{"id":97981,"date":"2026-10-02T03:02:00","date_gmt":"2026-10-02T07:02:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=97981"},"modified":"2026-09-29T07:47:12","modified_gmt":"2026-09-29T11:47:12","slug":"emdash-cms-architecture-fixes-wordpress-97981","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/emdash-cms-architecture-fixes-wordpress-97981\/","title":{"rendered":"EmDash CMS: The Architecture That Fixes WordPress"},"content":{"rendered":"

WordPress powers 43% of the internet. It also runs on a 23-year-old architecture where every plugin gets the master key to your database. That is not an exaggeration. A single contact form plugin with a bug can read your entire user table. Cloudflare<\/a> saw this problem and decided the fix was not another security plugin. The fix was a new CMS built from scratch.<\/p>\n

EmDash CMS, released April 1, 2026, is written entirely in TypeScript and powered by Astro. It runs on V8 isolates at Cloudflare’s edge network. Every plugin executes inside its own sandboxed environment called a dynamic worker. The plugin declares what it needs in a capability manifest. It can do nothing else.<\/p>\n

The Plugin Paradox<\/h2>\n

In 2025, security researchers disclosed 11,334 new WordPress vulnerabilities. That is a 42% increase from the year before. 96% of those came from plugins, not WordPress core.<\/p>\n

The median time from vulnerability disclosure to mass exploitation is 5 hours. Roughly half of all high-impact exploits happen within the first 24 hours. This is not a bug in individual plugins. It is a structural problem.<\/p>\n

WordPress plugins run in the same process as WordPress itself. A plugin calls global wpdb<\/code>codecodecodecode and has unrestricted access to every table, every file, and every user session. Install one plugin with a backdoor and an attacker can create admin accounts, mine cryptocurrency on your server, or exfiltrate your entire database. There is no sandbox. There is no permission system.<\/p>\n

EmDash eliminates this attack surface architecturally.<\/p>\n

How the Plugin Sandbox Actually Works<\/h2>\n

Every EmDash plugin runs inside its own V8 isolate, powered by Cloudflare’s dynamic workers. The plugin declares its capabilities upfront. Here is a real example from the EmDash documentation:<\/p>\n

“`typescript<\/p>\n

definePlugin({<\/p>\n

id: ’email-notifier’,<\/p>\n

version: ‘1.0.0’,<\/p>\n

capabilities: [‘read:content’, ’email:send’],<\/p>\n

hooks: {<\/p>\n

‘post:publish’: async (context) => {<\/p>\n

const email = context.email;<\/p>\n

await email.send({<\/p>\n

to: ‘admin@example.com’,<\/p>\n

subject: ‘New post published’<\/p>\n

});<\/p>\n

}<\/p>\n

}<\/p>\n

});<\/p>\n

“`<\/p>\n

This plugin can read content and send emails. It cannot touch the database directly. It cannot access the file system. It cannot make external network calls. The dynamic worker runtime enforces the boundary at the hardware level using V8 isolates, Linux namespaces, seccomp filters, and memory protection keys.<\/p>\n

If a compromised update tries to read password hashes or phone home to an external server, the runtime physically blocks it.<\/p>\n

Cloudflare published benchmarks showing dynamic workers start roughly 100 times faster than a traditional Docker container. A Docker container takes seconds to cold start. A V8 isolate starts in milliseconds. For a CMS, this means plugins load instantly. No cold start penalties. No container orchestration overhead.<\/p>\n

The catch: the full sandbox only works on Cloudflare’s runtime. Self-host EmDash on a regular Node.js server and plugins run in-process without isolation. The feature that justifies EmDash’s existence requires Cloudflare’s paid infrastructure. $5 a month. Remarkably cheap, but still a dependency on a single vendor.<\/p>\n

Serverless Infrastructure: Cheap Until It Is Not<\/h2>\n

EmDash runs on five Cloudflare products simultaneously. Workers for compute. D1 for the database. R2 for media storage with zero egress fees. KV for sessions. Workers AI for moderation.<\/p>\n

This is where the economics get interesting and dangerous.<\/p>\n

A managed WordPress site on WP Engine costs roughly $525 the first year, climbing past $1,600 across three years. EmDash on Cloudflare’s paid plan costs $75 a year. On the free tier, a small blog costs roughly $15 a year for just a domain name. 100,000 visits a day on the $5 plan uses roughly 3% of its monthly request allowance.<\/p>\n

But serverless billing cuts both ways. One forum user calculated the math: a basic DDoS attack of 10,000 unique IPs making one request per second<\/a> each would rack up 26 billion billable requests in a month. That is not a hypothetical. Cloudflare does not offer a global spending cap. There is no kill switch. Your site keeps running, workers keep firing, and your credit card keeps getting charged.<\/p>\n

Traditional WordPress hosting charges a flat rate. Twenty bucks a month. Fifty bucks. If you get 10 visitors or 10 million, your bill stays the same. Your server might crash, but you know what you are paying. EmDash flips that completely. Every page view, every admin panel click, every API call is a worker invocation. One page view can hit four or five different billing meters simultaneously.<\/p>\n

Built for AI Agents, Not Just Humans<\/h2>\n

EmDash ships with a built-in MCP server. Model Context Protocol, the standard Anthropic created for AI agent<\/a> communication. Claude, Cursor, GitHub Copilot, any MCP-compatible agent can connect directly to your CMS.<\/p>\n

The agent can search posts, upload media, create new content types, manage plugins, deploy changes. All through natural language. All with scoped permissions.<\/p>\n

EmDash also ships agent skills files. These are structured documentation files that tell AI agents<\/a> exactly how to operate the CMS. No custom prompting needed. The AI reads the skills files and knows what it can do.<\/p>\n

Matt Mullenweg, the co-creator of WordPress, published a detailed review days after EmDash’s launch. He pushed back on the “spiritual successor” branding. He said it was created to sell more Cloudflare services. But he also wrote that the agent skills approach was “amazing” and “a brilliant strategy.” He said WordPress needs to do the same as soon as possible.<\/p>\n

The Licensing Shift That Changes the Economy<\/h2>\n

WordPress uses the GPL license. Copyleft. Any derivative work must be published under the same license. This means every WordPress plugin and theme must be GPL-licensed. For enterprises, this is a compliance headache. For developers, it means you are pressured to give your code away for free and only charge for pro features.<\/p>\n

EmDash is MIT licensed. One requirement: give credit. That is it.<\/p>\n

This changes the plugin economy entirely. Developers can keep their plugins closed source. They can sell them under any license. They can monetize on a per-use basis using the built-in 402 payment protocol. No more restrictive marketplaces. No more long review queues. No more licensing headaches.<\/p>\n

The lead engineer, Matt Cain, spent significant time with lawyers to ensure EmDash contained no reference to WordPress source code. He said he intentionally never even looked at it. The result is a CMS that is architecturally distinct and legally clean.<\/p>\n

What You Actually Get Today<\/h2>\n

EmDash is version 0.1.0. 89 commits on GitHub. Built in roughly 2 months by one engineer with significant AI coding assistance. Three starter templates ship out of the box: a blog, a marketing site, and a portfolio.<\/p>\n

The dashboard looks deliberately familiar to WordPress. Same left-hand menu structure. Same content types for pages and posts. Same concept of widgets, menus, and comments. But it also includes things WordPress requires plugins for: SEO controls, custom content types, redirect management, and built-in forms.<\/p>\n

The custom content type system is native. You do not need Advanced Custom Fields or Jet Engine. Create a new content type, define its fields, set its URL pattern. Done. This is what WordPress should have done 15 years ago.<\/p>\n

The WordPress migration tool imports posts, pages, media, and custom post types from a standard WXR export file. It maps Yoast SEO fields to EmDash’s built-in SEO fields automatically. But it does not migrate plugins, themes, custom functionality, or WooCommerce stores. All of that must be rebuilt.<\/p>\n

The Uncomfortable Truth<\/h2>\n

WordPress has 62,000 plugins. WooCommerce powers 35% of all e-commerce. Elementor is on 10 million sites. The average WordPress site runs 12 to 15 plugins. That is not just an ecosystem. It is an entire economy of agencies, freelancers, hosting providers, and job postings.<\/p>\n

EmDash launched with zero third-party plugins. History is brutal here. Ghost launched over a decade ago with better technology than WordPress. It has 0.1% market share. Craft CMS and Statamic are technically excellent but ecosystem-starved.<\/p>\n

People are not on WordPress because of WordPress. They are on WordPress because of WooCommerce, a million themes, and integrations for every internal business API on the planet.<\/p>\n

EmDash’s counter-strategy is AI. The MIT license removes GPL friction. The MCP server lets agents generate plugins programmatically. The agent skills files tell AI exactly how to build for this platform. But signals do not ship features. Not yet.<\/p>\n

If you are starting a greenfield content site in TypeScript and security matters, EmDash is worth a serious look. For everything else, WordPress still wins by default. Not because it is better, but because its ecosystem has no substitute yet.<\/p>\n","protected":false},"excerpt":{"rendered":"

WordPress powers 43% of the internet. It also runs on a 23-year-old architecture where every plugin gets the master key to your database. That is not an exaggeration. A single contact form plugin with a bug can read your entire user table. Cloudflare saw this problem and decided the fix was not another security plugin. […]<\/p>\n","protected":false},"author":7,"featured_media":98772,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/97981.png","fifu_image_alt":"EmDash CMS: The Architecture That Fixes WordPress","footnotes":""},"categories":[31],"tags":[],"class_list":["post-97981","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/97981.png","fifu_image_alt":"EmDash CMS: The Architecture That Fixes WordPress","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/97981","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=97981"}],"version-history":[{"count":2,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/97981\/revisions"}],"predecessor-version":[{"id":98773,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/97981\/revisions\/98773"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/98772"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=97981"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=97981"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=97981"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}