{"id":98082,"date":"2026-10-12T03:02:00","date_gmt":"2026-10-12T07:02:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=98082"},"modified":"2026-09-29T08:13:11","modified_gmt":"2026-09-29T12:13:11","slug":"write-emdash-plugin-tutorial-98082","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/write-emdash-plugin-tutorial-98082\/","title":{"rendered":"How to Write an EmDash Plugin: A Step-by-Step Tutorial"},"content":{"rendered":"

Cloudflare’s EmDash CMS<\/a> launched on April 1, 2026, and the first question from every WordPress developer was the same: How do I write a plugin for it?<\/em> The answer is radically different from what you know. WordPress plugins get full access to your database, file system, and user sessions\u2014one compromised plugin and your entire site is exposed. In 2025 alone, security researchers disclosed 11,334 new WordPress vulnerabilities, and 96% of all WordPress security issues trace back to plugins. EmDash fixes this architecturally: every plugin runs in its own V8 isolate via Cloudflare’s dynamic workers, with permissions declared upfront in a capability manifest. A plugin that declares read:content<\/code>codecodecode and email:send<\/code>codecodecode can literally do nothing else\u2014no database queries, no file system access, no unrestricted network calls.<\/p>\n

This tutorial walks you through writing your first EmDash plugin from scratch. You’ll build a “Notify Admin on New Post” plugin that sends an email when a post is published. By the end, you’ll understand the security model, the hook system, and how to deploy your plugin to Cloudflare’s runtime.<\/p>\n

What Makes EmDash Plugins Different?<\/h2>\n

The fundamental difference is isolation. In WordPress, a plugin is a PHP script that sits alongside the core code. It calls global wpdb<\/code>codecodecode and has unrestricted access to every table. In EmDash, plugins run in their own dynamic worker\u2014a lightweight, hardware-isolated V8 isolate that spins up in milliseconds and disappears when done. The plugin cannot touch your database, your theme, or other plugins unless the capability manifest explicitly grants it.<\/p>\n

Here’s what that looks like in practice. A typical WordPress contact form plugin can read, write, and delete anything. An EmDash plugin with the same feature declares exactly two capabilities: read:content<\/code>codecodecode (to read existing pages) and email:send<\/code>codecodecode (to send notifications). The runtime enforces these boundaries. If a compromised update tries to read password hashes or phone home to an external server, the isolate physically blocks it. This is not policy\u2014it’s architectural enforcement. V8 isolates, Linux namespaces, seccomp filters, and hardware memory protection keys all work together.<\/p>\n

The downside? Full sandboxing requires Cloudflare’s dynamic workers, which are only available on the Workers Paid plan ($5\/month). On the free tier or when self-hosting on a Node.js<\/a> server, plugins run in-process without isolation. EmDash is open source under MIT, but the headline security feature depends on Cloudflare’s runtime.<\/p>\n

Prerequisites<\/h2>\n

Before you start, you need:<\/p>\n