Three CMSs. Three different philosophies. And one newcomer that claims to fix the biggest problem in web publishing: plugin security.
WordPress powers 43% of the internet. Contentful pioneered the headless approach. And EmDash CMS, from Cloudflare, launched in April 2025 as a v0.1.0 beta — calling itself the “spiritual successor to WordPress.”
A compromised plugin cannot pivot to steal password hashes or crypto-mine. It physically cannot.
My position: for most new content-driven websites in 2025, EmDash offers the best balance of security, modern tooling, and cost — provided you don’t need a massive plugin ecosystem today. The strongest counterargument is that ecosystem gap. I’ll address it head-on.
Let’s break down how these three platforms compare across the dimensions that actually matter.
Quick Comparison: EmDash vs Contentful vs WordPress
| Feature | EmDash | Contentful | WordPress |
|---|---|---|---|
| Architecture | Full-stack (frontend + backend), serverless on Cloudflare Workers | Headless (API-only), bring your own frontend | Monolithic (PHP + MySQL), can be headless with plugins |
| Security Model | Plugins run in V8 isolates with capability manifests; no direct database access | No plugin execution; security depends on your frontend implementation | Plugins have full access to database, file system, and network; 96% of vulnerabilities come from plugins |
| Ecosystem Size | Zero third-party plugins at launch; 3 starter templates | Large marketplace of integrations and apps | 60,000+ plugins, 10,000+ themes |
| Cost Model | Serverless: $5/month for sandbox plugins, pay per request after 10M; free tier available | Free tier (limited), paid plans start at $300/month for teams | Hosting $5–$100/month; premium plugins $50–$500/year |
| AI-Readiness | Built-in MCP server, agent skills, CLI; designed for AI agents from day one | API-first, can integrate AI via webhooks or custom apps | AI plugins exist but retrofitted; no native MCP support |
| Learning Curve | Familiar WordPress-like admin; requires TypeScript and terminal for setup | Steep: must learn content modeling, API usage, and frontend framework | Low for basic use; high for custom development without page builders |
The Security Argument: Why EmDash Wins by Design
WordPress’s biggest strength is also its biggest vulnerability. Every plugin runs in the same process as the core. Install a contact form plugin with a bug, and an attacker can read your entire database. In 2025 alone, researchers disclosed over 11,000 new WordPress vulnerabilities — 91% from plugins.
Contentful avoids this by being headless. You never install plugins that touch your backend. But that means you’re responsible for building and securing your frontend, deploying it, and maintaining that pipeline. For a small blog, that’s overkill.
EmDash takes a different approach. Each plugin runs inside its own V8 isolate, powered by Cloudflare’s dynamic workers. The plugin declares exactly what it needs in a capability manifest. Read content? Send email? That’s all it can do. No file system access, no database queries, no unrestricted network calls. The runtime enforces the boundary at the hardware level.
This isn’t just policy — it’s architectural enforcement. A compromised plugin cannot pivot to steal password hashes or crypto-mine. It physically cannot.
Ecosystem: The Elephant in the Room
Here’s the counterargument: EmDash launched with zero third-party plugins. WordPress has 60,000. Contentful has hundreds of integrations. How can EmDash compete?
It can’t — not yet. But that doesn’t mean it’s a non-starter.
First, EmDash ships with many features that WordPress requires plugins for: SEO, forms, custom content types, redirects, comments with AI moderation. The average WordPress site runs 12–15 plugins. A new EmDash site might need one or two.
Second, the migration tool works. You can import your entire WordPress site — posts, pages, media — via a WXR file or a dedicated export plugin. For themes and plugins, the built-in MCP server lets AI coding agents generate Astro-compatible templates and sandboxed plugins from your existing code. The MIT license removes the GPL friction that kept commercial developers away from WordPress.
Third, the plugin review queue in WordPress is 800 plugins long and takes weeks to traverse. EmDash’s sandbox model means plugins don’t need centralized approval — they declare capabilities, and the runtime enforces them. That shifts trust from reputation to architecture.
The ecosystem will take time. But the architecture accelerates it.
Cost: Predictable vs Pay-As-You-Go
WordPress hosting is predictable — $20 a month, same bill whether you get 100 visitors or 10,000. But that predictability hides costs: premium plugins, page builders, security subscriptions. A managed WordPress site on WP Engine costs about $525 the first year.
Contentful’s free tier is generous for small projects, but team plans start at $300/month. Traffic spikes can push you into expensive tiers.
EmDash flips the model. It’s serverless. The paid plan starts at $5/month and includes 10 million requests. After that, $0.30 per million requests plus CPU time. R2 storage has zero egress fees. A site with 100,000 visits per day uses about 3% of its monthly request allowance.
The real risk? No spending cap. A DDoS attack could rack up charges. Cloudflare offers rate limiting and CPU time limits, but no global kill switch. For a small business, that’s a legitimate concern — though still cheaper than a crashed WordPress site losing sales for a week.
Developer Experience: Modern vs Legacy
WordPress development means PHP, FTP, and a database you maintain. Modern workflows exist (Local, WP-CLI, Roots), but the core remains a 24-year-old monolith.
Contentful gives you a clean API and lets you use any frontend framework. But you’re now managing two deployments: the CMS and the frontend. That’s complexity.
EmDash is built on Astro, TypeScript, and Node.js. The admin is familiar to WordPress users — same sidebar, same post editor feel. But everything is code-defined. Content types are configured in the database (for now), but the Astro config file handles database, storage, and plugins. CLI commands let you scaffold projects, themes, and plugins. An MCP server lets Claude, Copilot, or any compatible agent manage content programmatically.
If you’re comfortable with a terminal, EmDash is faster to set up than either alternative.
AI-Native: The Future-Proof Advantage
WordPress is retrofitting AI through plugins. Contentful offers APIs that AI tools can consume. EmDash was built for AI from day one.
Every instance ships with agent skills files — structured documentation that tells AI agents exactly how to operate the CMS. The built-in MCP server means you can say “find all posts mentioning ‘widget’ and update them to ‘component'” and an agent does it. No custom prompting.
The plugin sandbox also matters here. When an AI agent generates code, you don’t want it running with full privileges. Dynamic workers let you execute AI-generated plugins in isolated environments — the agent writes the code, the worker runs it with scoped permissions, and your core stays safe.
Who Should Use What?
Stick with WordPress if you need WooCommerce, a specific premium plugin like Elementor or Yoast, or an ecosystem of freelancers and agencies. The 60,000 plugins are not going anywhere.
Choose Contentful if you’re building a multi-channel experience — mobile app, website, IoT — and need a headless content hub with a strong API. Be prepared for the cost and complexity.
Try EmDash for a new content blog, a marketing site, or a portfolio. The security model is superior, the cost is lower, and the AI integration is years ahead. If you’re a developer comfortable with TypeScript and want to future-proof your stack, EmDash is worth a serious look.
The ecosystem argument will fade. The architecture will not.
- What is the main security advantage of EmDash CMS over WordPress?EmDash runs each plugin in its own V8 isolate with a capability manifest, so a compromised plugin cannot access the database or file system.
- When should you choose Contentful over EmDash or WordPress?Choose Contentful if you need a headless content hub for multi-channel experiences like mobile apps, websites, and IoT.
- What is the biggest drawback of EmDash CMS at launch?EmDash launched with zero third-party plugins, so its ecosystem is much smaller than WordPress's 60,000 plugins.
