EmDash by Cloudflare: A New Open-Source CMS Aiming to Fix WordPress Security

At first glance, the April 1st announcement might have sounded like a prank—but it’s very real. Cloudflare has officially introduced EmDash, a brand-new open-source CMS designed as a “spiritual successor” to WordPress.

Built entirely in TypeScript, designed for serverless environments, and powered by Astro, EmDash directly targets one of WordPress’s biggest long-standing weaknesses: plugin security.

A preview version (v0.1.0) is already available on GitHub and can be deployed on Cloudflare Workers or any Node.js server.

The Core Problem: WordPress Plugin Security

WordPress powers over 40% of websites globally—but its plugin system has always been a double-edged sword.

Plugins in WordPress are essentially PHP scripts that run inside the same environment as the CMS itself. This means:

• Full access to the database
• Full access to the file system
• No real isolation between plugins and core

In simple terms, installing a plugin is like handing over full control of your website.

The result? A massive attack surface. Reports show that around 96% of WordPress vulnerabilities come from plugins, and 2025 saw a record-breaking number of critical security flaws—more than the previous two years combined.

EmDash’s Approach: Sandbox Everything

EmDash flips this model entirely.

Instead of running plugins inside the CMS, each plugin operates in its own isolated environment using Cloudflare Workers. This creates a strict permission-based system.

How It Works:

Each plugin must explicitly declare what it needs, such as:

• Read access to content
• Permission to send emails

And that’s it.

No hidden access. No database control. No unrestricted network calls.

This approach is similar to OAuth-style permissions, where you clearly see what an app can and cannot do before approving it.

👉 The result: dramatically reduced risk and far better transparency.

A Familiar Experience for WordPress Users

Despite its modern architecture, EmDash doesn’t reinvent the wheel when it comes to usability.

The admin interface will feel instantly familiar to anyone who has used WordPress:

• Posts
• Pages
• Media library
• Categories and tags

The content editor includes:

• Slug management
• Publishing status
• SEO fields
• Taxonomies

Everything is designed to minimize the learning curve while modernizing the backend.

Modern Frontend with Astro

On the frontend, EmDash uses Astro to deliver fast, clean, and optimized websites.

Themes are built as standalone Astro projects, which means:

• Full separation from CMS logic
• No direct database access
• Better security and performance

This makes EmDash especially appealing to modern frontend developers who prefer clean architectures and component-based workflows.

Easy Migration from WordPress

Switching from WordPress to EmDash is surprisingly straightforward.

EmDash includes a built-in import tool with two options:

1. Direct URL import – Enter your WordPress site URL and fetch content automatically
2. WXR file import – Upload your WordPress export file

The system imports:

• Posts and pages
• Media files
• Custom post types

For users relying on tools like Advanced Custom Fields, EmDash allows you to create custom content types directly within the admin panel, complete with dedicated database structures.

Should You Switch to EmDash Now?

Short answer: Not yet.

EmDash is currently in version 0.1.0—a preview build intended for developers, early adopters, and contributors. It’s not production-ready and shouldn’t replace a stable WordPress setup just yet.

Why EmDash Still Matters

Even in its early stage, EmDash represents a major shift in CMS design:

• Security-first architecture
• True plugin isolation
• Serverless-native deployment
• Modern developer experience

If the project continues to evolve and gains ecosystem support, it could become a serious competitor to WordPress in the near future.

Final Thoughts

EmDash isn’t just another CMS—it’s a bold attempt to rethink how content management systems should work in a modern, security-conscious web.

By sandboxing plugins and embracing serverless infrastructure, Cloudflare is addressing one of the biggest flaws in WordPress’s architecture. While it’s still early days, the direction is promising.

For now, EmDash is best seen as an experimental but exciting project. But if it matures as expected, it could redefine how developers build and secure websites.

Definitely one to watch.