{"id":98000,"date":"2026-10-04T00:38:00","date_gmt":"2026-10-04T04:38:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=98000"},"modified":"2026-09-29T07:51:27","modified_gmt":"2026-09-29T11:51:27","slug":"emdash-cms-wordpress-alternative-98000","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/emdash-cms-wordpress-alternative-98000\/","title":{"rendered":"Stop Using WordPress for New Projects? The Case for Starting With EmDash"},"content":{"rendered":"

You already know the numbers. 96% of WordPress security vulnerabilities come from plugins. In 2025 alone, researchers found over 11,000 new vulnerabilities, nearly half exploitable without authentication. WordPress powers 43% of the web, but its plugin architecture is a structural flaw, not a bug.<\/p>\n

EmDash<\/a>, Cloudflare’s new CMS, doesn’t patch that flaw. It eliminates it. Every plugin runs in its own V8 isolate via dynamic workers, with a capability manifest that grants only what you declare. No database access unless you say so. No file system access. No network calls without permission. This isn’t a security plugin bolted on. It’s the architecture.<\/p>\n

The question isn’t whether EmDash can replace WordPress today. It can’t. The ecosystem is zero. The question is whether starting a new project on EmDash is smarter than starting on WordPress. For a growing number of use cases, the answer is yes.<\/p>\n

The Plugin Paradox \u2013 Why WordPress’s Greatest Strength Is Its Greatest Liability<\/h2>\n

WordPress’s plugin ecosystem is its moat. Over 60,000 plugins, from WooCommerce to Yoast SEO, form an economy that no competitor can match. But that moat is also a trap. Every plugin runs in the same process as the core, with full access to the database, file system, and user sessions. One compromised contact form plugin and an attacker reads your entire user table.<\/p>\n

This is not a failure of individual plugin authors. It is how WordPress was designed. The architecture trusts code by default. There is no sandbox, no permission system, no isolation. The median time from vulnerability disclosure to mass exploitation is five hours. Half of high-impact exploits happen within the first 24 hours.<\/p>\n

Cloudflare’s lead engineer Matt Cain recognized this. He built EmDash with dynamic workers, a product Cloudflare originally created for securely executing AI-generated code. The same mechanism isolates plugins. A plugin that declares read content<\/code>codecodecodecode and send email<\/code>codecodecodecode can literally do nothing else. No database queries, no crypto mining, no exfiltration of password hashes. The runtime enforces the boundary at the hardware level using V8 isolates, Linux namespaces, seccomp filters, and memory protection keys.<\/p>\n

This is the “Sandbox-First” model. It inverts the trust assumption. Code is guilty until proven innocent, and innocence is declared upfront.<\/p>\n

The Ecosystem Gap \u2013 Why Zero Plugins Is Actually an Advantage for New Projects<\/h2>\n

The most common objection to EmDash is the missing ecosystem. WordPress has 60,000 plugins; EmDash has zero. That sounds fatal.<\/p>\n

But consider what you actually need for a new project. A blog, a marketing site, a portfolio, a small e-commerce store. The features you need are standard: SEO metadata, contact forms, caching, analytics, user management. EmDash ships with SEO built-in, a form builder, automated moderation, and role-based access control. You don’t need a plugin for these things. They are core.<\/p>\n

The problem with WordPress is not the number of plugins. It’s that you end up installing 12 to 15 plugins for a simple site, each one a potential attack surface. Each plugin also introduces update friction, compatibility risk, and license management overhead. The “plugin tax” is real \u2013 not just in cost, but in maintenance burden.<\/p>\n

EmDash’s zero-plugin state is not a weakness. It is a clean slate. You only add a plugin when you genuinely need a capability that does not exist in core. And when you do, that plugin runs in a sandbox. It cannot break your site, cannot read your database, cannot phone home. The security model means you can install plugins without the anxiety that comes with WordPress.<\/p>\n

For a new project, starting with a secure, minimal core and adding only what you need is architecturally superior to starting with a sprawling, insecure core and pruning later.<\/p>\n

The Cost Trap \u2013 Predictable vs. Unpredictable Billing<\/h2>\n

Critics point out that EmDash’s serverless billing model can be unpredictable. A DDoS attack or bot crawl could rack up charges with no built-in spending cap. One forum post estimated $13,000 for 10,000 APIs making one request per second<\/a> each.<\/p>\n

That scenario is real. But it is also manageable. Cloudflare offers rate limiting via WAF rules, CPU time limits per request, and alerts. The risk is that small business owners won’t configure these protections. Fair criticism.<\/p>\n

Compare to WordPress. Managed hosting costs $20 to $60 per month, plus $300 per year in premium plugins. That’s predictable. But it’s also a flat fee that doesn’t scale down. You pay for capacity you don’t use. EmDash’s paid plan starts at $5 per month and includes 10 million requests. For a small blog, that’s effectively free. For a site with 100,000 visits per day, the cost is still under $10 per month. The risk of runaway billing exists, but it is a risk you can mitigate with proper configuration. WordPress’s cost is guaranteed, but it’s also higher for what you get.<\/p>\n

The real cost trap is the hidden one: the time spent managing plugin updates, security patches, and compatibility issues. WordPress developers spend hours every month on maintenance. EmDash’s architecture reduces that dramatically. Plugins are isolated, so a plugin update cannot break the site. Core updates are handled by the runtime. The time saved is real.<\/p>\n

The AI-Native Advantage \u2013 Why EmDash’s MCP Server Changes the Game<\/h2>\n

WordPress is retrofitting AI. EmDash was built for it. Every instance ships with a built-in MCP server and agent skills files. You can point Claude, Cursor, or any MCP-compatible agent at your CMS and say, “Build me a new custom content type” or “Migrate this old theme.” The agent reads the skills files, knows the API, and executes.<\/p>\n

This is not a gimmick. It is a fundamental shift in how content management works. The traditional workflow is: install a plugin, configure it, write content. The new workflow is: describe what you want, the agent builds it, you review and publish.<\/p>\n

The co-creator of WordPress, Matt Mullenweg, reviewed EmDash and called its agent skills approach “amazing” and said WordPress needs to copy it as soon as possible. That’s validation from the source.<\/p>\n

For a new project, starting with an AI-native CMS means you can skip months of plugin research and configuration. You can generate custom post types, fields, and templates on demand. The MIT license removes the GPL friction that kept commercial developers away from WordPress. You can keep your code proprietary, sell plugins with any license, and monetize per-use via the built-in 402 payment protocol.<\/p>\n

The Vendor Lock-In Trade-Off \u2013 Open Source, But Architecturally Tied<\/h2>\n

EmDash is MIT licensed. The code is on GitHub. You can run it on any Node.js server. But the headline feature \u2013 plugin sandboxing \u2013 requires Cloudflare’s paid infrastructure. Dynamic workers are a Cloudflare product. Without them, plugins run in-process with no isolation. Self-hosted EmDash loses its primary advantage.<\/p>\n

This is the “Open Source, But Architecturally Locked In” problem. WordPress runs on any server with PHP and MySQL. You can switch hosts in an afternoon. EmDash’s data is portable \u2013 D1 is SQLite, R2 is S3 compatible \u2013 but the security model is not.<\/p>\n

That said, WordPress has its own lock-in. Managed hosting costs $20 to $60 per month, plus premium plugins that you cannot easily move. The difference is that WordPress’s lock-in is economic; EmDash’s is architectural. For a new project, architectural lock-in is acceptable if the architecture is better. You are not migrating a production site. You are building from scratch.<\/p>\n

The Framework \u2013 “Ecosystem Debt” vs. “Architecture Equity”<\/h2>\n

Here is the mental model: Every CMS choice<\/a> involves a trade-off between ecosystem debt and architecture equity.<\/p>\n

WordPress has enormous ecosystem debt. You inherit 60,000 plugins, but you also inherit their vulnerabilities, their update cycles, their compatibility issues, and their licensing constraints. That debt compounds over time. The more plugins you install, the more debt you accrue.<\/p>\n

EmDash has low ecosystem debt. You start with zero plugins, but you also start with zero vulnerabilities, zero update friction, and zero license headaches. You build architecture equity: a sandboxed runtime, a modern frontend stack (Astro, TypeScript), and an AI-native API. That equity compounds as you add features that are designed into the core, not bolted on.<\/p>\n

For a new project, you want to minimize ecosystem debt and maximize architecture equity. EmDash wins on both dimensions. WordPress wins only if you need a plugin that does not exist in EmDash’s core and cannot be built quickly with AI.<\/p>\n

The Honest Take \u2013 Who Should Start on EmDash Today<\/h2>\n