The structural dilemma of WordPress security issues
Powering more than 40% of the web, WordPress has long faced a structural reality where 96% of its security vulnerabilities stem from plugins. An architecture granting plugins full PHP execution permissions to access the database and file system directly makes them prime targets for attackers.
On April 1, 2026, Cloudflare tackled this challenge head-on by publishing an open-source preview release (MIT license) of a new CMS called EmDash.
EmDash's design philosophy: The three pillars
1. Full-stack TypeScript
While WordPress relies on PHP, EmDash is written entirely in TypeScript. Running as an Astro 6.0 integration, it delivers end-to-end type safety from the frontend to the backend.
2. Sandboxed plugin architecture
EmDash's defining feature is its security model for plugins.
| Item | WordPress | EmDash |
|---|---|---|
| Plugin runtime | Same PHP process | V8 isolate (sandboxed) |
| Database access | Direct access allowed | Restricted (API only) |
| Permission management | None (full access) | Explicitly declared in manifest |
| File system | Direct access allowed | Access disallowed |
Each plugin runs in a strictly isolated environment inside Cloudflare Workers Dynamic Workers. Plugins must explicitly declare permissions such as read:content and email:send in their manifest files, and any operation outside those scopes is strictly blocked.
3. AI-native architecture
EmDash is designed from the ground up with the expectation that AI agents will interact with the CMS.
- Built-in MCP server: Every instance includes a Model Context Protocol server, enabling AI agents to create, edit, and publish articles directly.
- Portable Text: Content is stored as structured JSON rather than raw HTML, allowing AI agents to read and write content without parsing.
- Agent Skills: Built-in documentation enabling AI agents to autonomously develop plugins and migrate content from WordPress.
Setup guide
Trying it out locally
npm create emdash@latestRunning this command launches an interactive setup wizard and starts EmDash backed by a local SQLite database.
Deploying to Cloudflare
One-click deployments via the Cloudflare dashboard are fully supported. The setup automatically provisions D1 (a SQLite-compatible database) and R2 (object storage), operating in a serverless architecture that scales down to zero when idle.
Migrating from WordPress
- Supports importing WXR (WordPress eXtended RSS) files
- Supports direct migration via the EmDash Exporter plugin
Technical architecture deep dive
Database layer
Using Kysely (a type-safe SQL query builder), it supports multiple backends:
- Cloudflare D1 — Serverless SQLite
- Turso — Distributed SQLite
- PostgreSQL — Traditional RDBMS
- Local SQLite — Development environments
Storage layer
Standardized around an S3-compatible API, supporting any of the following backends:
- Cloudflare R2
- AWS S3
- Local file system
License
Released under the MIT license, it is more permissive than WordPress's GPL. Plugin and theme developers are free to choose their own licensing terms.
Community reactions
Positive reactions
When Yoast founder Joost de Valk began migrating his personal site to EmDash, it made waves across the WordPress ecosystem. The plugin security model has drawn widespread praise, with many noting that it addresses WordPress's biggest weakness head-on.
Skeptical viewpoints
- "The WordPress ecosystem took decades to build. It will take significant time before tens of thousands of plugins become available."
- "Announcing a real product on April Fools' Day (April 1) is questionable marketing."
- "There are concerns regarding Cloudflare vendor lock-in" (though documentation explicitly clarifies that it also runs on Node.js).
Overall, the consensus leans toward a realistic appraisal: "The direction is spot on, but the ecosystem is currently empty."
Summary: Should you migrate today?
As EmDash is currently in a v0.1.0 preview release, migrating production sites is premature. However, it is well worth exploring for developers who match these profiles:
- Concerned about WordPress plugin security
- Looking to build full-stack applications with TypeScript
- Interested in integrating CMSs with AI agents
- Looking to optimize operational costs with serverless architecture
Choosing a CMS is a foundational business decision. For a comparison between WordPress and alternative no-code tools, see our detailed guide on how to build websites without code. If you are interested in comparing it with Jamstack architecture, our Jamstack and headless CMS case studies will also serve as a helpful reference.
Try out the playground at emdashcms.com, or set up a local environment with npm create emdash@latest to experience the feel of a next-generation CMS firsthand.
