WordPress powers 43% of the internet. It also powers 4.7 million hacked sites every single year. That contradiction is not an accident \u2014 it’s a feature of the architecture. Every plugin gets the master key to your database, your files, and your users. One bad line of PHP in a contact form plugin, and an attacker owns everything.<\/p>\n
Cloudflare’s EmDash CMS changes the equation. It’s open source, MIT-licensed, and built on TypeScript and Astro. But the real<\/a> story is what happens under the hood.<\/p>\n EmDash CMS is an open-source content management system built by Cloudflare on the Astro framework. It reimagines WordPress for the modern web, replacing PHP with TypeScript and serverless architecture. Its defining feature is plugin sandboxing using V8 isolates, which structurally prevents the security vulnerabilities that plague 96% of WordPress plugin-related attacks.<\/p>\n Here are five hidden features that make EmDash worth a serious look \u2014 especially if you have ever had to clean up a compromised WordPress site.<\/p>\n The fundamental problem with WordPress plugins is architectural. Every plugin runs in the same process as WordPress core. Global EmDash fixes this with Dynamic Workers.<\/p>\n Every plugin runs inside its own V8 isolate \u2014 a lightweight, hardware-isolated execution environment. The plugin must declare exactly what it needs in a capability manifest. Read content. Send email. That’s it. The runtime enforces the boundary. A plugin that declares The performance numbers back this up. Cloudflare’s benchmarks show Dynamic Workers start roughly 100 times faster than a traditional Docker container. Docker cold starts take seconds. A V8 isolate spins up in milliseconds. For a CMS, this means plugins load instantly with no orchestration overhead.<\/p>\n The strongest counterargument:<\/strong> This locks you into Cloudflare’s ecosystem. The full sandbox requires the Workers paid plan, starting at $5 a month. Self-host on a regular Node.js server and plugins run in-process without isolation.<\/p>\n Here is the dismantling:<\/strong> Portability of a runtime is useless if the runtime is inherently insecure. WordPress is portable PHP \u2014 you can run it on a Raspberry Pi. But that portability comes with the burden of managing a LAMP stack, patching vulnerabilities, and paying for expensive managed hosting or security plugins. The average managed WordPress host costs $300 a year, plus another $200 a year in premium security and backup plugins. And you still get hacked.<\/p>\n EmDash’s $5 a month plan includes the sandbox, D1 database, R2 storage with zero egress fees, and a global CDN across 300-plus data centers. The cost of “portability” in WordPress is endless plugin subscriptions, security maintenance, and the risk of a single compromised plugin exposing your entire business. The lock-in is a trade-up in security and cost efficiency.<\/p>\n WordPress stores content as HTML. That works for a blog post. It breaks when you want to send that same content to a mobile app, an email newsletter, or an API. You end up stripping tags, parsing broken markup, and writing custom scripts to extract meaning from what is essentially a display format.<\/p>\n EmDash uses Portable Text \u2014 a structured JSON format for rich content.<\/p>\n Instead of Body text<\/p>\n <\/code>codecodecode, EmDash stores content as an array of blocks with typed data. Headings, paragraphs, images, and embeds are all first-class citizens in the data model. A machine can read it without scraping HTML. An AI agent<\/a> can write to it without guessing the markup. A mobile app can render it without parsing a full HTML document.<\/p>\n1. Plugin Sandboxing That Actually Works<\/h2>\n
wpdb<\/code>codecodecode gives any plugin unrestricted access to every table in your database. A caching plugin can read your password hashes. A SEO plugin can delete your media library. There is no sandbox, no isolation, no permission system.<\/p>\nread content<\/code>codecodecode and email send<\/code>codecodecode can literally do nothing else. No file system access. No database queries. No unrestricted network calls.<\/p>\n2. Structured Content Instead of HTML Blobs<\/h2>\n
<\/p>\nTitle<\/h2>\n