WordPress powers 43% of the web. But 96% of its security vulnerabilities come from plugins — code that runs with full database access, no sandbox, no permission system. In 2025 alone, researchers disclosed 11,334 new WordPress vulnerabilities. That’s a 42% increase from 2024. Cloudflare’s answer, launched April 1st 2026, is EmDash: an open-source CMS written entirely in TypeScript, built on Astro, and designed from day one for AI agents and sandboxed plugin execution. It’s the most architecturally coherent challenge WordPress has faced in two decades. But it ships as a 0.1.0 beta with zero third-party plugins and a billing model that could surprise you.
What Makes EmDash “AI-Native”
Most CMS platforms bolt AI on as a plugin. EmDash builds it in.
When the creator of the platform you're trying to disrupt says that, something has shifted.
Every EmDash instance ships with a built-in MCP server (Model Context Protocol, the standard Anthropic created for AI agent communication). Claude, Cursor, GitHub Copilot — any MCP-compatible agent can connect directly to your CMS. They can upload media, search posts, create new content types, manage plugins, and deploy changes. All through natural language. All with scoped permissions.
EmDash also ships “agent skills” files: structured documentation that tells AI agents exactly how to operate the CMS. No custom prompting needed. The AI reads the skills file and knows what it can do.
Content isn’t stored as HTML strings like WordPress. EmDash uses portable text — structured JSON. One content source renders to web, mobile, email, or API. That makes content machine-readable by default, not something an AI has to parse from markup.
The CLI is designed for agents, not just humans. You can point an AI at your terminal and say, “Build me a new custom content type” or “Migrate this old theme.” The agent has all the tools it needs programmatically.
The Plugin Sandbox: Architecture, Not Policy
This is EmDash’s defining feature. Every plugin runs inside its own V8 isolate, powered by Cloudflare’s dynamic workers. Each plugin gets a sandboxed environment. It cannot access the database, the file system, or other plugins unless the capability manifest explicitly grants it.
A WordPress plugin calls global WPDBcodecodecodecodecode and has unrestricted access to every table. An EmDash plugin declares its permissions upfront: read contentcodecodecodecodecode, email sentcodecodecodecodecode. That’s it. The worker runtime enforces the boundary. The plugin can literally do nothing else.
Cloudflare published benchmarks showing dynamic workers start about 100 times faster than a traditional Docker container. A V8 isolate spins up in milliseconds, uses roughly 10 times less memory, and scales back to zero when traffic stops. For a CMS, this means plugins load instantly with no cold-start penalty.
The sandbox requires Cloudflare’s paid Workers plan — $5 a month. On the free tier, plugins run in-process without isolation. Self-host on a regular Node.js server and plugins also run without sandboxing. The feature that justifies EmDash’s existence requires a single-vendor runtime.
Security by Design, Not by Plugin
WordPress plugins have full database access because that’s how the architecture was designed in 2003. A contact form plugin with a bug can expose your entire user table. EmDash structurally prevents this.
Authentication is passkey-first using WebAuthn. No passwords to leak or brute-force. User management includes role-based access control — administrators, editors, authors, contributors — each scoped to specific actions.
Even themes are isolated. An EmDash theme is built with Astro components and CSS. It can never perform database operations. It’s strictly front-end, keeping core data completely safe. Themes can be sold with any license — MIT, GPL, closed-source — because they don’t share code with the core system.
The Ecosystem Problem
WordPress has 62,000 plugins. WooCommerce powers 35% of all e-commerce. Elementor runs on 10 million sites. Yoast SEO, another 10 million. The average WordPress site runs 12 to 15 plugins.
EmDash launched with zero third-party plugins.
History is brutal here. Ghost launched over a decade ago with better technology than WordPress. It has 0.1% market share. Craft CMS and Statamic are technically excellent, ecosystem-starved. As one Hacker News commenter put it: “People aren’t on WordPress because of WordPress. They’re on WordPress because of WooCommerce, a million themes, integrations for every stupid internal business API on the planet.”
EmDash’s migration tool imports content only: posts, pages, media. It does not migrate plugins, themes, custom functionality, WooCommerce stores, membership systems, forms, or SEO configuration. All of that must be rebuilt from scratch.
WordPress stores content as HTML. EmDash uses portable text — structured JSON. That’s not a simple database export. For any site with custom blocks or advanced layouts, migration is a serious engineering project.
The Cost and Lock-in Debate
A managed WordPress site on WP Engine costs about $525 the first year, climbing past $1,600 over three years. EmDash on Cloudflare’s paid plan: $75 a year. On the free tier, a small blog costs roughly $15 a year — just a domain.
But EmDash is serverless. Every page view, admin panel click, API call — that’s a Cloudflare Worker invocation. The paid plan includes 10 million requests. After that, you pay $0.30 per additional million requests plus CPU time charges. One page view can hit four or five different billing meters simultaneously: Workers, D1 database reads, R2 storage operations, KV lookups.
A critic on the Cloudflare forum calculated that a modest DDoS attack — 10,000 IPs, one request per second each — would rack up 26 billion billable requests in a month. There is no built-in spending cap. You can set CPU time limits per individual request and configure rate limiting through WAF rules, but there is no global request cap. A distributed bot attack from thousands of different IPs goes right through per-IP rate limiting.
The code is MIT licensed. But every EmDash site on Cloudflare uses at minimum five Cloudflare products: Workers for compute, D1 for database, R2 for media storage, KV for sessions, and Workers AI for moderation. Each is a separate billing line. None are portable. You can’t take a D1 database and move it to AWS. You can’t replicate the V8 isolate sandbox anywhere else.
WordPress runs on any server with PHP and MySQL. You can switch hosting providers in an afternoon. EmDash’s data is portable — D1 is SQLite, R2 is S3-compatible — but the security model isn’t. Open source, architecturally locked in.
Counter-Signal: Where EmDash Falls Short Today
EmDash is version 0.1.0. Built in about two months by one engineer with significant AI coding assistance. That transparency became a lightning rod. Reddit comments included “Was calling it SlopPress too on the nose?” The name itself — EmDash, the hallmark punctuation of AI-generated text — didn’t help.
Multiple beta testers ran into bugs immediately. Passkey authentication didn’t work on some Linux setups. The magic link fallback returned a page-not-found error. One reviewer found that editing a page in two browser tabs caused content to reset — losing work. That’s a dealbreaker for any content management system.
The multiplayer editing that modern CMS users expect — real-time collaboration, live preview — isn’t there. Sanity Studio has had that for years. EmDash’s editor is functional but basic. It’s a block editor reminiscent of Gutenberg but less polished.
And the billing model is a real barrier for the audience EmDash targets: bloggers, small publishers, people migrating from WordPress because they heard it’s insecure. These are not people who configure WAF rules and monitor Cloudflare dashboards daily. They want to publish content and not think about infrastructure. EmDash gives them the exact opposite.
What This Means for the Future of CMS
The dynamic worker technology behind EmDash’s plugin sandbox may outlive the CMS itself. Cloudflare’s Craig Dennis demonstrated building a secure chat agent where the LLM generates code, hands it to a dynamic worker for execution, and never touches the raw data. That pattern — isolate third-party code, scope its permissions, spin it up and down in milliseconds — is applicable far beyond content management. It’s a general solution for running untrusted code safely on the edge.
EmDash might not replace WordPress. But it forces the conversation. WordPress co-founder Matt Mullenweg reviewed EmDash and called its agent skills approach “amazing, a brilliant strategy. WordPress needs to do the same as soon as possible.” When the creator of the platform you’re trying to disrupt says that, something has shifted.
The real question isn’t whether EmDash wins. It’s whether every CMS will soon be expected to ship with agent-native interfaces, sandboxed plugin models, and serverless economics. EmDash is the first answer. It won’t be the last.
- What makes EmDash AI-native?EmDash includes a built-in MCP server for AI agents and uses portable text JSON for machine-readable content.
- How does the plugin sandbox work?Each plugin runs in a V8 isolate with declared permissions, enforced by Cloudflare's dynamic workers.
- What is the billing model for EmDash?The sandbox requires Cloudflare's paid Workers plan at $5 per month; free tier runs plugins without isolation.
/i.s3.glbimg.com/v1/AUTH_08fbf48bc0524877943fe86e43087e7a/internal_photos/bs/2026/q/p/xkrnfASUWa5SSkay0x6A/marvels-wolverine-20260907193401.jpg "Marvel’s Wolverine Best Techniques to Unlock First")
