The documentation team at OpenAPI-Tools (a fictional open-source project for API testing) had a familiar problem. Their WordPress site, which hosted 1,200+ technical articles, took 4.2 seconds to load on a good day. On bad days, it crashed under traffic spikes from Hacker News. They spent $240 a month on managed WordPress hosting with caching plugins, and security patches arrived weekly.
They migrated to EmDash CMS in April 2026. Their page load time dropped to 380 milliseconds. Their hosting bill fell to $15 a month. Their plugin count went from 14 to zero.
Their page load time dropped to 380 milliseconds.
Here is exactly how they did it — and what they learned.
The Problem: WordPress Couldn’t Scale Their Content
OpenAPI-Tools published documentation for a developer tool. Their audience expected speed. WordPress delivered the opposite.
The site ran 14 plugins to handle SEO, caching, code syntax highlighting, search, redirects, and contact forms. Each plugin was a PHP script with full database access. In 2025 alone, they patched three plugin vulnerabilities — one in a syntax highlighter that could have exposed user session data.
The hosting bill told its own story. Managed WordPress hosting on WP Engine cost $240 a month. Even then, the site hit CPU limits during traffic spikes. A post about a new API feature went viral. The site returned 503 errors for 45 minutes.
The development team spent 8-10 hours per month on maintenance: plugin updates, cache clearing, PHP version compatibility checks. That was time they wanted to spend on documentation.
The Approach: Migrating to EmDash on Cloudflare Workers
The team evaluated alternatives. Ghost was fast but lacked custom content types. Sanity required a separate frontend build. Headless WordPress meant keeping PHP complexity.
EmDash was different. It ran on Cloudflare Workers — serverless V8 isolates that scale to zero and back. The admin interface looked familiar. The import tool could pull WordPress content in minutes.
The migration took three days
Day one: They spun up the EmDash playground at emdashcms.com to test the admin. The dashboard loaded in under a second. They created custom content types for code snippets and API reference docs — features that required plugins in WordPress.
Day two: They ran the WordPress export tool. EmDash’s import function read their WXR file and mapped posts, pages, media, and Yoast SEO fields to EmDash’s built-in SEO fields. The migrator handled 1,200 posts in 4 minutes.
Day three: They ported their custom theme. EmDash themes use Astro components. The team fed their WordPress theme files to an AI coding agent via EmDash’s built-in MCP server. The agent generated Astro-compatible templates in under an hour. They adjusted the CSS for dark mode support — two hours of manual work.
What they kept from WordPress
The core features that made WordPress productive remained. EmDash includes SEO controls, custom content types, user roles (admin, editor, author, contributor), and a block editor out of the box. The team did not need a single plugin.
The Results: 90% Faster, 94% Cheaper
The numbers tell a clear story.
Page load time: WordPress served pages in 4.2 seconds (with caching). EmDash served them in 380 milliseconds — measured from a test location in Sydney, Australia. The difference came from Cloudflare’s global edge network. WordPress ran on a single server in Virginia. EmDash ran across 330+ data centers.
Hosting cost: The WordPress bill was $240/month. EmDash on Cloudflare’s $5 paid plan covered the site’s 8,000 daily visits. R2 storage for media cost $0.50/month with zero egress fees. Total: $15/month.
Maintenance time: Plugin updates and security patches consumed 10 hours per month. EmDash has no plugins to update. Core updates happen at the infrastructure level. Maintenance dropped to zero hours.
Security surface area: The WordPress site had 14 plugins, each with full database access. EmDash plugins run in sandboxed V8 isolates. They declare capabilities in a manifest — read content, send email — and can do nothing else. The team runs zero third-party plugins.
What Broke and What Didn’t
Not everything went smoothly.
The passkey issue: EmDash uses WebAuthn passkeys for authentication. The team’s Linux CI server could not create passkeys. The magic link fallback returned a 404 error on the first attempt. They worked around it by keeping one admin session active. Cloudflare has since patched the bug.
The form builder: EmDash ships with a basic form plugin. It supports name, email, and message fields. The team needed a multi-step form for documentation feedback requests. They built it as a sandboxed plugin in two hours. The plugin declares read content and send email capabilities. It cannot touch the database.
The widget system: EmDash includes widgets and sections — similar to WordPress’s widget areas. The team found the drag-and-drop interface functional but dated. They replaced it with custom Astro components for the header and footer, which performed better and required no admin configuration.
The Plugin Paradox — Solved
WordPress’s biggest strength became its biggest liability. Plugins made the platform extensible. They also made it vulnerable. 96% of WordPress security issues come from plugins — not from core.
EmDash solves this architecturally. Every plugin runs in a dynamic worker — a lightweight V8 isolate that spins up in milliseconds, executes the code, and disappears. The plugin cannot access the database, file system, or other plugins unless the manifest grants it.
For OpenAPI-Tools, this meant their custom syntax highlighter plugin could read post content but could not execute SQL queries, modify user data, or phone home to an external server. The team stopped worrying about plugin vulnerabilities entirely.
Who Should Not Switch Yet
The migration worked for a documentation site with standard content types. It would not work for every WordPress use case.
E-commerce: WooCommerce powers 35% of all online stores. EmDash has no e-commerce plugin. A store migration would require building payment, inventory, and shipping systems from scratch.
Page builders: Sites built with Elementor or Divi cannot export their layouts. The WordPress migration tool imports content only — posts, pages, media. Custom page structures must be rebuilt in Astro.
Plugin-dependent businesses: If your revenue depends on a specific WordPress plugin (a membership system, a learning management system, a booking calendar), EmDash cannot replace it today. The plugin ecosystem is zero.
The Edge Case Nobody Talks About
Here is the nuance that most coverage misses. EmDash’s sandboxed plugin model works — but only on Cloudflare’s paid runtime. Self-host on a regular Node.js server, and plugins run in-process with no isolation.
The team at OpenAPI-Tools pays $5 a month for Cloudflare’s Workers Paid plan. That gives them dynamic workers, the sandbox, and the V8 isolate architecture. If they ever want to self-host, they lose the security model that justified the migration.
WordPress runs on any server with PHP and MySQL. You can switch hosts in an afternoon. EmDash’s data is portable (D1 uses SQLite, R2 is S3-compatible), but the security model is not. The code is MIT-licensed. The runtime that makes the code secure is proprietary Cloudflare infrastructure.
For a documentation site that needs speed and security, that trade-off made sense. For a business that needs hosting flexibility, it may not.
- What problem did the OpenAPI-Tools team face with WordPress?Their WordPress site took 4.2 seconds to load, crashed under traffic spikes, and required $240 monthly hosting with 14 plugins.
- How long did the migration to EmDash CMS take?The migration took three days: one day for testing, one day for importing 1,200 posts, and one day for porting the custom theme.
- What is the key trade-off of using EmDash CMS?EmDash's security model relies on Cloudflare's paid runtime; self-hosting on a regular Node.js server loses the sandboxed plugin isolation.
