Three CMSs. Three different philosophies. And one newcomer that claims to fix the biggest problem in web publishing: plugin security.<\/p>\n
WordPress<\/a> powers 43% of the internet. Contentful<\/a> pioneered the headless approach. And EmDash CMS, from Cloudflare, launched in April 2025 as a v0.1.0 beta \u2014 calling itself the “spiritual successor to WordPress.”<\/p>\n My position: for most new content-driven websites in 2025, EmDash offers the best balance of security, modern tooling, and cost \u2014 provided you don\u2019t need a massive plugin ecosystem today. The strongest counterargument is that ecosystem gap. I\u2019ll address it head-on.<\/p>\n Let’s break down how these three platforms compare across the dimensions that actually matter.<\/p>\nQuick Comparison: EmDash vs Contentful vs WordPress<\/h2>\n
Feature<\/strong><\/th>\n| EmDash<\/strong><\/th>\n | Contentful<\/strong><\/th>\n | WordPress<\/strong><\/th>\n<\/tr>\n<\/thead>\n\n | Architecture<\/strong><\/td>\n | Full-stack (frontend + backend), serverless on Cloudflare Workers<\/td>\n | Headless (API-only), bring your own frontend<\/td>\n | Monolithic (PHP + MySQL), can be headless with plugins<\/td>\n<\/tr>\n | Security Model<\/strong><\/td>\n | Plugins run in V8 isolates with capability manifests; no direct database access<\/td>\n | No plugin execution; security depends on your frontend implementation<\/td>\n | Plugins have full access to database, file system, and network; 96% of vulnerabilities come from plugins<\/td>\n<\/tr>\n | Ecosystem Size<\/strong><\/td>\n | Zero third-party plugins at launch; 3 starter templates<\/td>\n | Large marketplace of integrations and apps<\/td>\n | 60,000+ plugins, 10,000+ themes<\/td>\n<\/tr>\n | Cost Model<\/strong><\/td>\n | Serverless: $5\/month for sandbox plugins, pay per request after 10M; free tier available<\/td>\n | Free tier (limited), paid plans start at $300\/month for teams<\/td>\n | Hosting $5\u2013$100\/month; premium plugins $50\u2013$500\/year<\/td>\n<\/tr>\n | AI-Readiness<\/strong><\/td>\n | Built-in MCP server, agent skills, CLI; designed for AI agents<\/a> from day one<\/td>\n | API-first, can integrate AI via webhooks or custom apps<\/td>\n | AI plugins exist but retrofitted; no native MCP support<\/td>\n<\/tr>\n | Learning Curve<\/strong><\/td>\n | Familiar WordPress-like admin; requires TypeScript and terminal for setup<\/td>\n | Steep: must learn content modeling, API usage, and frontend framework<\/td>\n | Low for basic use; high for custom development without page builders<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n | The Security Argument: Why EmDash Wins by Design<\/h2>\nWordPress\u2019s biggest strength is also its biggest vulnerability. Every plugin runs in the same process as the core. Install a contact form plugin with a bug, and an attacker can read your entire database. In 2025 alone, researchers disclosed over 11,000 new WordPress vulnerabilities \u2014 91% from plugins.<\/p>\n Contentful avoids this by being headless. You never install plugins that touch your backend. But that means you\u2019re responsible for building and securing your frontend, deploying it, and maintaining that pipeline. For a small blog, that\u2019s overkill.<\/p>\n EmDash takes a different approach. Each plugin runs inside its own V8 isolate, powered by Cloudflare\u2019s dynamic workers. The plugin declares exactly what it needs in a capability manifest. Read content? Send email? That\u2019s all it can do. No file system access, no database queries, no unrestricted network calls. The runtime enforces the boundary at the hardware level.<\/p>\n This isn\u2019t just policy \u2014 it\u2019s architectural enforcement. A compromised plugin cannot pivot to steal password hashes or crypto-mine. It physically cannot.<\/p>\n Ecosystem: The Elephant in the Room<\/h2>\nHere\u2019s the counterargument: EmDash launched with zero third-party plugins. WordPress has 60,000. Contentful has hundreds of integrations. How can EmDash compete?<\/p>\n It can\u2019t \u2014 not yet. But that doesn\u2019t mean it\u2019s a non-starter.<\/p>\n First, EmDash ships with many features that WordPress requires plugins for: SEO, forms, custom content types, redirects, comments with AI moderation. The average WordPress site runs 12\u201315 plugins. A new EmDash site might need one or two.<\/p>\n Second, the migration tool works. You can import your entire WordPress site \u2014 posts, pages, media \u2014 via a WXR file or a dedicated export plugin. For themes and plugins, the built-in MCP server lets AI coding agents generate Astro-compatible templates and sandboxed plugins from your existing code. The MIT license removes the GPL friction that kept commercial developers away from WordPress.<\/p>\n Third, the plugin review queue in WordPress is 800 plugins long and takes weeks to traverse. EmDash\u2019s sandbox model means plugins don\u2019t need centralized approval \u2014 they declare capabilities, and the runtime enforces them. That shifts trust from reputation to architecture.<\/p>\n The ecosystem will take time. But the architecture accelerates it.<\/p>\n Cost: Predictable vs Pay-As-You-Go<\/h2>\nWordPress hosting is predictable \u2014 $20 a month, same bill whether you get 100 visitors or 10,000. But that predictability hides costs: premium plugins, page builders, security subscriptions. A managed WordPress site on WP Engine costs about $525 the first year.<\/p>\n Contentful\u2019s free tier is generous for small projects, but team plans start at $300\/month. Traffic spikes can push you into expensive tiers.<\/p>\n EmDash flips the model. It\u2019s serverless. The paid plan starts at $5\/month and includes 10 million requests. After that, $0.30 per million requests plus CPU time. R2 storage has zero egress fees. A site with 100,000 visits per day uses about 3% of its monthly request allowance.<\/p>\n |
|---|