WordPress runs on 62,000 plugins. EmDash runs on zero. That gap looks fatal \u2014 until you understand why it exists.<\/p>\n
Cloudflare<\/a> launched EmDash on April 1st, 2026. It calls the project the spiritual successor to WordPress. The tagline is ambitious. The reality is more complicated. But on one specific axis \u2014 plugin security \u2014 EmDash doesn\u2019t just match WordPress. It makes the 24-year-old architecture look like it was designed in a different century.<\/p>\n Let\u2019s be precise about what\u2019s here today and what\u2019s actually coming.<\/p>\n WordPress\u2019s plugin ecosystem is its superpower and its anchor. 96% of all WordPress security vulnerabilities come from plugins. In 2025 alone, researchers disclosed over 11,000 new vulnerabilities. Nearly half required no authentication to exploit. A single compromised contact form plugin can read your entire database, steal your user table, and start crypto mining on your server.<\/p>\n That\u2019s not a bug. That\u2019s the architecture.<\/p>\n Every WordPress plugin runs in the same process. It calls EmDash solves this by doing something WordPress never could: it isolates plugins at the architectural level.<\/p>\n Every EmDash plugin runs inside its own V8 isolate, powered by Cloudflare\u2019s dynamic workers. The plugin cannot touch your database, your file system, or other plugins unless a capability manifest explicitly permits it.<\/p>\n Here\u2019s what that looks like in practice. A plugin declares its permissions upfront:<\/p>\n “`typescript<\/p>\n definePlugin({<\/p>\n id: “email-notifier”,<\/p>\n version: “1.0.0”,<\/p>\n capabilities: [“read:content”, “email:send”],<\/p>\n hooks: {<\/p>\n “post:publish”: async (context, { post }) => {<\/p>\n if (post.status === “published”) {<\/p>\n await context.email.send({<\/p>\n to: post.author.email,<\/p>\n subject: });<\/p>\n }<\/p>\n },<\/p>\n },<\/p>\n });<\/p>\n “`<\/p>\n That plugin can read content and send email. Nothing else. It cannot delete posts. It cannot query the user table. It cannot make external network calls. The runtime enforces the boundary. A compromised update that tries to read password hashes or phone home to a command server is physically blocked.<\/p>\n This isn\u2019t just policy. It\u2019s hardware-enforced. V8 isolates, Linux namespaces, seccomp filters, and memory protection keys all work together. A plugin that declares Dynamic workers spin up in milliseconds and spin down when idle. No cold starts. No container orchestration overhead. A single runtime instance can run hundreds of thousands of isolates, switching between them seamlessly.<\/p>\n Let\u2019s be honest about where EmDash is right now. Version 0.1.0. Zero third-party plugins. No theme marketplace. No hosting partners outside Cloudflare. The plugin sandbox requires Cloudflare\u2019s paid Workers plan \u2014 $5 a month. Self-host on Node.js and the sandbox disappears.<\/p>\n That\u2019s a real limitation. WordPress has 62,000 plugins. WooCommerce powers 35% of all e-commerce. Elementor runs on 10 million sites. The average WordPress site uses 12 to 15 plugins. EmDash has none of that.<\/p>\n But here\u2019s the thing: the architecture was designed from day one to build an ecosystem, not to inherit one.<\/p>\n WordPress plugins must carry the GPL license. That sounds noble. In practice, it\u2019s a barrier. Enterprises cannot safely mix GPL code with proprietary code without legal review. Developers who want to build commercial plugins face pressure to give away their work for free and charge only for pro features.<\/p>\n EmDash is MIT licensed. No copyleft. No viral clauses. Developers can keep their code closed-source, sell it, license it per-use, or release it under MIT. The choice<\/a> is theirs.<\/p>\n That matters. The GPL friction has kept many commercial developers away from the WordPress ecosystem. EmDash removes it.<\/p>\n EmDash ships with a built-in MCP server and agent skills files. AI coding tools \u2014 Claude, Cursor, GitHub Copilot \u2014 can connect directly to the CMS and generate plugins programmatically.<\/p>\nThe Plugin Paradox: Why WordPress\u2019s Strength Is Its Weakness<\/h2>\n
global $wpdb<\/code>codecodecodecode and gets unfettered access to every table, every file, every user session. There is no sandbox. There is no permission model. Install a plugin, and you hand it the keys to your entire site. The median time from vulnerability disclosure to mass exploitation is five hours.<\/p>\nThe EmDash Plugin Architecture: Sandboxed by Design<\/h2>\n
Your post \"${post.title}\" is live<\/code>codecodecodecode,<\/p>\nread:content<\/code>codecodecodecode and email:send<\/code>codecodecodecode can literally do no more.<\/p>\nThe Ecosystem Today: Zero Plugins, Full Potential<\/h2>\n
The MIT License as a Developer Magnet<\/h2>\n
The AI-Assisted Ecosystem Strategy<\/h2>\n