EmDash arrived on April 1, 2026, with a bold promise: a spiritual successor to WordPress that fixes plugin security. Version 0.1.0 beta. Three months of development. A lead engineer who built most of it with AI coding agents. The hype was instant. So were the mistakes.
The most common errors come from treating this EmDash CMS beta like a mature platform. The architecture is different. The billing is different. The plugin model is different. Here are six specific mistakes people make in their first week — and what to do instead.
EmDash is the most architecturally interesting challenger to WordPress in years.
Mistake 1: Deploying on the Free Tier and Expecting Sandbox Security
The headline feature of EmDash is sandboxed plugins. Every plugin runs in its own V8 isolate, declaring capabilities like read: contentcodecodecodecode and email: sendcodecodecodecode. It literally cannot do anything else.
But that sandbox requires Cloudflare’s dynamic workers. And dynamic workers require the Workers Paid plan, starting at $5 per month. Deploy on the free tier and you get error code 10195. Switch to a paid plan. Even on Cloudflare’s free tier, plugins run in “in-process” mode — no isolation, no sandbox.
The fix: Before you deploy, check your Cloudflare plan. If you need plugin sandboxing, budget for the $5/month Workers Paid plan. That $5 covers 10 million requests per month — enough for most small sites. After that, it’s $0.30 per additional million requests plus CPU time.
Mistake 2: Expecting a Drop-In WordPress Replacement
WordPress has 62,000 plugins. WooCommerce powers 35% of all e-commerce. Elementor runs on 10 million sites. Yoast SEO, another 10 million. The average WordPress site uses 12 to 15 plugins.
EmDash launched with zero third-party plugins. Zero. The forms plugin it ships with is reminiscent of form builders from 2002 — basic field types, no conditional logic, no multi-step. The content editor is sparse compared to Gutenberg. There is no page builder.
The fix: Treat EmDash as a greenfield project, not a migration. If your WordPress site depends on specific plugins — WooCommerce, MemberPress, LearnDash — EmDash cannot replace them today. Use the WordPress import tool to bring over posts, pages, and media. Plan to rebuild functionality with Astro components or custom code. The MIT license means you own what you build, but you are building from scratch.
Mistake 3: Ignoring the Serverless Billing Model Until the Bill Arrives
Traditional WordPress hosting charges a flat rate. $20 per month. $50 per month. $100 per month. Traffic spikes might slow your site or crash it, but your bill stays the same.
EmDash is serverless. Every page view, every admin panel click, every API call is a Cloudflare Workers invocation. Workers bill per request and per CPU millisecond. One page view can hit four or five billing meters simultaneously: Workers for compute, D1 for database reads, R2 for storage operations, KV for session lookups.
On the Cloudflare forum, someone calculated that a basic DDoS attack — 10,000 IPs, one request per second each — would rack up 26 billion requests in a month. There is no built-in spending cap. No kill switch. Cloudflare does not offer a global request cap.
The fix: Configure WAF rate limiting rules per IP range. Set CPU time limits per individual worker request. Monitor your Cloudflare dashboard daily during the first month. For a small blog on the $5 plan, 100,000 visits per day uses roughly 3% of the monthly request allowance — but that assumes no bot traffic.
Mistake 4: Creating Custom Content Types Through the Admin UI — and Losing Them
EmDash includes native custom content types — a feature WordPress lacks without plugins like Advanced Custom Fields. In the admin panel, under Content Types, you can create new types: Projects, Team Members, Offices. You add fields, set slugs, configure URL patterns. It works. It feels powerful.
But those content types are stored in the database, not in code. There is no configuration file, no schema-as-code approach. If you rebuild your instance, migrate environments, or restore from backup, those content types exist only as long as the database contains them. They are not version-controlled. They are not deployable.
The fix: For production sites, define content types programmatically. EmDash does not yet support schema-as-code in its configuration, but treat the admin UI as a prototyping tool only. Document every content type you create, including field names, types, and relationships. Before you deploy to production, verify that your database backup strategy captures these definitions. This is a v0.1.0 limitation — expect it to change, but do not rely on the UI for production schema management.
Mistake 5: Self-Hosting and Losing the Only Differentiator
EmDash runs on any Node.js server. You can deploy it to your own hardware, AWS, or any VPS. The code is MIT licensed. It will run.
But when you self-host, there is no support for sandboxed plugins. The dynamic workers that power plugin isolation are a Cloudflare Workers feature. On a standard Node.js server, plugins run in-process — the same model as WordPress, with the same security risks. You are running a brand-new CMS with zero plugins and no security advantage over WordPress at all.
The fix: Self-host only for development, staging, or experimentation. For production, deploy to Cloudflare’s runtime to get the features that justify the switch. If vendor lock-in concerns you — and it should — evaluate EmDash’s portability layer. D1 is SQLite-compatible. R2 is S3-compatible. The data is portable. The security model is not. Make that trade-off consciously.
Mistake 6: Assuming Passkey Authentication Works Everywhere
EmDash ships with passkey-based authentication by default. No passwords to leak. No brute-force vectors. It uses WebAuthn, and the setup wizard prompts you to create a passkey on first login.
One early tester on Linux reported that passkey authentication did not work on their setup. The magic link fallback returned a “page not found” error. They were locked out of their own installation. For an agency managing 50 to 100 client sites, passkeys bound to a single browser or device create a management nightmare.
The fix: Test passkey authentication on your development OS before committing. Keep the magic link fallback working — test it. EmDash supports email-based login as a fallback, but verify that flow works on your deployment. If you manage multiple sites, consider a password manager that handles passkeys consistently across installations.
What experienced practitioners notice that beginners miss: EmDash’s content types are database-bound, not code-defined. In any mature CMS workflow, schema belongs in version control alongside your theme and plugins. Click-ops content types are a regression, not a feature. Until EmDash adds infrastructure-as-code support for content models, treat the admin UI as temporary. Export your schema definitions. Document them. Do not let your content architecture live only in a SQLite file on Cloudflare’s D1.
EmDash is the most architecturally interesting challenger to WordPress in years. The plugin sandbox solves a real problem. The economics are compelling. But it is v0.1.0 beta with 89 commits and a three-month development cycle. The mistakes above come from treating it like a mature platform. Use it like what it is: a promising foundation that needs careful handling.
- What is the most common mistake new EmDash users make?Deploying on the free tier expecting sandbox security, which requires the Workers Paid plan at $5 per month.
- Can EmDash replace WordPress plugins like WooCommerce?No, EmDash launched with zero third-party plugins, so it cannot replace WordPress plugins like WooCommerce or Elementor.
- How does EmDash billing differ from traditional hosting?EmDash uses serverless billing where every page view and API call incurs costs, unlike flat-rate WordPress hosting.
