Cloudflare recently announced the preview of EmDash, a new open-source CMS it describes as a “spiritual successor to WordPress” Designed to rebuild the CMS model around a serverless, developer-focused architecture, EmDash includes AI-native features, developer tooling, and migration paths from WordPress, sparking debate across the WordPress and broader CMS community about architecture choices, security trade-offs, and potential platform lock-in.
Built in TypeScript and powered by Astro 6.0, EmDash runs on edge platforms and isolates plugins in secure sandboxes (Dynamic Workers) with explicit permissions. This aims to address the long-standing security risks posed by WordPress plugins while enabling automatic scaling and pay-per-use compute.
Matt “TK” Taylor, senior product manager at Cloudflare, and Matt Kane, senior principal systems engineer at Cloudflare, explain the reason behind the project:
WordPress powers over 40% of the Internet. It is a massive success that has enabled anyone to be a publisher, and created a global community of WordPress developers. But the WordPress open source project will be 24 years old this year. Hosting a website has changed dramatically during that time. When WordPress was born, AWS EC2 didn’t exist.
Cloudflare argues that WordPress plugin security is weakened because plugins typically have full access to a site’s files and database, and that about 96% of WordPress security vulnerabilities stem from third-party plugins. While a vulnerable or malicious plugin can compromise an entire website, Taylor and Kane explain how EmDash addresses this differently:
Plugins are securely sandboxed and can run in their own isolate, via Dynamic Workers, solving the fundamental security problem with the WordPress plugin architecture. And under the hood, EmDash is powered by Astro, the fastest web framework for content-driven websites.
With built-in agent support, MCP server integration, and programmable interfaces, EmDash is currently a v0.1.0 developer preview and can be deployed to Cloudflare or any Node.js server. The hyperscaler claims that while EmDash aims to be compatible with WordPress, no WordPress code was used in its creation, allowing for a more permissive open source license.
By design, EmDash themes are standard Astro projects, covering pages, layouts (shared HTML structure), components, styles, and a seed file, a JSON file that tells the CMS what content types and fields to create. EmDash provides x402 support, enabling site owners to charge AI agents or any HTTP client for content access on a pay-per-use basis, with no subscription infrastructure or custom engineering required.
Source: Cloudflare blog
EmDash is designed to be managed programmatically by AI agents through three built-in primitives: Agent Skills (to describe CMS capabilities, plugin hooks, and guidance on structuring plugins or porting WordPress themes), EmDash CLI for programmatic interaction, and a built-in MCP server that exposes the same capabilities as the Admin UI to any MCP-compatible client.
While acknowledging some technical merits, Matt Mullenweg, co-founder of WordPress and CEO of Automattic, suggests that “EmDash was created to sell more Cloudflare services,” notes that its plugin security only works on Cloudflare, and argues it is unlikely to be a true “spiritual successor.” Mullenweg writes on his personal blog:
There’s a new CMS every other day. And that’s great! I love building CMSes and I totally get why other people do, to (…) Some day, there may be a spiritual successor to WordPress that is even more open. When that happens, I hope we learn from it and grow together. (…) The closest thing I’ve seen to a spiritual successor isn’t another CMS, it’s been OpenClaw.
As EmDash was announced on April 1st, some developers initially questioned whether it was an April Fool’s joke. On a popular Hacker News thread, some users see EmDash as “the polar opposite of the direction CMSs need to go”, while user earthlingdavey comments:
I’ve worked with WordPress on and off for 10 years, and I’m convinced that this project has got 2 things absolutely spot on. TypeScript and Worker plugins.
One common concern is that EmDash includes a graphical interface for managing content but does not yet offer a point-and-click website builder like those found in many modern CMS platforms. Discussing “6 Reasons Why Cloudflare’s EmDash Can’t Compete With WordPress,” Roger Montti, search marketing consultant, summarizes:
I was quite excited to read Cloudflare’s announcement about a “spiritual successor” to WordPress, but the more I read, the more it became apparent that EmDash is not the solution I am looking for (…) Hopefully, someday it will be a viable competitor to WordPress, but EmDash is not that right now.
EmDash is open source and available on GitHub under an MIT license.
