Cloudflare launched EmDash on April 1, 2026 — and it wasn’t a joke. The company calls it the “spiritual successor” to WordPress. Built on TypeScript and Astro, it runs on V8 isolates at Cloudflare’s edge network. It’s open source under MIT. And it fundamentally rethinks how plugins work.
But does that make it a replacement for the CMS powering 43% of the web? Not yet. Here’s where EmDash genuinely outperforms WordPress — and where it still has a long way to go.
The plugin sandbox solves a problem that WordPress structurally cannot fix.
What EmDash Gets Right
1. Plugin Security Is Architectural, Not Optional
The headline feature. In WordPress, a plugin calls global wpdbcodecodecodecode and gets unrestricted access to every table in your database. That’s not a bug — it’s how the architecture was designed. 96% of all WordPress security vulnerabilities come from plugins. In 2025 alone, researchers disclosed 11,334 new WordPress vulnerabilities, a 42% increase from the year before.
EmDash fixes this at the runtime level. Every plugin runs inside its own V8 isolate via Cloudflare’s dynamic workers. It must declare exactly what it needs in a capability manifest. A plugin that declares read contentcodecodecodecode and send emailcodecodecodecode can literally do nothing else — no file system access, no database queries, no unrestricted network calls. The runtime physically blocks it.
One Hacker News commenter who worked with WordPress for a decade called the sandbox “genuinely smart.”
2. Serverless Pricing Means You Pay Only for What You Use
WordPress hosting charges a flat monthly rate — $20, $50, $100 — whether you get 10 visitors or 10 million. Your site might crash under load, but the bill stays the same.
EmDash flips that. It runs on Cloudflare Workers, which bill per request and per CPU millisecond. The paid plan starts at $5 a month and includes 10 million requests. After that, it’s $0.30 per additional million. R2 storage charges zero egress fees. A site getting 100,000 visits per day on the $5 plan uses roughly 3% of its monthly request allowance.
For a small blog, total infrastructure cost is about $15 a year — just a domain name. For a managed WordPress site on WP Engine, the first year costs around $525.
3. Modern Tech Stack — TypeScript, Astro, No PHP
WordPress was built in 2003 on PHP and MySQL. Running it today means managing PHP alongside JavaScript, configuring multiple caching layers for acceptable performance, and maintaining a monolithic server that’s always on.
EmDash is written entirely in TypeScript and powered by Astro. Themes use components, layouts, and CSS — familiar to any modern frontend developer. You can use Tailwind, scoped CSS, and standard build tools. Crucially, an EmDash theme can never perform database operations. It’s strictly frontend, keeping core data completely safe.
The lead engineer built most of EmDash in about 2 months with significant AI coding assistance. That timeline — a project that would have taken a full team several years — is itself a statement about the stack’s productivity.
4. AI-Native From Day One
Most CMS platforms bolt AI on as a plugin. EmDash builds it in. Every instance ships with a built-in MCP server (Model Context Protocol, the standard Anthropic created for AI agent communication).
Claude, Cursor, GitHub Copilot — any MCP-compatible agent can connect to your CMS and manage content directly. Upload media, search posts, create new content types, manage plugins. All through natural language, all with scoped permissions.
EmDash also ships agent skills files — structured documentation that tells AI agents exactly how to operate the CMS. No custom prompting needed. Joost de Valk, founder of Yoast SEO (used on 10 million WordPress sites), called this “the most interesting thing to happen to content management in years.” Matt Mullenweg, WordPress co-creator, said the agent skills approach is “amazing” and that WordPress “needs to do the same as soon as possible.”
5. Built-In Custom Content Types Without a Plugin
WordPress ships with two content types: posts and pages. For anything else — products, staff, offices — you need a plugin. Typically Advanced Custom Fields (ACF), which runs on millions of sites.
EmDash includes custom content types natively. You define fields, slugs, URL patterns, and SEO settings from the admin. No plugin required. Content types are flexible, searchable, and automatically included in sitemaps.
This one feature eliminates the most common plugin dependency on WordPress.
6. MIT License Removes the GPL Friction
WordPress is GPL licensed. That means any derivative work must carry the same license if distributed. For enterprises, the “viral” nature of GPL creates compliance overhead. Every WordPress plugin and theme must be GPL licensed because of how deeply they integrate with core.
EmDash is MIT licensed. The only requirement is attribution. Enterprises can use it without legal review cycles. Developers can sell plugins under any license they choose — closed source, MIT, or anything else. The lead engineer spent significant time with Cloudflare’s lawyers to ensure no reference to WordPress source code exists in the EmDash codebase.
7. Passkey Authentication — No Passwords to Leak
WordPress authentication relies on username and password. Brute-force attacks are a constant vector. EmDash uses passkey authentication via WebAuthn by default. No passwords to leak, no credential stuffing, no brute-force logins.
User management includes familiar role-based access control out of the box: administrators, editors, authors, and contributors. Each scope is strictly limited to the actions they need.
8. WordPress Import Tool
EmDash includes a migration tool that reads standard WordPress WXR export files. Posts, pages, media, custom post types — it maps them into EmDash’s structured content model. If your WordPress site uses Yoast, it reads those fields and maps them to EmDash’s built-in SEO fields.
You can also install an export plugin on your WordPress site and link them directly. The tool detected 468 posts, 12 pages, and 972 media items in one test within seconds.
Where EmDash Falls Short
1. Zero Plugin Ecosystem (Today)
WordPress has over 60,000 plugins. WooCommerce powers 35% of all e-commerce. Elementor runs on 10 million sites. The average WordPress site uses 12 to 15 plugins. That’s not just an ecosystem — it’s an entire economy of agencies, freelancers, and job postings.
EmDash launched with essentially zero third-party plugins. The counter-strategy is AI-assisted generation: the built-in MCP server lets coding agents generate plugins programmatically. But that’s a promise, not a marketplace. A business that needs e-commerce, SEO tools, and contact forms can install WordPress plugins in an afternoon. On EmDash, that’s weeks of custom development — assuming the functionality exists at all.
History is brutal here. Ghost launched over a decade ago with better technology than WordPress. It has 0.1% market share. Craft CMS and Statamic are technically excellent but ecosystem-starved.
2. The Core Feature Requires Cloudflare’s Paid Infrastructure
The plugin sandbox — EmDash’s defining feature — only works on Cloudflare’s dynamic workers. Those require the Workers Paid Plan at $5 a month. Deploy on the free tier and you get error code 10195.
Self-host on a regular Node.js server? No sandbox support at all. Plugins run in-process without isolation. The one feature that justifies EmDash’s existence disappears completely.
As one widely upvoted Hacker News comment put it: “Open source, but architecturally locked in.” WordPress runs on any server with PHP and MySQL. You can switch hosting providers in an afternoon. EmDash’s data is portable — D1 is SQLite, R2 is S3 compatible — but the security model isn’t.
3. Unpredictable Billing With No Spending Cap
Serverless pricing cuts both ways. A user on the Cloudflare forum calculated the math: 10,000 APIs making one request per second each would rack up 26 billable requests in a month. A basic DDoS attack from thousands of different IPs goes right through rate limiting — which is per-IP, not a global cap.
Cloudflare does not offer a spending limit or kill switch. Your site keeps running, workers keep firing, and your credit card keeps getting charged. One scenario estimated a potential $13,000 bill. Compare that to WordPress hosting: your site might crash under load, but your $20 flat rate stays the same.
For bloggers and small publishers — the exact audience EmDash targets — this is a real risk. They want to publish content, not monitor Cloudflare dashboards daily.
The Honest Bottom Line
EmDash is version 0.1.0 beta. Built in 2 months by a small team using AI agents. No plugin marketplace, no theme ecosystem, no hosting partners outside Cloudflare, no agency tooling. WordPress has 20-plus years of battle testing, millions of developers, and hosting support from every provider on the planet.
But architecture is not adoption. The plugin sandbox solves a problem that WordPress structurally cannot fix. The AI integration isn’t an afterthought — it’s built into the core. And the economics are compelling for anyone starting a greenfield content site.
If you’re building a new TypeScript project where security matters and you’re comfortable with the terminal, EmDash is worth a serious look. For everything else, WordPress still wins by default — not because it’s better, but because its ecosystem has no substitute yet.
Where this gets interesting is the 402 payment protocol EmDash supports — an open standard for charging AI agents or users on a per-use basis. That’s a monetization model that doesn’t exist in WordPress at all, and it could shift how content creators think about value on the web. Whether that matters depends on whether the ecosystem follows.
- What makes EmDash's plugin security different from WordPress?EmDash runs each plugin in its own V8 isolate via Cloudflare Workers, requiring a capability manifest that limits actions like read content or send email. The runtime physically blocks anything else.
- How does EmDash's pricing compare to WordPress hosting?EmDash charges per request and CPU millisecond, starting at $5 per month for 10 million requests. Managed WordPress hosting on WP Engine costs around $525 per year.
- What are EmDash's main weaknesses against WordPress?EmDash is still in beta with no plugin marketplace, no theme ecosystem, and no hosting partners outside Cloudflare. WordPress has 20 years of development and millions of developers.
