Helsinki. WP Media Cloud uses this to construct the correct endpoint URL in the format https://[region].your-objectstorage.com. Once the constants are in place, go to WP Media Cloud > Settings > Storage and confirm the plugin has loaded them. Constants override any values saved in the settings panel.
Step 5: Test the connection#
Click Test Connection. WP Media Cloud will upload a small test file to your Hetzner bucket and confirm it can be read back. A green success message confirms the connection is working.
Step 6: Configure CDN delivery (optional)#
Hetzner Object Storage does not include a built-in CDN. Files are served directly from the storage endpoint by default. For global edge delivery, configure an external CDN with your Hetzner bucket as the origin. Bunny CDN, KeyCDN, and CDN77 all support custom S3 origins and work well with Hetzner. Configure your CDN hostname in WP Media Cloud > Settings > CDN > Custom CDN URL.
GDPR and data residency#
All three Hetzner Object Storage locations are within the European Union. Hetzner is a German company subject to German and EU data protection law. If your site handles personal data and requires storage within the EU, Hetzner Object Storage satisfies that requirement. You remain the data controller for any personal data stored in your bucket.
Troubleshooting#
Connection test returns Access Denied
The access key or secret key is incorrect. If the secret key was lost at creation, generate a new set of credentials in Security > S3 Credentials in the Hetzner Cloud console.
Connection test returns endpoint error
The region code is incorrect or the bucket does not exist in the specified location. Confirm the location code matches the bucket’s location in the Hetzner console. The three valid codes are fsn1, nbg1, and hel1.
Files upload but return 403 when accessed publicly
The bucket does not have a public read policy and the file ACL was not set to public on upload. Apply the bucket policy from step 3 or confirm WP Media Cloud is setting file ACLs to public-read on upload.