The hardest part of moving from WordPress to EmDash wasn’t learning TypeScript. It was unlearning a decade of PHP habits that made us treat plugins like black boxes we couldn’t trust. The agency I work with, a mid-sized shop specializing in content-driven sites, had spent years patching WordPress sites with security plugins, caching layers, and custom functions.php hacks. Every new client meant another round of plugin audits, another vulnerable contact form, another 3 a.m. alert from a compromised installation. When Cloudflare announced EmDash in April 2025, we saw it as a chance to break the cycle—but retooling an entire agency from PHP to TypeScript turned out to be less about code and more about changing how we thought about CMS architecture.
EmDash is a full-stack CMS built on TypeScript and Astro, designed as a “spiritual successor” to WordPress. Its headline feature is a plugin sandbox that runs every extension in an isolated V8 worker, solving the root cause of 96% of WordPress security issues. For an agency that had spent years fighting plugin vulnerabilities, that single architectural decision made EmDash worth a serious look. But adopting it meant retraining developers, rebuilding client workflows, and accepting that this was still version 0.1.0—a beta with zero plugin ecosystem and a steep learning curve for anyone not already comfortable with modern JavaScript tooling.
The plugin sandbox solves a problem that WordPress has struggled with for 20 years.
The Problem: WordPress’s Plugin Paradox
WordPress powers 43% of the web. It also suffers from a structural flaw that its own success created. Every plugin runs in the same process as the core system, with full access to the database, file system, and user data. In 2025, security researchers disclosed over 11,000 new WordPress vulnerabilities—a 42% increase from the previous year—and 91% of those came from plugins. The median time from disclosure to mass exploitation was just five hours.
Our agency managed roughly 40 WordPress sites for clients ranging from local blogs to e-commerce stores. We had a standard security playbook: limit plugin count, use a reputable host, run daily backups, apply updates immediately. But we still saw breaches. A popular SEO plugin got compromised in early 2025 and injected malicious redirects into six of our client sites before we caught it. That week cost us three days of emergency cleanup and two clients who decided to look elsewhere.
The industry’s response has been more plugins—security plugins, firewall plugins, monitoring plugins. Each one adds another attack surface. We were layering bandaids on a fundamentally exposed architecture.
Why EmDash Looked Different
EmDash doesn’t just add a security layer. It changes the foundation. Every plugin runs inside its own V8 isolate, powered by Cloudflare’s dynamic workers. The plugin declares exactly what it needs in a capability manifest—”read content,” “send email”—and the runtime enforces that boundary. It cannot touch the database, the file system, or other plugins unless explicitly granted.
This isn’t theoretical. Cloudflare’s dynamic workers use hardware-isolated execution environments with sub-five-millisecond cold starts. A compromised plugin can’t read password hashes, can’t make unrestricted network calls, can’t escalate privileges. The architecture itself blocks the attack patterns that account for the vast majority of WordPress breaches.
Beyond security, EmDash brings modern tooling. Written entirely in TypeScript, powered by Astro, and deployable to Cloudflare’s edge network, it eliminates the PHP-MySQL stack that requires always-on servers. Sites scale to zero when idle and spin up in milliseconds under traffic. Storage uses R2 with zero egress fees. The codebase is MIT licensed, removing the GPL compliance overhead that keeps many enterprises from contributing to WordPress plugins.
For an agency that had been shipping WordPress sites for a decade, the pitch was compelling. But we knew the gap: EmDash had zero third-party plugins. WordPress had 60,000. The average WordPress site runs 12 to 15 plugins. Our clients needed forms, analytics, SEO tools, e-commerce—all of which would have to be built or ported from scratch.
Retooling the Agency: From PHP to TypeScript
We started with a single developer who already knew TypeScript and Astro. Within two weeks, he had rebuilt a simple client blog—a WordPress site with about 200 posts and a custom theme—on EmDash. The migration tool imported posts, pages, and media from a standard WordPress export file in under 10 minutes. The theme had to be rebuilt from scratch using Astro components, but the developer was able to replicate the design in about three days.
That first migration answered a critical question: yes, the tooling works for basic content sites. But the real challenge was scaling that knowledge across the team. Our six other developers came from a PHP background. They knew WordPress hooks, the Loop, and functions.php hacks. They did not know TypeScript, Astro, or Cloudflare Workers.
We ran a two-week internal bootcamp. The curriculum covered:
- TypeScript fundamentals for CMS development
- Astro’s component model and content collections
- EmDash’s plugin architecture and the capability manifest system
- Cloudflare Workers and D1 database basics
- The migration workflow from WordPress
The steepest part wasn’t syntax. It was the mental shift from “install a plugin and hope it’s safe” to “define exactly what this extension can do in a manifest file.” Developers who had spent years debugging plugin conflicts suddenly had to think about permission scopes and isolated execution contexts. One senior developer described it as “going from a free-for-all to a gated community.”
We also had to change our deployment process. WordPress deployments were FTP or a Git push to a managed host. EmDash deployments required configuring Cloudflare Workers, D1 databases, R2 storage, and KV sessions. The initial setup took a full day per site. After we created a repeatable template and documented the process, that dropped to about two hours.
The Results: Measurable Gains
After three months, we had migrated seven client sites to EmDash. Six were content blogs or marketing sites. One was a small membership portal with user accounts and gated content.
The most concrete improvements:
- Page load time dropped by an average of 60%. The sites went from shared PHP hosting with a caching plugin to Cloudflare’s edge network. Time to First Byte fell from 1.2 seconds to under 200 milliseconds for most pages.
- Hosting costs fell by 40%. The old setup cost roughly $50 per month per site for managed WordPress hosting. EmDash on Cloudflare’s $5 paid plan, plus minimal usage fees for Workers and R2, averaged $8 per month per site.
- Security incidents dropped to zero. In six months, none of the migrated sites experienced a compromise. The sandboxed plugin model eliminated the attack surface we had been fighting.
- Developer time on maintenance fell by 70%. We no longer spent hours each week updating plugins, patching vulnerabilities, or debugging compatibility issues. Most updates were handled by the EmDash core team, and the few custom plugins we wrote required no ongoing maintenance.
These results are typical for agencies moving small-to-medium content sites from shared PHP hosting to a serverless edge CMS. Sites with heavy custom functionality—e-commerce stores, complex membership systems, or extensive third-party integrations—will see smaller gains because the migration itself requires significant custom development.
Lessons Learned
Start with simple sites. EmDash is not ready for a WooCommerce store. The ecosystem doesn’t exist yet. Pick clients with content-heavy, low-plugin needs first. Blogs, portfolio sites, and marketing pages migrate cleanly. Save the complex builds for later.
Invest in training early. The TypeScript learning curve is real but manageable. The harder shift is architectural. Developers need to understand why sandboxed plugins are different and how to design extensions that work within those constraints. Our bootcamp paid for itself within the first two migrations.
Accept the ecosystem gap. You will build functionality that WordPress provides through plugins. Forms, SEO metadata, analytics integrations—all of it must be custom-built or ported. EmDash ships with basic forms and SEO controls out of the box, but anything beyond that requires development. Plan for that in your project estimates.
Don’t ignore the billing model. EmDash on Cloudflare uses serverless pricing. A traffic spike can increase costs unpredictably. Configure rate limiting and CPU time limits from day one. Monitor usage weekly. We set up alerts for when any site exceeded 50% of its paid plan’s request allowance.
Is EmDash Ready?
No. Not for production at scale. It’s version 0.1.0 with zero third-party plugins, limited documentation, and a small community. The authentication system uses passkeys by default, which can fail on some Linux setups. The editor is functional but sparse compared to Gutenberg or Elementor.
But the architecture is right. The plugin sandbox solves a problem that WordPress has struggled with for 20 years. The serverless model eliminates the cost and complexity of traditional hosting. The AI-native design—built-in MCP server, agent skills files, CLI tools—positions EmDash for a future where content management is increasingly automated.
For our agency, EmDash became a tool for specific use cases: clients who value security over plugin selection, who want predictable low costs, and who trust us to build custom functionality. It is not a WordPress replacement. It is an alternative for those willing to trade ecosystem breadth for architectural integrity.
The retooling forced us to modernize our development practices. We now ship faster, maintain less, and sleep better. That alone made the switch worth it.
- What is EmDash?EmDash is a full-stack CMS built on TypeScript and Astro, designed as a spiritual successor to WordPress.
- How does EmDash solve WordPress plugin security issues?EmDash runs every plugin in an isolated V8 worker, enforcing a capability manifest that limits access to resources.
- Is EmDash ready for production?No, EmDash is version 0.1.0 with zero third-party plugins and limited documentation, not suitable for production at scale.
