Cloudflare Launches EmDash, An Open Source CMS Built To Replace WordPress

Cloudflare has released an early developer preview of EmDash, a new open source content management system that the company describes as a “spiritual successor” to (the tremendously popular) WordPress, built from the ground up in TypeScript with a focus on addressing the plugin security vulnerabilities that, they say, “have plagued the WordPress ecosystem for years.”

The project, which Cloudflare says was built over two months using AI coding agents, is fully open source under the MIT licence and can be deployed on Cloudflare’s global network or on any Node.js server.

WordPress currently powers more than 40 per cent of websites globally. EmDash does not use any WordPress code but aims to be compatible with WordPress functionality, allowing organisations to migrate existing sites to the new platform.

Plugin Security As The Core Problem

The central pitch for EmDash centres on what Cloudflare describes as a fundamental flaw in WordPress’s plugin architecture.

In WordPress, a plugin is a PHP script that hooks directly into the platform’s core. It has direct access to the site’s database and filesystem, with no isolation between the plugin and the rest of the site. According to Cloudflare, 96 per cent of security issues for WordPress sites originate in plugins. The company noted that in 2025, more high-severity vulnerabilities were found in the WordPress ecosystem than in the previous two years combined.

“When you install a WordPress plugin, you are trusting it with access to nearly everything, and trusting it to handle every malicious input or edge case perfectly,” the company wrote in a blog post authored by Matt “TK” Taylor and Matt Kane.

EmDash takes a different approach. Each plugin runs in its own isolated sandbox using what Cloudflare calls a Dynamic Worker. Rather than granting plugins direct access to underlying data, EmDash provides capabilities via bindings based on what the plugin explicitly declares it needs in a manifest file.

The security model works on a strict guarantee: an EmDash plugin can only perform the actions explicitly declared in its manifest. Cloudflare compared the approach to an OAuth flow, where a third-party application is granted a specific set of scoped permissions.

A plugin that sends an email after content is saved, for example, would declare just two capabilities in its manifest: the ability to read content and the ability to send email. It would have no external network access unless a specific hostname was declared in its definition.

Breaking Free Of Marketplace Lock-In

Cloudflare argued that WordPress’s plugin security problem has created what it characterised as marketplace lock-in for developers.

Because WordPress plugins carry such significant security risks, WordPress.org manually reviews and approves each plugin submitted to its marketplace. At the time of Cloudflare’s announcement, that review queue was more than 800 plugins long with a wait time of at least two weeks.

The vulnerability surface area is so wide that in practice, all parties rely on marketplace reputation, ratings and reviews. And because WordPress plugins run in the same execution context as WordPress itself, some argue they must carry forward WordPress’s GPL licence.

“These realities combine to create a chilling effect on developers building plugins, and on platforms hosting WordPress sites,” Cloudflare wrote.

EmDash plugins have two properties that Cloudflare contends mitigate this lock-in. First, plugins can carry any licence because they run independently of EmDash and share no code. Second, because plugin code runs in a secure sandbox, a plugin can be provided to an EmDash site and trusted without the site ever needing to see the underlying code.

“The more that both sites and platforms can trust the security model to provide constraints, the more that sites and platforms can trust plugins, and break free of centralised control of marketplaces and reputation,” the company wrote.

Built-In Payments For The AI Era

EmDash ships with built-in support for x402, an open standard for internet-native payments. The feature allows any EmDash site operator to charge for access to content on a pay-per-use basis without requiring subscriptions and with no engineering work.

The mechanism works through the HTTP 402 Payment Required status code. A client – such as an AI agent – sends a request, receives the 402 response and pays for access on demand. The server then grants access to the requested content.

Cloudflare positioned this as a response to the changing economics of the web, where AI agents rather than human visitors are increasingly accessing content.

“The business model of the web is at risk, particularly for content creators and publishers,” the company wrote. “The old way of making content widely accessible, allowing all clients free access in exchange for traffic, breaks when there is no human looking at a site to advertise to, and the client is instead their agent accessing the web on their behalf.”

Serverless Architecture

Unlike WordPress, which requires provisioning and managing servers, EmDash is built to run on serverless platforms. On Cloudflare’s infrastructure, it uses the company’s open source workerd runtime. On an incoming request, the Workers runtime spins up an isolate to execute code and serve a response, then scales back down to zero if there are no further requests.

For hosting platforms, Cloudflare argued this architecture resolves the challenge of pre-provisioning instances and running idle compute to handle traffic spikes. The company indicated that millions of EmDash instances could run on Cloudflare using its for Platforms offering, each scaling to zero or up to the required request volume.

EmDash can also be deployed on any Node.js server for organisations that prefer to run it on their own infrastructure.

Astro-Powered Frontend

EmDash uses Astro, a web framework designed for content-driven websites, as its frontend engine. Themes are created as Astro projects that include pages, layouts, components, styles and a seed file that tells the CMS what content types and fields to create.

Cloudflare noted that WordPress themes operate with many of the same security risks as plugins, as they integrate through functions.php, which acts as an all-encompassing execution environment. EmDash themes cannot perform database operations.

AI-Native Management Tools

EmDash is designed to be managed programmatically by AI agents. Each instance includes what Cloudflare calls Agent Skills – descriptions that tell an agent what capabilities EmDash can provide to plugins, the hooks that can trigger them and guidance on structuring plugins or porting legacy WordPress themes.

The platform also includes a CLI that enables agents to interact with local or remote EmDash instances, and a built-in Model Context Protocol (MCP) server for remote management.

Cloudflare framed these tools as a solution to the repetitive work involved in content migration and management.

“The least fun part about working with any CMS is doing the rote migration of content: finding and replacing strings, migrating custom fields from one format to another, renaming, reordering and moving things around,” the company wrote.

WordPress Migration Path

EmDash includes tools for importing existing WordPress sites. Users can either export a WXR file from WordPress admin or install an EmDash Exporter plugin that configures a secure endpoint protected by a WordPress Application Password. Cloudflare indicated that migrating content takes a few minutes and automatically brings attached media into EmDash’s media library.

The platform also supports custom content types natively through schema definitions in the admin panel, creating separate database collections rather than relying on the WordPress approach of fitting custom post types into a single posts table.

Authentication

EmDash uses passkey-based authentication by default, removing passwords from the equation. User management includes role-based access control with administrators, editors, authors and contributors. Authentication is pluggable, allowing integration with existing SSO providers.

Early Developer Beta

EmDash is available now as a v0.1.0 preview. Developers can deploy it to a Cloudflare account, run it on a local Node.js server via the CLI, or try the admin interface through an online playground.

The project is accepting contributions through its GitHub repository.

Whether EmDash gains any traction against the deeply entrenched – and very popular – WordPress ecosystem remains to be seen. WordPress’s 40 per cent market share represents more than two decades of community building, plugin development and institutional knowledge. Migrating that ecosystem – particularly for non-technical users who form a large part of WordPress’s user base – would be a significant undertaking regardless of the technical merits of a new platform.

For hosting platforms, plugin developers and organisations already invested in the Cloudflare ecosystem, however, the combination of a serverless architecture, sandboxed plugins and AI-native tooling may prove compelling enough to warrant evaluation.

Last Updated on April 2, 2026 by Nick Ross