{"id":97991,"date":"2026-10-03T03:02:00","date_gmt":"2026-10-03T07:02:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=97991"},"modified":"2026-09-29T07:48:49","modified_gmt":"2026-09-29T11:48:49","slug":"emdash-cms-vs-wordpress-97991","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/emdash-cms-vs-wordpress-97991\/","title":{"rendered":"EmDash CMS: 8 Things It Does Better Than WordPress (And 3 Where It Falls Short)"},"content":{"rendered":"

Cloudflare launched EmDash on April 1, 2026 \u2014 and it wasn’t a joke. The company calls it the “spiritual successor” to WordPress<\/a>. Built on TypeScript and Astro, it runs on V8 isolates at Cloudflare’s edge network. It’s open source under MIT. And it fundamentally rethinks how plugins work.<\/p>\n

But does that make it a replacement for the CMS powering 43% of the web? Not yet. Here’s where EmDash genuinely outperforms WordPress \u2014 and where it still has a long way to go.<\/p>\n

What EmDash Gets Right<\/h2>\n

1. Plugin Security Is Architectural, Not Optional<\/h3>\n

The headline feature. In WordPress, a plugin calls global wpdb<\/code>codecodecodecode and gets unrestricted access to every table in your database. That’s not a bug \u2014 it’s how the architecture was designed. 96% of all WordPress security vulnerabilities come from plugins. In 2025 alone, researchers disclosed 11,334 new WordPress vulnerabilities, a 42% increase from the year before.<\/p>\n

EmDash fixes this at the runtime level. Every plugin runs inside its own V8 isolate via Cloudflare’s dynamic workers. It must declare exactly what it needs in a capability manifest. A plugin that declares read content<\/code>codecodecodecode and send email<\/code>codecodecodecode can literally do nothing else \u2014 no file system access, no database queries, no unrestricted network calls. The runtime physically blocks it.<\/p>\n

One Hacker News commenter who worked with WordPress for a decade called the sandbox “genuinely smart.”<\/p>\n

2. Serverless Pricing Means You Pay Only for What You Use<\/h3>\n

WordPress hosting charges a flat monthly rate \u2014 $20, $50, $100 \u2014 whether you get 10 visitors or 10 million. Your site might crash under load, but the bill stays the same.<\/p>\n

EmDash flips that. It runs on Cloudflare Workers, which bill per request and per CPU millisecond. The paid plan starts at $5 a month and includes 10 million requests. After that, it’s $0.30 per additional million. R2 storage charges zero egress fees. A site getting 100,000 visits per day on the $5 plan uses roughly 3% of its monthly request allowance.<\/p>\n

For a small blog, total infrastructure cost is about $15 a year \u2014 just a domain name. For a managed WordPress site on WP Engine, the first year costs around $525.<\/p>\n

3. Modern Tech Stack \u2014 TypeScript, Astro, No PHP<\/h3>\n

WordPress was built in 2003 on PHP and MySQL. Running it today means managing PHP alongside JavaScript, configuring multiple caching layers for acceptable performance, and maintaining a monolithic server that’s always on.<\/p>\n

EmDash is written entirely in TypeScript and powered by Astro. Themes use components, layouts, and CSS \u2014 familiar to any modern frontend developer. You can use Tailwind, scoped CSS, and standard build tools. Crucially, an EmDash theme can never perform database operations. It’s strictly frontend, keeping core data completely safe.<\/p>\n

The lead engineer built most of EmDash in about 2 months with significant AI coding assistance. That timeline \u2014 a project that would have taken a full team several years \u2014 is itself a statement about the stack’s productivity.<\/p>\n

4. AI-Native From Day One<\/h3>\n

Most CMS platforms bolt AI on as a plugin. EmDash builds it in. Every instance ships with a built-in MCP server (Model Context Protocol, the standard Anthropic created for AI agent communication).<\/p>\n

Claude, Cursor, GitHub Copilot \u2014 any MCP-compatible agent can connect to your CMS and manage content directly. Upload media, search posts, create new content types, manage plugins. All through natural language, all with scoped permissions.<\/p>\n

EmDash also ships agent skills files \u2014 structured documentation that tells AI agents<\/a> exactly how to operate the CMS. No custom prompting needed. Joost de Valk, founder of Yoast SEO (used on 10 million WordPress sites), called this “the most interesting thing to happen to content management in years.” Matt Mullenweg, WordPress co-creator, said the agent skills approach is “amazing” and that WordPress “needs to do the same as soon as possible.”<\/p>\n

5. Built-In Custom Content Types Without a Plugin<\/h3>\n

WordPress ships with two content types: posts and pages. For anything else \u2014 products, staff, offices \u2014 you need a plugin. Typically Advanced Custom Fields (ACF), which runs on millions of sites.<\/p>\n

EmDash includes custom content types natively. You define fields, slugs, URL patterns, and SEO settings from the admin. No plugin required. Content types are flexible, searchable, and automatically included in sitemaps.<\/p>\n

This one feature eliminates the most common plugin dependency on WordPress.<\/p>\n

6. MIT License Removes the GPL Friction<\/h3>\n

WordPress is GPL licensed. That means any derivative work must carry the same license if distributed. For enterprises, the “viral” nature of GPL creates compliance overhead. Every WordPress plugin and theme must be GPL licensed because of how deeply they integrate with core.<\/p>\n

EmDash is MIT licensed. The only requirement is attribution. Enterprises can use it without legal review cycles. Developers can sell plugins under any license they choose \u2014 closed source, MIT, or anything else. The lead engineer spent significant time with Cloudflare’s lawyers to ensure no reference to WordPress source code exists in the EmDash codebase.<\/p>\n

7. Passkey Authentication \u2014 No Passwords to Leak<\/h3>\n

WordPress authentication relies on username and password. Brute-force attacks are a constant vector. EmDash uses passkey authentication via WebAuthn by default. No passwords to leak, no credential stuffing, no brute-force logins.<\/p>\n

User management includes familiar role-based access control out of the box: administrators, editors, authors, and contributors. Each scope is strictly limited to the actions they need.<\/p>\n

8. WordPress Import Tool<\/h3>\n

EmDash includes a migration tool that reads standard WordPress WXR export files. Posts, pages, media, custom post types \u2014 it maps them into EmDash’s structured content model. If your WordPress site uses Yoast, it reads those fields and maps them to EmDash’s built-in SEO fields.<\/p>\n

You can also install an export plugin on your WordPress site and link them directly. The tool detected 468 posts, 12 pages, and 972 media items in one test within seconds.<\/p>\n

Where EmDash Falls Short<\/h2>\n

1. Zero Plugin Ecosystem (Today)<\/h3>\n

WordPress has over 60,000 plugins. WooCommerce powers 35% of all e-commerce. Elementor runs on 10 million sites. The average WordPress site uses 12 to 15 plugins. That’s not just an ecosystem \u2014 it’s an entire economy of agencies, freelancers, and job postings.<\/p>\n

EmDash launched with essentially zero third-party plugins. The counter-strategy is AI-assisted generation: the built-in MCP server lets coding agents generate plugins programmatically. But that’s a promise, not a marketplace. A business that needs e-commerce, SEO tools, and contact forms can install WordPress plugins in an afternoon. On EmDash, that’s weeks of custom development \u2014 assuming the functionality exists at all.<\/p>\n

History is brutal here. Ghost launched over a decade ago with better technology than WordPress. It has 0.1% market share. Craft CMS and Statamic are technically excellent but ecosystem-starved.<\/p>\n

2. The Core Feature Requires Cloudflare’s Paid Infrastructure<\/h3>\n

The plugin sandbox \u2014 EmDash’s defining feature \u2014 only works on Cloudflare’s dynamic workers. Those require the Workers Paid Plan at $5 a month. Deploy on the free tier and you get error code 10195.<\/p>\n

Self-host on a regular Node.js server? No sandbox support at all. Plugins run in-process without isolation. The one feature that justifies EmDash’s existence disappears completely.<\/p>\n

As one widely upvoted Hacker News comment put it: “Open source, but architecturally locked in.” WordPress runs on any server with PHP and MySQL. You can switch hosting providers in an afternoon. EmDash’s data is portable \u2014 D1 is SQLite, R2 is S3 compatible \u2014 but the security model isn’t.<\/p>\n

3. Unpredictable Billing With No Spending Cap<\/h3>\n

Serverless pricing cuts both ways. A user on the Cloudflare forum calculated the math: 10,000 APIs making one request per second<\/a> each would rack up 26 billable requests in a month. A basic DDoS attack from thousands of different IPs goes right through rate limiting \u2014 which is per-IP, not a global cap.<\/p>\n

Cloudflare does not<\/a> offer a spending limit or kill switch. Your site keeps running, workers keep firing, and your credit card keeps getting charged. One scenario estimated a potential $13,000 bill. Compare that to WordPress hosting: your site might crash under load, but your $20 flat rate stays the same.<\/p>\n

For bloggers and small publishers \u2014 the exact audience EmDash targets \u2014 this is a real risk. They want to publish content, not monitor Cloudflare dashboards daily.<\/p>\n

The Honest Bottom Line<\/h2>\n

EmDash is version 0.1.0 beta. Built in 2 months by a small team using AI agents. No plugin marketplace, no theme ecosystem, no hosting partners outside Cloudflare, no agency tooling. WordPress has 20-plus years of battle testing, millions of developers, and hosting support from every provider on the planet.<\/p>\n

But architecture is not adoption. The plugin sandbox solves a problem that WordPress structurally cannot fix. The AI integration isn’t an afterthought \u2014 it’s built into the core. And the economics are compelling for anyone starting a greenfield content site.<\/p>\n

If you’re building a new TypeScript project where security matters and you’re comfortable with the terminal, EmDash is worth a serious look. For everything else, WordPress still wins by default \u2014 not because it’s better, but because its ecosystem has no substitute yet.<\/p>\n

Where this gets interesting is the 402 payment protocol EmDash supports \u2014 an open standard for charging AI agents or users on a per-use basis. That’s a monetization model that doesn’t exist in WordPress at all, and it could shift how content creators think about value on the web. Whether that matters depends on whether the ecosystem follows.<\/p>\n","protected":false},"excerpt":{"rendered":"

Cloudflare launched EmDash on April 1, 2026 \u2014 and it wasn’t a joke. The company calls it the “spiritual successor” to WordPress. Built on TypeScript and Astro, it runs on V8 isolates at Cloudflare’s edge network. It’s open source under MIT. And it fundamentally rethinks how plugins work. But does that make it a replacement […]<\/p>\n","protected":false},"author":7,"featured_media":98848,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/97991.png","fifu_image_alt":"EmDash CMS: 8 Things It Does Better Than WordPress (And 3 Where","footnotes":""},"categories":[31],"tags":[],"class_list":["post-97991","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/97991.png","fifu_image_alt":"EmDash CMS: 8 Things It Does Better Than WordPress (And 3 Where","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/97991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=97991"}],"version-history":[{"count":2,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/97991\/revisions"}],"predecessor-version":[{"id":98849,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/97991\/revisions\/98849"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/98848"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=97991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=97991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=97991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}