{"id":98040,"date":"2026-10-08T00:38:00","date_gmt":"2026-10-08T04:38:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=98040"},"modified":"2026-09-29T07:58:22","modified_gmt":"2026-09-29T11:58:22","slug":"emdash-plugin-sandbox-cost-98040","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/emdash-plugin-sandbox-cost-98040\/","title":{"rendered":"The Real Cost of EmDash\u2019s Plugin Sandbox"},"content":{"rendered":"

You\u2019ve read the headlines. Plugins run in isolated V8 isolates. No more WPDB<\/code>codecodecodecode-level access. Security solved. But the cost model behind that sandbox is the part nobody is talking about on launch day.<\/p>\n\n

The $5\/month paid plan is the entry fee. The real<\/a> expense lives in the metering.<\/p>\n\n

Every Plugin Invocation Is a Billable Event<\/h2>

WordPress plugins run in the same PHP process. One server, one bill. EmDash flips that: each plugin hook triggers a separate Dynamic Worker invocation. That worker spins up, executes, and spins down. You pay per request and per CPU millisecond.<\/p>\n\n

A single page load that fires three hooks\u2014say, a content filter, an email notification, and a logging routine\u2014generates three separate Worker invocations. Plus the base page render itself. That\u2019s four billable events for one visitor.<\/p>\n\n

Now add D1 database reads. Each plugin that queries content triggers a row-read charge. R2 storage operations for media. KV lookups for plugin state. A single user action can hit five different Cloudflare<\/a> billing meters simultaneously.<\/p>\n\n

The free tier includes 10 million Worker requests. That sounds generous until you run a site with a contact form, an analytics tracker, and a caching plugin. A modest blog with 50,000 page views per month and three active plugins easily burns 200,000+ Worker invocations. On the paid plan, after the included 10 million, you pay $0.30 per additional million requests plus CPU time. That\u2019s negligible for low traffic. But it scales linearly with every spike.<\/p>\n\n

The $5 Floor, the $13,000 Ceiling<\/h2>

A forum post that surfaced shortly after launch calculated the worst case: a basic DDoS attack using 10,000 distinct IPs, each making one request per second<\/a>, could rack up 26 billion requests in a month. At $0.30 per million after the free allowance, that\u2019s roughly $7,800 in Worker charges alone. Add D1 and R2 operations, and the total crosses $13,000.<\/p>\n\n

Cloudflare offers no global spending cap. You can set CPU time limits per request and rate-limiting rules per IP, but a distributed bot attack bypasses IP-based caps trivially. The site stays online, the workers keep firing, and the meter keeps running.<\/p>\n\n

Compare that to a $20\/month shared WordPress host. Under the same attack, your site crashes. Your bill doesn\u2019t change. That\u2019s not a bug\u2014it\u2019s a fundamental difference in risk profile.<\/p>\n\n

Self-Hosting Kills the Feature That Justifies the Cost<\/h2>

If you self-host EmDash on a Node.js server to avoid Cloudflare\u2019s variable billing, you lose the plugin sandbox entirely. Plugins run in-process, with no isolation. The security advantage evaporates. You\u2019re left with a brand-new CMS that has zero plugin ecosystem and no security edge over WordPress.<\/p>\n\n

So the architecture forces you onto Cloudflare\u2019s runtime. The code is MIT-licensed, but the sandbox is proprietary infrastructure. Vendor lock-in by design.<\/p>\n\n

The 402 Twist: Per-Use Plugin Pricing<\/h2>

EmDash includes a built-in 402 payment protocol. Plugin authors can charge per invocation instead of per download or per subscription. A plugin that sends transactional emails could bill $0.001 per email. A form plugin could charge per submission.<\/p>\n\n

For a small blog, that\u2019s pennies. For a high-traffic ecommerce site with thousands of orders a day, the cost compounds fast. And it\u2019s unpredictable\u2014you don\u2019t know which plugins will spike in usage until they do.<\/p>\n\n

This is a paradigm shift from WordPress, where you pay a flat fee for a plugin license regardless of usage. EmDash\u2019s model rewards low-traffic sites and punishes successful ones.<\/p>\n\n

What the Practitioner Needs to Watch<\/h2>