Cloudflare R2 as the WordPress media library, SDK-free, SigV4 in pure PHP

<?php
class R2_SigV4 {
    private string $accessKey;
    private string $secretKey;
    private string $accountId;
    private string $region = "auto";

    public function __construct(string $accessKey, string $secretKey, string $accountId) {
        $this->accessKey = $accessKey;
        $this->secretKey = $secretKey;
        $this->accountId = $accountId;
    }

    /**
     * Sends a SigV4-signed HTTP request to R2.
     *
     * @param string $method    GET|PUT|DELETE|HEAD
     * @param string $bucket    bucket name
     * @param string $key       object key (no leading slash)
     * @param string $body      raw body (empty for GET/DELETE)
     * @param array  $headers   extra request headers; Content-Type etc.
     * @return array { status:int, headers:array, body:string }
     */
    public function request(
        string $method,
        string $bucket,
        string $key,
        string $body = "",
        array $headers = []
    ): array {
        $host = "{$this->accountId}.r2.cloudflarestorage.com";
        $path = "/" . rawurlencode($bucket) . "/" . str_replace("%2F", "/", rawurlencode($key));
        $amzDate = gmdate("Ymd\THis\Z");
        $dateStamp = gmdate("Ymd");
        $payloadHash = hash("sha256", $body);

        $canonicalHeaders =
            "host:{$host}\n" .
            "x-amz-content-sha256:{$payloadHash}\n" .
            "x-amz-date:{$amzDate}\n";
        $signedHeaders = "host;x-amz-content-sha256;x-amz-date";

        $canonicalRequest =
            "{$method}\n" .
            "{$path}\n" .
            "" . "\n" .          // canonical query string (none here)
            "{$canonicalHeaders}\n" .
            "{$signedHeaders}\n" .
            "{$payloadHash}";

        $scope = "{$dateStamp}/{$this->region}/s3/aws4_request";
        $stringToSign =
            "AWS4-HMAC-SHA256\n" .
            "{$amzDate}\n" .
            "{$scope}\n" .
            hash("sha256", $canonicalRequest);

        $kDate    = hash_hmac("sha256", $dateStamp,    "AWS4{$this->secretKey}", true);
        $kRegion  = hash_hmac("sha256", $this->region, $kDate, true);
        $kService = hash_hmac("sha256", "s3",            $kRegion, true);
        $kSigning = hash_hmac("sha256", "aws4_request", $kService, true);
        $signature = hash_hmac("sha256", $stringToSign, $kSigning);

        $authorization =
            "AWS4-HMAC-SHA256 " .
            "Credential={$this->accessKey}/{$scope}, " .
            "SignedHeaders={$signedHeaders}, " .
            "Signature={$signature}";

        $reqHeaders = array_merge([
            "Host: {$host}",
            "X-Amz-Date: {$amzDate}",
            "X-Amz-Content-Sha256: {$payloadHash}",
            "Authorization: {$authorization}",
        ], $headers);

        $ch = curl_init("https://{$host}{$path}");
        curl_setopt_array($ch, [
            CURLOPT_CUSTOMREQUEST  => $method,
            CURLOPT_HTTPHEADER     => $reqHeaders,
            CURLOPT_POSTFIELDS     => $body,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HEADER         => true,
            CURLOPT_TIMEOUT        => 30,
        ]);
        $raw = curl_exec($ch);
        $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
        $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
        curl_close($ch);

        return [
            "status"  => (int) $status,
            "headers" => substr($raw, 0, $headerSize),
            "body"    => substr($raw, $headerSize),
        ];
    }
}

add_filter("wp_handle_upload", function ($upload) {
    if (!isset($upload["file"]) || !file_exists($upload["file"])) {
        return $upload;
    }

    $r2 = appycodes_r2_client();
    $key = appycodes_r2_key_for($upload["file"]);

    $put = $r2->request(
        "PUT",
        APPYCODES_R2_BUCKET,
        $key,
        file_get_contents($upload["file"]),
        ["Content-Type: " . $upload["type"]]
    );

    if ($put["status"] !== 200) {
        error_log("R2 upload failed: " . $put["body"]);
        return $upload;
    }

    // Keep the file locally for image-size generation; we'll push
    // the resized variants on wp_generate_attachment_metadata below,
    // then optionally clean up.
    $upload["url"] = APPYCODES_R2_PUBLIC_BASE . "/" . $key;
    return $upload;
}, 10, 1);

add_filter("wp_generate_attachment_metadata", function ($metadata, $attachment_id) {
    if (empty($metadata["file"])) return $metadata;

    $uploads = wp_get_upload_dir();
    $baseDir = trailingslashit($uploads["basedir"]);
    $relDir = dirname($metadata["file"]);
    $r2 = appycodes_r2_client();

    foreach ((array) ($metadata["sizes"] ?? []) as $size => $info) {
        $absPath = $baseDir . $relDir . "/" . $info["file"];
        if (!file_exists($absPath)) continue;
        $key = ltrim($relDir . "/" . $info["file"], "/");
        $r2->request(
            "PUT",
            APPYCODES_R2_BUCKET,
            $key,
            file_get_contents($absPath),
            ["Content-Type: " . $info["mime-type"] ?? "image/jpeg"]
        );
    }

    return $metadata;
}, 10, 2);

add_filter("upload_dir", function ($dirs) {
    $dirs["baseurl"] = APPYCODES_R2_PUBLIC_BASE;
    $dirs["url"]     = APPYCODES_R2_PUBLIC_BASE . $dirs["subdir"];
    return $dirs;
});

add_filter("wp_get_attachment_url", function ($url, $attachment_id) {
    $file = get_post_meta($attachment_id, "_wp_attached_file", true);
    if (!$file) return $url;
    return APPYCODES_R2_PUBLIC_BASE . "/" . ltrim($file, "/");
}, 10, 2);

add_filter("wp_get_attachment_image_src", function ($image, $attachment_id, $size) {
    if (is_array($image)) {
        $file = get_post_meta($attachment_id, "_wp_attached_file", true);
        if ($file) {
            $dir = dirname($file);
            $basename = basename($image[0]);
            $image[0] = APPYCODES_R2_PUBLIC_BASE . "/" . trim("$dir/$basename", "/");
        }
    }
    return $image;
}, 10, 3);

add_action("delete_attachment", function ($attachment_id) {
    $file = get_post_meta($attachment_id, "_wp_attached_file", true);
    if (!$file) return;

    $r2 = appycodes_r2_client();
    $r2->request("DELETE", APPYCODES_R2_BUCKET, $file);

    $metadata = wp_get_attachment_metadata($attachment_id);
    foreach ((array) ($metadata["sizes"] ?? []) as $info) {
        $key = ltrim(dirname($file) . "/" . $info["file"], "/");
        $r2->request("DELETE", APPYCODES_R2_BUCKET, $key);
    }
});

1. Cloudflare dashboard -> R2 -> Buckets -> your bucket -> Settings
2. Custom Domains -> "Connect Domain"
3. Enter "media.example.com"
4. Cloudflare creates a CNAME record automatically (if the domain is
   already on Cloudflare DNS).
5. Wait 30-60s for SSL provisioning.
6. Verify with: curl -I https://media.example.com/test-image.jpg

Then set in wp-config.php:
  define("APPYCODES_R2_PUBLIC_BASE", "https://media.example.com");

<?php
/**
 * Plugin Name: Appycodes R2 Media
 * Description: Offload WordPress media to Cloudflare R2, no SDK required.
 * Version: 1.0.0
 */

require_once __DIR__ . "/r2/class-r2-sigv4.php";

if (!defined("APPYCODES_R2_ACCOUNT_ID")) return;
if (!defined("APPYCODES_R2_ACCESS_KEY")) return;
if (!defined("APPYCODES_R2_SECRET_KEY")) return;
if (!defined("APPYCODES_R2_BUCKET")) return;
if (!defined("APPYCODES_R2_PUBLIC_BASE")) return;

function appycodes_r2_client(): R2_SigV4 {
    static $client = null;
    if ($client === null) {
        $client = new R2_SigV4(
            APPYCODES_R2_ACCESS_KEY,
            APPYCODES_R2_SECRET_KEY,
            APPYCODES_R2_ACCOUNT_ID
        );
    }
    return $client;
}

function appycodes_r2_key_for(string $abs_path): string {
    $uploads = wp_get_upload_dir();
    $baseDir = trailingslashit($uploads["basedir"]);
    return ltrim(str_replace($baseDir, "", $abs_path), "/");
}

require_once __DIR__ . "/r2/hooks/upload.php";
require_once __DIR__ . "/r2/hooks/sizes.php";
require_once __DIR__ . "/r2/hooks/urls.php";
require_once __DIR__ . "/r2/hooks/delete.php";