8 EmDash Plugins That Fix What WordPress Broke

The most surprising thing about EmDash’s plugin ecosystem? It barely exists — and that’s exactly why it’s already better than WordPress.

WordPress has 60,000 plugins, but 96% of its security vulnerabilities come from them. Every plugin runs with full database access, no sandbox, no permission system. EmDash launched with zero third-party plugins, but the ones the community is building on GitHub right now are architecturally impossible to exploit the same way. The sandbox model changes everything: plugins declare capabilities, run in isolated V8 isolates, and physically cannot touch your database unless you grant explicit permission.

The ecosystem is small now, but the architecture is right. That's more than WordPress can say after 24 years.

Here are eight community-built plugins already available on GitHub that demonstrate why this approach matters — and why early adopters are already shipping features that WordPress plugin developers can only dream of.

1. Gutenberg Block Editor Port

A product manager from Pantheon open-sourced a PR that ports the Gutenberg block editor into EmDash. It’s not a merge candidate for the core project, but it proves something important: because EmDash uses structured JSON (portable text) instead of HTML, the editor can be swapped, extended, or replaced without touching content storage. WordPress sites that rely on Gutenberg blocks can now migrate their content structure, not just their posts.

2. Sandboxed Contact Form With Turnstile

EmDash ships with a basic form plugin, but the community already built one that runs entirely inside a dynamic worker. The plugin declares capabilities: read: contentcodecodecodecode, write: submissionscodecodecodecode, network: turnstile.cloudflare.comcodecodecodecode. That’s it. If a compromised update tries to exfiltrate your user database, the runtime blocks it at the hardware level. No WordPress contact form plugin can make that guarantee.

AI Agent Skills: The Gap Between Theory and Practice

How to Customize the EmDash Admin Dashboard for Your Brand

Lemmo 3 gets semi-solid-state battery and radar safety system

3. SEO Meta Manager With Agent Skills

This plugin doesn’t just add meta fields — it ships an MCP server that lets AI agents scan your content, suggest titles, and update schema markup programmatically. The plugin’s capability manifest restricts it to read: contentcodecodecodecode and write: seo_fieldscodecodecodecode. It cannot touch your database or user data. The founder of Yoast SEO called EmDash’s agent approach “brilliant” and said WordPress needs to copy it immediately.

4. Auto-Image Optimizer Using R2

Media storage is one of EmDash’s core advantages: R2 charges zero egress fees, and images are stored as blobs, not files on a local filesystem. This community plugin hooks into the afterUploadcodecodecodecode event, runs WebP conversion in a sandboxed worker, and stores optimized versions in separate R2 buckets. The plugin cannot read your original files — it only receives the uploaded image buffer and returns the processed version.

5. Custom Content Type Builder (Code-First)

WordPress requires ACF or JetEngine for custom post types. EmDash already has content types built into the admin UI, but this plugin lets you define them in TypeScript and deploy them as code. Your schema lives in your repository, not in the database. When you push to production, the plugin reads the definition and creates the fields automatically. No click-ops, no database drift, no migrations.

6. Scheduled Post Queue With Webhooks

A plugin that triggers webhook calls when posts are published, updated, or deleted. In WordPress, this kind of plugin is a common attack vector — a compromised webhook plugin can create admin users. In EmDash, the plugin declares network: webhook.example.comcodecodecodecode and read: contentcodecodecodecode. Even if the plugin is fully compromised, it cannot modify your database or create users. The webhook payload is scoped to the post data only.

7. Analytics Dashboard Using Workers Analytics

Instead of injecting JavaScript into your frontend, this plugin processes server-side analytics using Cloudflare Workers Analytics. It runs as a sandboxed plugin that listens to page-view events and aggregates data without ever exposing user IPs or browser fingerprints. The plugin cannot access your database — it only receives anonymized request metadata from the worker runtime.

8. AI Migration Agent (The One Beginners Overlook)

This isn’t a traditional plugin — it’s an MCP server that connects Claude or Cursor to your EmDash instance. You tell the agent “migrate my old WordPress theme,” and it reads the theme files, generates Astro-compatible templates, and deploys them. The agent never touches your live site. It works through the plugin’s sandbox, which declares write: themescodecodecodecode and read: contentcodecodecodecode. Experienced developers know this is the real unlock: EmDash isn’t just a CMS, it’s a platform designed for AI to build on top of it. Beginners focus on the admin dashboard; veterans focus on the agent protocols.

These eight plugins represent the first wave of community development. None of them existed on launch day. All of them are safer than their WordPress equivalents because safety is built into the runtime, not bolted on afterward. The ecosystem is small now, but the architecture is right. That’s more than WordPress can say after 24 years.