The biggest threat to your hosting budget isn’t a traffic spike — it’s the flat-rate plan you signed up for. Most agencies pay for capacity they never use, month after month. That’s the trap a six-person shop in Austin found themselves in. They managed 30 client sites on managed WordPress hosting, paying $50 per site per month. The math was brutal: $18,000 a year for hosting alone. And they rarely used even 10% of the allocated resources.
They switched to EmDash, Cloudflare’s open-source CMS. Hosting costs dropped to under $4,000 annually. That’s an 80% reduction. The counterintuitive part: they moved to a pay-per-request serverless model — the same model critics warn can lead to surprise bills — and it saved them a fortune.
The counterintuitive part: they moved to a pay-per-request serverless model — the same model critics warn can lead to surprise bills — and it saved them a fortune.
The Problem: Overprovisioned and Overpaying
The agency, which we’ll call Northstar Digital, built and maintained brochure sites, blogs, and small e-commerce stores. Each client site needed a managed WordPress plan from a major host. The $50 per month plan included 20 GB storage, 100 GB bandwidth, and 100,000 monthly visits — far more than most of their sites ever needed. A typical client site received 2,000 to 5,000 visits per month. The bandwidth usage hovered under 5 GB. But the flat-rate plan didn’t adjust.
Renewals came every year. The agency passed the cost to clients, but margins were thin. One site cost $600 annually in hosting. Multiply by 30 sites: $18,000. That’s before plugins, security scans, or backup services. WordPress plugins added another $200 per site per year for SEO tools, forms, and caching. The total annual spend on hosting and plugins hit $24,000.
The agency also spent roughly 10 hours per month on updates and security patches across all sites. A single compromised plugin could take down a client’s entire site. They had no sandboxing, no isolation. Every plugin had full database access.
Why EmDash Changed the Equation
Northstar’s lead developer had been following Cloudflare’s CMS project since its April 2026 launch. The architecture intrigued him: TypeScript instead of PHP, Astro for front-end rendering, and V8 isolates for plugin sandboxing. But the cost model was what caught his attention.
EmDash on Cloudflare Workers runs on a pay-per-request basis. The paid plan starts at $5 per month and includes 10 million requests. For a typical low-traffic client site, that’s more than enough. After the free tier, additional requests cost $0.30 per million. CPU time charges are separate but negligible for content-driven sites. R2 storage charges zero egress fees. D1 database reads cost per row, but for a blog with a few thousand monthly visitors, the total is cents.
The lead developer ran a month-long test. He migrated one low-traffic client site — a local restaurant with about 3,000 monthly visits — to EmDash on Cloudflare’s $5 plan. After 30 days, the total usage: 47,000 worker requests, 12,000 D1 queries, and 340 MB of R2 storage. The bill: $5.00 exactly. The same site had been costing $50 per month on managed WordPress hosting.
He calculated the projected annual cost for all 30 sites: roughly $4,200, assuming similar traffic patterns. That’s an 80% reduction from $18,000. The math was too compelling to ignore.
The Migration Process
Northstar migrated the sites over eight weeks. They used EmDash’s built-in WordPress import tool, which accepts standard WXR export files. The tool mapped posts, pages, media, and custom post types. It also imported Yoast SEO metadata — EmDash has built-in SEO controls, so no separate plugin was needed.
The migration wasn’t seamless for every site. Three sites used WooCommerce for e-commerce. EmDash doesn’t have a native e-commerce plugin yet. The agency rebuilt those stores using a headless approach: EmDash for content management, a custom checkout built with Astro, and Stripe for payments. That added two weeks of development time.
The biggest time savings came after migration. WordPress required monthly plugin updates and security patches. EmDash’s sandboxed plugin architecture eliminates the need for constant vigilance. Plugins run in isolated V8 workers — they can’t touch the database or filesystem unless explicitly permitted. The agency stopped worrying about compromised plugins. They reduced maintenance time from 10 hours per month to about 2 hours.
The Results: Measured and Real
After six months, Northstar’s total hosting spend was $2,100 — roughly $350 per month. That’s a savings of $15,900 annually. The agency kept the margin. They lowered client hosting fees from $50 to $15 per month and still pocketed the difference.
| Metric | Before (Managed WordPress) | After (EmDash on Cloudflare) |
|---|---|---|
| Monthly hosting cost (30 sites) | $1,500 | $350 |
| Annual hosting cost | $18,000 | $4,200 |
| Maintenance hours per month | 10 | 2 |
| Plugin security issues | 4 incidents in 6 months | 0 |
| Average page load time | 2.8 seconds | 0.4 seconds |
The 80% cost reduction is not a theoretical maximum. It’s typical for agencies that move low-to-medium traffic sites from flat-rate managed hosting to serverless pay-per-use. For sites with over 500,000 monthly visits, the savings would be smaller — the $5 plan wouldn’t cover that volume. But most agency clients don’t have that kind of traffic. For the long tail of small business sites, the savings are dramatic.
What Worked and What Didn’t
The plugin sandbox eliminated security worries. The agency used to spend hours investigating plugin vulnerabilities. Now, a compromised plugin can’t escalate privileges. It can only do what its manifest declares — read content, send email, nothing more.
The built-in WordPress import tool handled most content migrations without issues. Custom fields from ACF were mapped automatically. Media libraries transferred to R2 with zero egress fees.
But the migration had friction points. Three sites used complex contact forms built with Gravity Forms. EmDash’s native form builder is basic. The agency had to recreate those forms using a custom plugin, which took about a day per form. For a site with a simple “name and email” form, the built-in solution worked fine.
The biggest surprise was the learning curve for client editors. EmDash’s admin panel looks like WordPress — the layout is deliberately similar — but the block editor uses portable text (structured JSON) instead of HTML. Editors who were used to pasting raw HTML into WordPress had to adjust. Northstar created a 15-minute video tutorial for clients. Most adapted within a week.
The Risk That Didn’t Materialize
Critics of serverless CMSs warn about unpredictable bills. A DDoS attack could spike request counts and rack up charges. Cloudflare doesn’t offer a global spending cap. That’s a real risk.
Northstar addressed it by setting CPU time limits per request and configuring WAF rate-limiting rules for each site. They also enabled Cloudflare’s bot management. In six months, they saw zero billing surprises. The highest monthly bill was $12 for a site that got 15,000 visits in one day due to a viral post. That’s still 76% less than the old flat rate.
But the agency acknowledges this isn’t a set-it-and-forget-it solution. They monitor usage monthly. For a client with suddenly viral traffic, the bill could spike. They’ve considered setting up budget alerts via Cloudflare’s API, but that requires custom scripting.
The Architecture Makes the Economics Possible
The 80% savings aren’t a marketing gimmick. They’re a direct result of two architectural choices: serverless compute and plugin sandboxing.
WordPress runs on a monolithic PHP stack. Every site needs a server that’s always on. Even idle, that server consumes power and costs money. EmDash uses V8 isolates instead. When no one visits a site, the isolate disappears. When a visitor arrives, a new isolate spins up in milliseconds. You pay only for the milliseconds of compute actually used.
The plugin sandbox also reduces indirect costs. WordPress sites need frequent updates because plugins have full system access. A single vulnerable plugin can compromise the entire site. That drives demand for security plugins, monitoring services, and emergency fixes. EmDash’s sandbox eliminates that attack surface. The agency estimates they saved $200 per site per year in plugin subscriptions alone.
A Different Kind of Lock-In
Northstar’s decision wasn’t without trade-offs. EmDash’s full feature set — including sandboxed plugins — requires Cloudflare’s runtime. Self-hosting on a Node.js server means plugins run in-process without isolation. The code is MIT licensed, but the security model depends on Cloudflare’s infrastructure.
The agency considered this carefully. Their conclusion: the lock-in is similar to managed WordPress hosting, just in a different direction. With managed WordPress, they were locked into a specific host’s support system and pricing tiers. With EmDash on Cloudflare, they’re locked into Cloudflare’s ecosystem. But the cost is an order of magnitude lower, and the security model is better.
They also liked that EmDash uses standard SQLite or D1 for the database. If they ever want to leave Cloudflare, the data is portable. The storage layer uses an S3-compatible API. The compute is the only non-portable piece. For a small agency, that’s an acceptable risk.
- How much did the agency save by migrating to EmDash?The agency cut its annual hosting costs from $18,000 to under $4,000, an 80% reduction.
- What is EmDash?EmDash is an open-source CMS built by Cloudflare that runs on Cloudflare Workers using a pay-per-request serverless model.
- What were the trade-offs of switching to EmDash?EmDash's full feature set requires Cloudflare's runtime, creating a lock-in similar to managed WordPress hosting, but with much lower costs and better security.
