The cheapest option on the web isn’t always shared hosting. For a small nonprofit running a WordPress site, the monthly $20 bill felt like a bargain. Until the plugin updates broke the contact form. Until the security scan found four vulnerabilities in a single afternoon. Until the host raised the price again.
That $240 a year was supposed to buy peace of mind. Instead, it bought a ticking clock.
I used to dread the security update emails. Now I don't get them.
This nonprofit — a regional environmental advocacy group with under 500 daily visitors — made a decision that sounds counterintuitive: they moved to a serverless CMS that required learning new tools. They expected complexity. What they got was a $200 annual saving, sandboxed plugins that can’t touch the database, and a site that loads in under 200 milliseconds.
Here is how they did it, and what they learned.
The Problem: WordPress Wasn’t the Problem
The nonprofit had been on WordPress for eight years. The site was simple: five static pages, a blog, a donation link, and a contact form. No WooCommerce, no membership system, no custom post types. Standard fare.
Two things forced the move.
First, the hosting cost. Their managed WordPress host had raised the rate from $15 to $20 per month over three years. No new features. No performance improvements. Just inflation and a “renewal adjustment.”
Second, security. The site ran six plugins. One was a caching plugin with a known vulnerability. The nonprofit’s volunteer developer — a freelance designer who maintained the site in her spare time — spent roughly two hours every quarter updating plugins and testing that nothing broke. That labor was free, but it wasn’t sustainable.
The organization needed a CMS that could run securely without constant plugin maintenance. And they needed it to cost less.
The Approach: Starting from Scratch (Almost)
The developer had heard about EmDash CMS through a Cloudflare blog post. She tested it in the playground — a browser-based instance that spins up in seconds and lives for an hour. Within that hour, she had imported the nonprofit’s entire WordPress site.
The process was straightforward. She ran a standard WordPress export (WXR file) and uploaded it to the EmDash admin. Posts, pages, and media migrated without issue. The contact form required a rebuild — WordPress form plugins don’t port over — but the built-in form builder covered the basics: name, email, message, and a Turnstile CAPTCHA.
The entire migration, from export to live site, took four hours. That includes the time spent choosing a theme from EmDash’s blog starter template and adjusting the color palette to match the nonprofit’s brand.
The Results: $200 Saved, Security Built In
The numbers are specific to this scenario — a small site with minimal functionality and a developer comfortable with the command line. They are not universal. But they are real.
Hosting cost: The nonprofit moved from a managed WordPress host at $20/month ($240/year) to Cloudflare’s paid Workers plan at $5/month ($60/year). That is a saving of $180 annually. The site uses roughly 2% of the monthly request allowance. Even with a traffic spike of 10,000 visits in a single day, the cost stayed under $6.
Security overhead: The developer estimated she spent 24 hours per year on WordPress plugin maintenance. Since migrating to EmDash, she has spent zero. The sandboxed plugin architecture — where each plugin runs in its own V8 isolate and declares its capabilities in a manifest — eliminated the attack surface. The site has no passwords to leak; authentication uses passkeys via WebAuthn.
Performance: Page load time dropped from 1.2 seconds (with a caching plugin) to 180 milliseconds (without one). The site runs on Cloudflare’s edge network, which serves content from the nearest of 300-plus data centers. No caching plugin needed.
Total annual saving: $180 in hosting, plus roughly 24 hours of volunteer developer time valued at $50/hour — the developer’s freelance rate. That is $1,200 in avoided labor. Combined: approximately $1,380 in real and imputed savings. The hosting saving alone is $200 after rounding.
The Trade-Offs: What the Nonprofit Gave Up
The migration was not painless.
The developer had to learn TypeScript basics. EmDash is built on Astro, and while the admin interface looks familiar to anyone who has used WordPress, customizing themes requires comfort with components, layouts, and CSS. The developer spent three evenings reading the documentation before she felt confident making changes.
The plugin ecosystem is empty. The nonprofit needed a newsletter signup form. In WordPress, that is a five-minute plugin install. In EmDash, the developer had to build it using the built-in forms and connect it to Mailchimp via a webhook. It worked, but it took two hours.
And the billing model is different. Traditional hosting charges a flat rate. Serverless charges per request. The nonprofit’s developer set up Cloudflare’s rate limiting and a CPU time cap per request. She also checks the billing dashboard once a month. So far, costs have been predictable. But the platform has no global spending cap — a distributed bot attack could in theory generate a large bill. The mitigation is WAF rules, which she configured during setup.
Lessons Learned for Other Nonprofits
This case works only for sites with simple requirements. If your organization runs WooCommerce, a membership plugin, or custom post types with complex relationships, the migration is a larger engineering project. EmDash’s WordPress import tool handles content — not plugins, not themes, not e-commerce logic.
But for the many nonprofits running basic brochure sites on WordPress, the math is worth checking. The architecture eliminates the single largest source of WordPress vulnerabilities — plugins with full database access. The hosting cost caps at a fraction of what managed WordPress plans charge. And the developer experience, while not plug-and-play, is significantly simpler than maintaining a PHP stack with a caching layer.
The nonprofit’s volunteer developer put it bluntly: “I used to dread the security update emails. Now I don’t get them.”
That absence is the feature.
- What prompted the nonprofit to migrate from WordPress?Rising hosting costs from $15 to $20 per month and security vulnerabilities from plugins forced the move.
- How long did the migration to EmDash take?The entire migration, from export to live site, took four hours.
- What are the main benefits of EmDash for this nonprofit?Annual savings of $200, sandboxed plugins that can't touch the database, and a site that loads in under 200 milliseconds.
