Cloudflare launched EmDash with two paths: a free self-hosted version and a $5/month paid plan. Most coverage skips what that $5 actually buys. The answer is uncomfortable. The free tier doesn’t include the one architectural breakthrough that makes EmDash worth considering. Without the paid plan, you’re running a beta CMS with zero security advantage over WordPress.
EmDash’s free tier gives you a self-hosted Node.js CMS with SQLite, basic content management, and a front-end editor. The $5/month paid plan adds Cloudflare Workers deployment, D1 database, R2 storage, and—most critically—dynamic workers for sandboxed plugin execution. Without the paid plan, plugins run in-process with no isolation, eliminating the security edge over WordPress.
The feature that makes EmDash different simply disappears.
| Feature | Free Tier (Self-Hosted) | Paid Plan ($5/month) |
|---|---|---|
| Deployment | Local Node.js server or any host | Cloudflare Workers (global edge, 300+ data centers) |
| Plugin execution | In-process, no sandbox | Dynamic workers with V8 isolate sandbox |
| Database | SQLite (local file) | D1 (Cloudflare’s serverless SQLite) |
| Media storage | Local filesystem | R2 (zero egress, S3-compatible) |
| Authentication | Password or passkey | Passkey + WebAuthn (same) |
| Plugin security isolation | None | Full capability-based manifest |
| Scalability | Single server limit | Auto-scales to zero and back in milliseconds |
| Cost model | Fixed hardware cost | Pay-per-request + $5 base (no spending cap) |
| Vendor dependency | None (portable code) | Requires Cloudflare infrastructure for key features |
The One Feature That Justifies $5
EmDash’s entire pitch is plugin security. WordPress suffers because every plugin gets full database and file system access. EmDash fixes that with sandboxed plugins running in Cloudflare’s dynamic workers. Each plugin declares exactly what it needs—read content, send email—and the runtime enforces that boundary. A compromised plugin cannot read your password hashes, cannot modify your database, cannot phone home.
That sandbox requires dynamic workers. Dynamic workers require Cloudflare’s Workers paid plan. Free tier? Error code 10195. You cannot deploy sandboxed plugins on a free Cloudflare account. Self-hosted on Node.js? Plugins run in-process with zero isolation. The feature that makes EmDash different simply disappears.
Example: a contact form plugin on the free tier can access your entire database. Same plugin on the paid plan only gets the permissions you grant in its manifest. That’s not a minor upgrade. It’s the difference between “another CMS” and “a genuine security improvement.”
What the Free Tier Actually Does
You can still build a site on the free tier. Create posts and pages. Define custom content types. Use the built-in SEO fields. Import a WordPress WXR file. Edit content with the front-end editor. The core CMS functions work.
But here’s the catch: any plugin you install has unrestricted access. And EmDash launched with zero third-party plugins. So you’re building from scratch. If you don’t need plugins—if your site is a simple blog with no forms, no e-commerce, no membership system—the free tier works. But why choose EmDash over Ghost, Astro, or a static site generator? The free tier gives you nothing those tools don’t already offer, with a smaller ecosystem.
The Hidden Cost of Free (and Paid)
The free tier’s cost is predictable: your own server bill. The paid plan flips that. $5/month gets you 10 million Workers requests. After that, $0.30 per additional million. Plus D1 reads, R2 operations, KV lookups. A single page view can hit four billing meters.
Someone on the Cloudflare forum calculated that a basic DDoS attack—10,000 IPs, one request per second each—could rack up $13,000 in a month. No spending cap exists. No kill switch. Your site keeps running, your card keeps charging.
That’s the real trade. Free tier: predictable cost, limited scale, no security. Paid plan: security and scale, but unpredictable billing with no ceiling.
Counterargument and Dismantle
“For a simple blog with no plugins, the free tier is sufficient. Why pay $5?”
If you don’t need plugins, you don’t need EmDash at all. You could use a static site generator, Ghost, or even WordPress on cheap shared hosting. The entire reason to choose EmDash over alternatives is the plugin sandbox—the architecture that prevents 96% of WordPress security vulnerabilities. Without it, you’re using a v0.1 beta CMS with zero ecosystem, no theme marketplace, and no community. The $5 is not a fee. It’s the activation cost for the product’s core value proposition. If you’re not paying for the sandbox, you’re not using EmDash—you’re testing a tech demo.
Who Should Pay and Who Should Skip
Pay the $5 if you plan to use plugins or want the security model. That means agencies building client sites, developers who need custom functionality, or anyone migrating from WordPress who intends to replicate their plugin stack. The sandbox is non-negotiable for production use.
Skip the paid plan if you’re experimenting, building a personal blog with no extensions, or evaluating the codebase. The free tier is adequate for learning. Just don’t mistake it for a production-ready CMS.
The Bottom Line
EmDash’s free tier is a demo. The $5 plan is the real product. Cloudflare knows this—they’ve open-sourced the code but locked the differentiating feature behind their proprietary runtime. The code is MIT. The engine is not. That’s not dishonest. It’s a business model. But it means the free tier is effectively a loss leader, not a viable alternative.
If you’re serious about EmDash, budget $5 and accept the billing risk. If you’re not ready for that, stick with WordPress. The free tier will only frustrate you when you realize what’s missing.
One final nuance: the $5 plan’s unpredictable billing is a real liability. Cloudflare has no plans to add spending caps. For a small business, a surprise $500 invoice from a bot attack could erase any savings from cheap infrastructure. That risk may outweigh the security benefits for many users. The architecture is smart. The pricing model is not.
- What does EmDash's free tier include?The free tier gives you a self-hosted Node.js CMS with SQLite, basic content management, and a front-end editor. Plugins run in-process with no sandbox.
- What does the $5/month paid plan add?The paid plan adds Cloudflare Workers deployment, D1 database, R2 storage, and dynamic workers for sandboxed plugin execution with full isolation.
- Why is the plugin sandbox important?The sandbox enforces plugin permissions via a manifest, preventing compromised plugins from accessing your database or sending data externally.
- Who should pay for EmDash?Pay if you plan to use plugins or want the security model—agencies, developers, or WordPress migrants needing custom functionality.
- What is the hidden cost of the $5 plan?Cloudflare has no spending caps, so a bot attack could generate a surprise $500 invoice, outweighing the savings from cheap infrastructure.
