The most common reason WordPress site owners install a plugin is to manage redirects. That plugin, like every other, is a vulnerability vector. In WordPress, plugins have unrestricted access to your database and file system. One compromised redirect plugin can expose your entire site.<\/p>\n
EmDash, Cloudflare’s new CMS, includes redirect management as a core feature. No plugin required. The architecture makes this possible: redirects live at the serverless edge, not in a plugin’s PHP code. Here’s exactly how to create, manage, and test them.<\/p>\n
To create a redirect in EmDash, navigate to the Redirects section in the admin panel, click “Add Redirect”, enter the source URL, target URL, and choose the HTTP status code (301 or 302). No plugin installation, no additional configuration. The redirect runs on Cloudflare’s infrastructure, not inside a plugin sandbox.<\/p>\n
WordPress redirect plugins are a classic example of the plugin paradox. You install one because the core CMS lacks a feature. But that plugin now has full database access. It can read every table, execute arbitrary queries, and connect to external servers. A bug in a redirect plugin can let an attacker exfiltrate your entire user database.<\/p>\n
According to Cloudflare’s analysis, 96% of all WordPress security issues come from plugins. In 2025 alone, researchers discovered over 11,000 new WordPress vulnerabilities \u2014 nearly half exploitable without any authentication. Redirect plugins are part of that problem.<\/p>\n
EmDash solves this by making redirects a first-class feature of the CMS itself. No plugin, no sandbox, no attack surface. The redirect logic runs on Cloudflare<\/a> Workers, which scale to zero when idle and spin up in milliseconds. You get built-in security without sacrificing performance.<\/p>\n The redirect manager lives in the EmDash admin panel under “Manage” > “Redirects”. You’ll see a clean interface with a table of existing redirects. The layout mirrors WordPress conventions, so muscle memory transfers. But the behavior is different \u2014 these redirects are applied at the edge, not in a PHP process.<\/p>\n From this screen you can:<\/p>\n Hit count tracking is built in. You can see which redirects are actually being used and which ones are stale. This data helps clean up old redirects that slow down your crawl budget.<\/p>\n Click “Add Redirect” to open a simple form. You’ll need three pieces of information:<\/p>\n Source URL<\/strong>: The path you want to redirect from. This is relative to your site root. For example, Target URL<\/strong>: The destination. This can be a relative path like HTTP Status Code<\/strong>: Two options \u2014 301 (permanent) and 302 (temporary). 301 tells search engines the page has moved permanently and passes link equity. 302 is for temporary moves where you might revert later. Most sites should use 301.<\/p>\n That’s it. Click “Save” and the redirect is live. No cache purge, no restart, no waiting. The redirect takes effect globally within seconds because it runs on Cloudflare’s edge network across 300+ data centers.<\/p>\nAccessing the Redirect Manager<\/h2>\n
\n
Creating a Redirect<\/h2>\n
\/old-blog-post<\/code>codecodecode or \/about-us<\/code>codecodecode. EmDash automatically handles trailing slashes \u2014 you can include or omit them and the redirect will still match.<\/p>\n\/new-blog-post<\/code>codecodecode or an absolute URL like https:\/\/example.com\/new-page<\/code>codecodecode. Internal redirects resolve faster because they stay within the same Worker context.<\/p>\n