{"id":97968,"date":"2026-09-30T19:50:00","date_gmt":"2026-09-30T23:50:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=97968"},"modified":"2026-09-29T07:43:56","modified_gmt":"2026-09-29T11:43:56","slug":"emdas-security-wordpress-alternative-97968","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/emdas-security-wordpress-alternative-97968\/","title":{"rendered":"Stop Using WordPress? The EmDash Security Case Is Stronger Than Ever"},"content":{"rendered":"

The advice you hear everywhere goes like this: WordPress powers 43% of the web. It has 60,000 plugins, 20 years of battle testing, and an ecosystem nothing else touches. Don’t switch to a beta CMS from Cloudflare \u2014 that’s reckless.<\/em><\/p>\n

That advice sounds reasonable. It’s also incomplete in a way that could cost you everything.<\/p>\n

Here’s what the conventional wisdom misses: the threat model has changed. The question isn’t whether EmDash is more feature-complete than WordPress today. It isn’t. The question is whether the architectural risk of running WordPress is still acceptable for your specific use case. For a growing number of site owners, the answer is no.<\/p>\n

The Numbers Are Worse Than You Think<\/h2>\n

Let’s start with what the “stick with WordPress” crowd doesn’t say out loud.<\/p>\n

In 2025, security researchers disclosed 11,334 new WordPress vulnerabilities. That’s a 42% increase from the year before. Nearly half of those were exploitable without any authentication. And 96% of all WordPress security issues come from plugins \u2014 not from WordPress core, not from PHP, not from your hosting provider.<\/p>\n

Think about what that means. You install a contact form plugin. It has a bug. An attacker doesn’t need to crack your password. They don’t need to find a hole in WordPress itself. They just exploit that contact form plugin, and suddenly they have full access to your database, your file system, your user data.<\/p>\n

The median time from disclosure to mass exploitation? Five hours. Roughly half of high-impact exploits happen within the first 24 hours.<\/p>\n

This isn’t a hypothetical. Around 4.7 million WordPress sites get hacked every single year. That’s 13,000 sites per day. Every day.<\/p>\n

The advice to “stick with WordPress” treats this as background noise \u2014 the cost of doing business. But for a small publisher, a freelancer, or a business owner who can’t afford a dedicated security team, that cost is existential.<\/p>\n

What the Plugin Sandbox Actually Changes<\/h2>\n

EmDash \u2014 Cloudflare’s open-source CMS built on TypeScript and Astro \u2014 doesn’t fix WordPress. It replaces the architecture that makes WordPress vulnerable.<\/p>\n

In WordPress, every plugin runs in the same process. There’s no sandbox. No isolation. A plugin calls global $wpdb<\/code> and it has unrestricted access to every table in your database. That’s not a bug in the plugin. That’s how WordPress was designed.<\/p>\n

EmDash flips this completely. Every plugin runs inside its own V8 isolate, powered by Cloudflare’s dynamic workers. The plugin declares exactly what it needs in a capability manifest. It can’t touch anything else.<\/p>\n

A plugin that declares read content<\/code> and send email<\/code> can literally do nothing beyond those two actions. It cannot access your database. It cannot read your file system. It cannot make unrestricted network calls. If a compromised update tries to exfiltrate password hashes or phone home to a command server, the runtime physically blocks it.<\/p>\n

This isn’t a policy. It’s architectural enforcement \u2014 V8 isolates, Linux namespaces, seccomp filters, and hardware memory protection keys all working together.<\/p>\n

Even themes can’t touch the database. They get read-only access through an API.<\/p>\n

One compromised plugin cannot take down your entire site. It cannot read your other plugins’ data. It cannot start crypto mining on your server. It cannot escalate to admin access. The blast radius is limited to what the manifest explicitly allows.<\/p>\n

That’s not a marginal improvement. That’s a fundamentally different security posture.<\/p>\n

The Framework: Architecture Risk Spectrum<\/h2>\n

Here’s the mental model I use to evaluate CMS choices. I call it the Architecture Risk Spectrum<\/strong>.<\/p>\n

On one end, you have systems where every extension runs with full privileges. The security model trusts that extensions will behave. WordPress sits here. So do most traditional CMS platforms built before the modern security era.<\/p>\n

On the other end, you have systems where extensions run in isolated contexts with explicit capability declarations. The security model assumes extensions could be compromised and limits the damage. EmDash sits here.<\/p>\n

The insight is simple: if you operate a site where a breach would be catastrophic \u2014 a membership site with payment data, a media site with a large user base, a business site that generates your primary revenue \u2014 you should gravitate toward the isolated end of the spectrum. If a compromised plugin can read your entire database, you’re one vulnerability away from disaster.<\/p>\n

WordPress’s model was fine in 2003 when plugins were fewer and simpler. In 2026, with 62,000 plugins, many of which are abandoned, poorly maintained, or written with minimal security awareness, the risk profile has shifted.<\/p>\n

What About the Counterarguments?<\/h2>\n

I’ve read the criticism. It’s substantial. Let me address the strongest ones directly.<\/p>\n

“The sandbox only works on Cloudflare’s paid plan.”<\/strong><\/p>\n

True. The dynamic workers feature that powers plugin isolation requires Cloudflare’s Workers Paid plan, starting at $5 per month. Self-hosted EmDash on a regular Node.js server runs plugins in-process without isolation.<\/p>\n

This is a real limitation. But consider the alternative. A managed WordPress site on WP Engine costs around $525 the first year. EmDash on Cloudflare’s paid plan costs $75 per year. Even with the vendor dependency, the economics favor EmDash for anyone starting fresh.<\/p>\n

“It’s vendor lock-in disguised as open source.”<\/strong><\/p>\n

Also true. EmDash’s code is MIT licensed. You can fork it, read it, run it locally. But the features that differentiate it \u2014 the sandbox, the edge deployment, the serverless scaling \u2014 require Cloudflare’s infrastructure.<\/p>\n

But let’s be honest about what “vendor lock-in” means in practice. WordPress is free software that requires $20 to $60 per month in managed hosting, plus $300 per year in premium plugins. That’s not freedom. That’s a different lock-in model.<\/p>\n

The question is which lock-in you prefer: paying for infrastructure that handles security for you, or paying for plugins that create most of your security risk.<\/p>\n

“Zero ecosystem. 60,000 plugins vs. zero.”<\/strong><\/p>\n

This is the strongest argument against EmDash today. WordPress has WooCommerce powering 35% of e-commerce. Elementor on 10 million sites. Yoast SEO on another 10 million. The average WordPress site runs 12 to 15 plugins.<\/p>\n

EmDash launched with essentially zero third-party plugins. History is brutal here. Ghost launched over a decade ago with better technology. It has 0.1% market share. Craft CMS, Statamic \u2014 technically excellent, ecosystem starved.<\/p>\n

But EmDash’s counter-strategy is different. It ships with a built-in MCP server, agent skills, and CLI tools designed for AI-assisted development. The MIT license removes the GPL friction that keeps commercial developers away. And Joost de Valk \u2014 the founder of Yoast SEO, used on 10 million WordPress sites \u2014 called EmDash the most interesting thing to happen to content management in years.<\/p>\n

When the creator of the most popular WordPress SEO plugin takes a project seriously, the ecosystem argument starts to weaken.<\/p>\n

The Risk Calculus Has Changed<\/h2>\n

Here’s the honest take. If you’re building a greenfield content site in 2026, and security matters to you \u2014 not theoretically, but practically \u2014 EmDash is worth a serious look. Not because it’s better than WordPress today. Because its architecture eliminates a class of risk that WordPress cannot fix without a complete rewrite.<\/p>\n

WordPress will be around for decades. It’s battle-tested. It has an ecosystem that no competitor can match. But its security model is structurally broken. The advice to “stick with WordPress” assumes that broken model is acceptable.<\/p>\n

For many sites, it still is. A simple blog with a few plugins, a static site with minimal interactivity, a brochure site with no user accounts \u2014 the risk is low. The conventional wisdom applies.<\/p>\n

But for sites with payment processing, user authentication, membership systems, or sensitive data, the calculus changes. One compromised plugin can destroy everything. And with 11,334 new vulnerabilities in 2025 alone, the probability that your<\/em> site will be affected is higher than most people want to admit.<\/p>\n

The Edge Case No One Talks About<\/h2>\n

Here’s the nuance that doesn’t fit the pro-WordPress narrative.<\/p>\n

Consider a site that has already been compromised once. A site that has suffered a plugin vulnerability, lost data, or dealt with a malware cleanup. For those site owners, the “stick with it” advice rings hollow. They’ve experienced the cost of the architectural risk firsthand.<\/p>\n

EmDash’s sandbox doesn’t just reduce the probability of a breach. It reduces the blast radius<\/em> of a breach. A compromised plugin on EmDash cannot cascade. It cannot spread to other plugins, the database, or the file system. The damage is contained.<\/p>\n

For anyone who has gone through a WordPress security incident \u2014 the cleanup, the lost trust, the downtime \u2014 that containment is worth more than the ecosystem gap.<\/p>\n

The Bottom Line<\/h2>\n

The conventional wisdom says don’t switch. And for most use cases, that’s still the right call. WordPress works. It has the plugins. It has the community. It has the track record.<\/p>\n

But the conventional wisdom is not a security argument. It’s a convenience argument. And convenience has a cost.<\/p>\n

EmDash is version 0.1.0. It has bugs. It has a long way to go before it can replace WordPress for the majority of sites. But its architectural foundation is sound in a way that WordPress’s has never been. The plugin sandbox isn’t a feature. It’s a fundamentally different approach to security.<\/p>\n

If you’re starting fresh and security is your top priority, the safer bet might not be the 24-year-old platform with a broken permission model. It might be the two-month-old beta that got the architecture right.<\/p>\n","protected":false},"excerpt":{"rendered":"

The advice you hear everywhere goes like this: WordPress powers 43% of the web. It has 60,000 plugins, 20 years of battle testing, and an ecosystem nothing else touches. Don’t switch to a beta CMS from Cloudflare \u2014 that’s reckless. That advice sounds reasonable. It’s also incomplete in a way that could cost you everything. […]<\/p>\n","protected":false},"author":7,"featured_media":98677,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/97968.png","fifu_image_alt":"Stop Using WordPress? The EmDash Security Case Is Stronger Than Ever","footnotes":""},"categories":[31],"tags":[],"class_list":["post-97968","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/97968.png","fifu_image_alt":"Stop Using WordPress? The EmDash Security Case Is Stronger Than Ever","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/97968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=97968"}],"version-history":[{"count":1,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/97968\/revisions"}],"predecessor-version":[{"id":98145,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/97968\/revisions\/98145"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/98677"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=97968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=97968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=97968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}