Moving from WordPress to EmDash doesn’t just change your CMS. It forces you to rethink why you needed half your plugins in the first place. That’s the counterintuitive truth that most migration guides miss. You expect a technical lift-and-shift. What you get is a philosophical reset.
I’ve been building WordPress sites for freelancers since 2016. When Cloudflare launched EmDash CMS in April 2026, I dismissed it as another vaporware April Fools’ joke. Then I tested the playground. Then I migrated a real client site. Here’s what actually happened when one freelancer — me — took the leap.
EmDash doesn't just fix the security problem. It fixes the complexity problem.
The Problem: A Plugin-Bloated WordPress Site
The client was a small consultancy with a blog, a portfolio, and a contact form. Standard stuff. Their WordPress site had been running for four years on shared hosting. They had 14 plugins installed. Half of them were for things that EmDash ships built-in: SEO metadata, redirect management, basic caching.
The site loaded in 2.1 seconds on average. Not terrible, but not great. More importantly, the client’s hosting bill was climbing — they’d been throttled twice during traffic spikes. And every month, another plugin update notification with a vague security fix.
The real problem wasn’t the plugins themselves. It was that each plugin introduced a new attack surface. A contact form plugin with a known SQL injection vulnerability. An SEO plugin that phoned home to an analytics service. A caching plugin that had full database access because that’s how WordPress works.
The Approach: Migrate Content, Then Rebuild the Rest
EmDash provides a WordPress import tool. It’s straightforward — export a WXR file from WordPress, upload it to EmDash. Posts, pages, media, categories, tags all come over. Custom post types? Those require the dedicated export plugin, but the client only had posts and pages.
The migration took 20 minutes. Content was intact. Media files transferred to Cloudflare R2 storage — zero egress fees, unlimited bandwidth. The client’s 500 posts, 12 pages, and 972 media files landed safely.
Then came the hard part: the plugins.
EmDash doesn’t support WordPress plugins. At all. Every plugin you rely on must be replaced by either a built-in feature, a new EmDash plugin (sandboxed, MIT-licensed), or custom code.
For this client, the list was short:
- Yoast SEO → EmDash has built-in SEO fields (title, description, canonical URL, sitemap generation) for every content type. No plugin needed.
- Contact Form 7 → EmDash ships a form builder. Basic, but functional. Turnstile captcha integration included.
- Redirection → Built-in redirect manager with 301/302 support and 404 tracking.
- WP Super Cache → Not needed. EmDash runs on Cloudflare Workers with automatic edge caching. Zero configuration.
- UpdraftPlus backups → EmDash has a built-in export/download tool. For production, D1 database backups are handled at the Cloudflare level.
Three plugins survived the cut: a custom analytics snippet, a social sharing button script, and a newsletter integration. For those, I wrote simple EmDash sandbox plugins. Each declares exactly what it can access — read content, send email, or nothing else. No database access. No file system access. No external network calls unless explicitly granted.
The Results: Measurable Gains and One Surprise
After migration, the site loaded in 340 milliseconds on average over a week of normal traffic — a 6x improvement over the previous 2.1 seconds. This result is consistent with typical serverless performance on Cloudflare’s edge, though actual gains depend on theme complexity and how many dynamic workers are invoked per page.
The hosting cost dropped from $25/month to essentially zero. The site runs on Cloudflare’s free tier, which includes 10 million worker requests per month. With roughly 3,000 daily visits, the site uses less than 1% of that allowance. The only recurring cost is the domain name — $15/year.
The biggest surprise: the client no longer needed a caching plugin, a CDN, or a security plugin. EmDash’s architecture eliminated three entire categories of plugins. The sandbox model means even if a plugin is compromised, it can’t touch the database or other plugins. That’s not a security policy — it’s a hardware-enforced constraint via V8 isolates.
The Hard Part: What You Lose
Migration isn’t all roses. Three things hurt.
First, theme compatibility. WordPress themes are PHP-based with functions.phpcodecodecodecode files that can do anything. EmDash themes are built with Astro — TypeScript components, CSS, layouts. You cannot drop a WordPress theme into EmDash. You must rebuild it. The client’s theme was custom, so I rebuilt it in Astro in about three days using Tailwind and the starter template. For someone using a commercial WordPress theme, this is a dealbreaker.
Second, advanced plugins. The EmDash plugin ecosystem is essentially zero. No WooCommerce. No Elementor. No Advanced Custom Fields (though custom content types are built-in). If your site depends on a specific WordPress plugin with no EmDash equivalent, you’re either building it yourself or waiting.
Third, vendor lock-in. EmDash’s headline feature — sandboxed plugins — only works on Cloudflare’s paid Workers runtime. Self-host on Node.js, and plugins run in-process without isolation. The code is MIT-licensed, but the runtime that powers the security model is proprietary. WordPress runs on any server. EmDash runs best on Cloudflare.
Lessons Learned: What I’d Do Differently
If I were doing this again, I’d start with a thorough audit of plugin dependencies. Most WordPress sites run 12-15 plugins. In my experience, 8-10 of those can be eliminated by built-in features or simple configuration. The remaining 2-5 require custom development. Budget for that.
I’d also test the migration on a staging instance first. The EmDash playground gives you a one-hour sandbox — enough to run the import and verify content integrity. Don’t skip this step.
And I’d warn the client about the learning curve. The admin interface looks like WordPress, but the editing experience is sparser. No block editor. No drag-and-drop page builder. Portable text (structured JSON) is powerful for developers but unfamiliar for content editors used to Gutenberg.
The Counterintuitive Takeaway
Most people think migrating to EmDash is about adopting new technology. It’s not. It’s about admitting that WordPress’s plugin model — where every plugin has full access to everything — is fundamentally broken. EmDash doesn’t just fix the security problem. It fixes the complexity problem. When you can’t install a plugin for every little thing, you’re forced to use what’s built-in. And what’s built-in is often enough.
The client’s site is faster, cheaper, and more secure. But they lost the ability to install a new plugin on a whim. For some businesses, that’s a feature, not a bug.
What’s Next
EmDash is version 0.1.0. The plugin marketplace is empty. The theme ecosystem doesn’t exist. But the architecture is sound. In 12-18 months, if Cloudflare builds a real ecosystem around dynamic workers and structured content, this could be the most important CMS launch since WordPress itself.
For now, EmDash is for developers and early adopters who value security over convenience. If that’s you, the migration is worth the pain.
- What is the main challenge when migrating from WordPress to EmDash?The main challenge is replacing WordPress plugins, as EmDash does not support them. Every plugin must be replaced by a built-in feature, a new EmDash plugin, or custom code.
- How long does the content migration take?The content migration takes about 20 minutes using EmDash's WordPress import tool, which transfers posts, pages, media, categories, and tags.
- What are the benefits of migrating to EmDash?Benefits include faster site speed, lower hosting costs, improved security, and reduced complexity. EmDash runs on Cloudflare Workers with automatic edge caching and built-in SEO, redirect management, and form builder.
