Wasabi

Better Messages can keep the files members send in a Wasabi bucket instead of your server's uploads folder. Browsers upload files straight to the bucket, and files open from the bucket instead of from your server.

Cloud storage works in the free version and in the WebSocket version, from Better Messages 3.1. Wasabi is connected through the Amazon S3 or S3-compatible storage.

Wasabi bills every file for a minimum time, 90 days on pay-as-you-go, even if it is deleted sooner. A chat where members often delete what they send pays for those files anyway. Check Wasabi's current pricing before you choose it.

What you need#

A Wasabi account.
A bucket, kept private for members-only files.
A user with API keys whose policy covers that bucket only. The root account's keys would open every bucket of the account.

Choose how files open#

How files open	Who can open a file	What the bucket needs
Members of the conversation only (default)	Only members, through links Better Messages signs for each of them	A private bucket
Anyone with the link	Anyone who has a file's link	A public bucket, which Wasabi enables on request

1. Create the bucket#

In the Wasabi console, open Buckets and click Create Bucket. Enter a name, choose a region close to most of your members and note the endpoint shown next to it, for example s3.eu-central-2.wasabisys.com. Click Next, leave Bucket Versioning off, and click Create Bucket on the last step.

Create Bucket in the Wasabi console with the bucket name and the Frankfurt eu-central-2 region and its endpoint

2. Create the policy#

Open Policies → Create Policy, enter a name, for example better-messages-chat-files, and paste this into the Policy Editor, with your bucket's name in both places:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketCORS", "s3:PutBucketCORS"],
      "Resource": "arn:aws:s3:::my-site-chat-files"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts"],
      "Resource": "arn:aws:s3:::my-site-chat-files/*"
    }
  ]
}

It lets the key upload, read, list and delete files in that bucket and set its CORS rule, and nothing else. The editor says Policy is valid. Click Create Policy.

Create A New Policy with the one-bucket policy in the Policy Editor

3. Create the user and its keys#

Open Users → Create User. Enter a name, for example better-messages, and tick Programmatic (create API keys) only.

Create User with the user name and Programmatic access ticked

Click Next past Groups. Under Policies, find your policy and select it, then click Next and Create User. Wasabi then shows the user's Access Key and Secret Key. Click Copy Keys To Clipboard or Download Keys: the secret key is not shown again after you close this window.

Create Access Key with the access key, the hidden secret key and the Copy Keys To Clipboard and Download Keys buttons

4. Connect the bucket in Better Messages#

In WordPress, go to Better Messages → Settings → Attachments. In the Storage section, click Connect next to Amazon S3 or S3-compatible, and fill in:

Endpoint: the bucket's region endpoint from step 1, for example https://s3.eu-central-2.wasabisys.com. It must be the bucket's own region: another region's endpoint refuses the bucket.
Region: the region, for example eu-central-2.
Bucket: the bucket's name.
Folder: where in the bucket this site keeps its files, bm by default. Give each site its own folder if several sites share one bucket.
Access Key ID and Secret Access Key, from step 3.

Leave Path-style URLs on. Click Configure CORS, then Test Connection. Every line should say Passed.

Connect Amazon S3 or S3-compatible filled in for Wasabi, with every Test Connection line passed

Click Connect. It runs the same test and saves the storage when the test passes. When a check fails, nothing is saved: fix what the check says, or click Save Anyway.

5. Choose which files go to the bucket#

Under File Groups, choose Amazon S3 or S3-compatible for each kind of file you want in Wasabi, then click Save Settings. The choice applies to files sent after you save. Files in end-to-end encrypted conversations stay encrypted wherever they are kept.

Who can open files#

Members of the conversation only#

This is the default. The bucket stays private, and every member gets links to the files that Better Messages signs for them. A link works for one to one and a half days, and the messenger renews links on its own while the member keeps the conversation open. Someone who is not a member of the conversation gets no link, and without one the bucket opens nothing.

Anyone with the link#

Files open from a public address with no check: anyone who has a file's link can open it, and your site does no work when a file is viewed. Use this only for files that are not private, and keep them in a bucket of their own, because a public bucket opens every file in it.

Wasabi keeps public access off for trial accounts and for every account opened since 13 March 2023. The bucket's Settings → Properties → Public Access Override then says so. On a paid account, ask Wasabi Support to allow public access, then make the public bucket readable by anyone.

Public Access Override saying that public access to the account's buckets is disabled

In Better Messages, choose Anyone with the link (public URL) and enter https://s3.<region>.wasabisys.com/<bucket> as the Public URL. Test Connection checks that a file opens from it.

Public files on your own domain#

Wasabi serves a bucket on your own domain only for its resellers. Wasabi's way for everyone else is to put Cloudflare in front of a public bucket:

Name the public bucket exactly like the address, for example files.my-site.com. Wasabi picks the bucket by the name in the address.
In Cloudflare, add a CNAME record named files with the bucket's region endpoint, for example s3.eu-central-2.wasabisys.com, as its target, Proxied.

Enter https://files.my-site.com as the Public URL in Better Messages. Cloudflare keeps a copy of each file, and a deleted file can keep opening from it until its cache expires.

Uploads straight to the bucket#

With Upload straight to the bucket on, the default, a member's browser or the mobile app sends a file straight to the bucket, using a link Better Messages signs for that one file. Files never pass through your server, and large files are sent in parts.

The bucket has to allow uploads from your site, with a CORS rule. Configure CORS saves one, named better-messages, for your site's address and the mobile app. You can see it under the bucket's Settings → Permissions → Cross-Origin Resource Sharing (CORS), and change it there too.

The bucket's CORS configuration with the rule Configure CORS saved, for the site's address and the mobile app

While the bucket does not allow uploads from your site, files go through your server instead, so sending never fails because of CORS. With Upload straight to the bucket off, every file is uploaded to your server first and copied to the bucket after its message is sent.

The same rule lets members open files in end-to-end encrypted conversations. The messenger downloads such a file itself to decrypt it, and without the rule the browser refuses and shows Could not download media. So keep the rule even with Upload straight to the bucket off. With encryption on, Test Connection checks this too. The mobile app is not affected.

Moving files you already have#

Files sent before you connected the bucket stay where they are and keep opening. To move them, click Move all files from one storage to another under File Groups, or move single files in Better Messages → Administration → Files. Moves run in the background, so you can leave the page while they run.

When a file is deleted#

When a file is deleted in Better Messages, it is marked Pending deletion in Administration → Files, and a background job deletes it from the bucket within a few minutes. The file leaves the list once the bucket confirms it is gone. If the bucket refuses, the job tries again later.

Wasabi still bills a deleted file until its minimum storage time is over.

Keeping the keys out of the database#

You can put the keys in wp-config.php instead of the settings. The dialog then shows those fields as set in wp-config.php.

define( 'WORDPLUS_S3_ACCESS_KEY', 'your-access-key' );
define( 'WORDPLUS_S3_SECRET_KEY', 'your-secret-key' );

Troubleshooting#

"The provider does not recognise this access key." The Access Key ID is wrong, or the user or its key was deleted.

"The secret key does not match the access key." The Secret Access Key does not belong to that Access Key ID. If it was not copied when the user was created, create a new access key for the user under Users.

"The key is not allowed to do this in the bucket." The user's policy does not cover this bucket, or the policy is not attached to the user. Check the bucket name in both places of the policy, see step 2.

"The bucket does not exist at this endpoint." Check the bucket's name.

"The bucket is in another region. Check the region and the endpoint." The endpoint is another region's. Use the endpoint of the bucket's own region, see step 1.

"CORS does not allow uploads from … yet." Click Configure CORS, then run Test Connection again.

"Encrypted files will not open in browsers on …" Click Configure CORS, then run Test Connection again.

"Anyone can read files in this bucket without a link." The bucket is public while files are set to members only. Keep members-only files in a private bucket.

"The file does not open from its public URL." Public access is off on the account, or the bucket does not let anyone read. See Anyone with the link.

"This server's clock is … seconds off the provider's." Signed links stop working when your server's clock is more than 15 minutes off. Ask your host to fix the server time.