You’ve read the headlines. Plugins run in isolated V8 isolates. No more WPDBcodecodecodecode-level access. Security solved. But the cost model behind that sandbox is the part nobody is talking about on launch day.
The $5/month paid plan is the entry fee. The real expense lives in the metering.
The site stays online, the workers keep firing, and the meter keeps running.
Every Plugin Invocation Is a Billable Event
WordPress plugins run in the same PHP process. One server, one bill. EmDash flips that: each plugin hook triggers a separate Dynamic Worker invocation. That worker spins up, executes, and spins down. You pay per request and per CPU millisecond.
A single page load that fires three hooks—say, a content filter, an email notification, and a logging routine—generates three separate Worker invocations. Plus the base page render itself. That’s four billable events for one visitor.
Now add D1 database reads. Each plugin that queries content triggers a row-read charge. R2 storage operations for media. KV lookups for plugin state. A single user action can hit five different Cloudflare billing meters simultaneously.
The free tier includes 10 million Worker requests. That sounds generous until you run a site with a contact form, an analytics tracker, and a caching plugin. A modest blog with 50,000 page views per month and three active plugins easily burns 200,000+ Worker invocations. On the paid plan, after the included 10 million, you pay $0.30 per additional million requests plus CPU time. That’s negligible for low traffic. But it scales linearly with every spike.
The $5 Floor, the $13,000 Ceiling
A forum post that surfaced shortly after launch calculated the worst case: a basic DDoS attack using 10,000 distinct IPs, each making one request per second, could rack up 26 billion requests in a month. At $0.30 per million after the free allowance, that’s roughly $7,800 in Worker charges alone. Add D1 and R2 operations, and the total crosses $13,000.
Cloudflare offers no global spending cap. You can set CPU time limits per request and rate-limiting rules per IP, but a distributed bot attack bypasses IP-based caps trivially. The site stays online, the workers keep firing, and the meter keeps running.
Compare that to a $20/month shared WordPress host. Under the same attack, your site crashes. Your bill doesn’t change. That’s not a bug—it’s a fundamental difference in risk profile.
Self-Hosting Kills the Feature That Justifies the Cost
If you self-host EmDash on a Node.js server to avoid Cloudflare’s variable billing, you lose the plugin sandbox entirely. Plugins run in-process, with no isolation. The security advantage evaporates. You’re left with a brand-new CMS that has zero plugin ecosystem and no security edge over WordPress.
So the architecture forces you onto Cloudflare’s runtime. The code is MIT-licensed, but the sandbox is proprietary infrastructure. Vendor lock-in by design.
The 402 Twist: Per-Use Plugin Pricing
EmDash includes a built-in 402 payment protocol. Plugin authors can charge per invocation instead of per download or per subscription. A plugin that sends transactional emails could bill $0.001 per email. A form plugin could charge per submission.
For a small blog, that’s pennies. For a high-traffic ecommerce site with thousands of orders a day, the cost compounds fast. And it’s unpredictable—you don’t know which plugins will spike in usage until they do.
This is a paradigm shift from WordPress, where you pay a flat fee for a plugin license regardless of usage. EmDash’s model rewards low-traffic sites and punishes successful ones.
What the Practitioner Needs to Watch
- Map your plugin cascades: Every hook that triggers a Dynamic Worker is a cost line. Audit how many plugins fire per page load.
- Understand the free tier math: 10 million requests is about 330,000 per day. A busy site with 10 plugins could hit that in a week.
- No spending cap means you need external monitoring. Cloudflare’s dashboards show usage but won’t stop billing.
- The 402 protocol will shift plugin economics. Factor per-use costs into your budget, not just flat subscription costs.
EmDash’s pricing model isn’t better or worse than WordPress—it’s a different kind of risk. Predictable if you control your plugin surface. Catastrophic if you don’t.
FAQ
Q: Can I set a hard monthly spending limit on EmDash plugin costs?
A: No. Cloudflare does not offer a global spending cap. You can set per-request CPU limits and WAF rate rules, but a distributed attack or unexpected traffic spike will still generate billable requests.
Q: If I self-host EmDash, do I avoid all these costs?
A: Yes, but you also lose the plugin sandbox. Self-hosted EmDash runs plugins in-process with no isolation, defeating the primary security advantage. You also lose Cloudflare’s edge infrastructure for performance.
Q: How does the 402 payment protocol affect plugin pricing?
A: Plugin authors can set per-invocation fees. For example, a form plugin might charge $0.01 per submission. You pay only when the plugin runs, not a flat license fee. This can be cheaper for low-traffic sites but expensive for high-volume ones.
Can I set a hard monthly spending limit on EmDash plugin costs?
No. Cloudflare does not offer a global spending cap. You can set per-request CPU limits and WAF rate rules, but a distributed attack or unexpected traffic spike will still generate billable requests.
If I self-host EmDash, do I avoid all these costs?
Yes, but you also lose the plugin sandbox. Self-hosted EmDash runs plugins in-process with no isolation, defeating the primary security advantage. You also lose Cloudflare’s edge infrastructure for performance.
How does the 402 payment protocol affect plugin pricing?
Plugin authors can set per-invocation fees. For example, a form plugin might charge $0.01 per submission. You pay only when the plugin runs, not a flat license fee. This can be cheaper for low-traffic sites but expensive for high-volume ones.
- Can I set a hard monthly spending limit on EmDash plugin costs?No. Cloudflare does not offer a global spending cap. You can set per-request CPU limits and WAF rate rules, but a distributed attack or unexpected traffic spike will still generate billable requests.
- If I self-host EmDash, do I avoid all these costs?Yes, but you also lose the plugin sandbox. Self-hosted EmDash runs plugins in-process with no isolation, defeating the primary security advantage. You also lose Cloudflare's edge infrastructure for performance.
- How does the 402 payment protocol affect plugin pricing?Plugin authors can set per-invocation fees. For example, a form plugin might charge $0.01 per submission. You pay only when the plugin runs, not a flat license fee. This can be cheaper for low-traffic sites but expensive for high-volume ones.
