EmDash or WordPress: Navigating the New Era of Web Development

The web development world is talking about EmDash, Cloudflare’s newly announced open-source CMS. It was released on April 1, 2026 by Senior Product Manager Matt Taylor and Senior Principal Systems Engineer Matt Kane.

This serverless platform challenges WordPress directly. WordPress currently powers over 42.5% of all websites and nearly 60% of all CMS-driven sites on the internet. For agencies, developers, and content teams, the question is simple: Is it time to switch, or does WordPress still win?

EmDash was built in just two months with heavy use of AI coding agents. This is the same approach Cloudflare used to rebuild Next.js in a single week with its vinext project. Kane confirmed the project is real, not an April Fools joke: “Name is a joke but the project is real.”

The Origin Story: Why Cloudflare Built EmDash

WordPress was born in 2003, before AWS EC2 even existed. Back then, hosting a website meant renting a virtual private server. Over the following two decades, the web changed dramatically. You can now upload a JavaScript bundle to a globally distributed network at almost no cost. Yet WordPress’s core architecture stayed largely unchanged.

Cloudflare describes EmDash as the “spiritual successor to WordPress,” not a fork of it. No WordPress code was used. This allowed Cloudflare to release EmDash under the more permissive MIT license rather than WordPress’s GPL license. For enterprises with legal teams wary of GPL obligations, Kane noted: “For a lot of enterprises, GPL software is free only if your lawyers are free.”

The Core Difference: Infrastructure vs. Innovation

WordPress is a monolithic system built on PHP and MySQL. It is reliable and familiar, but can be slow without careful optimization and caching layers. EmDash takes a different architectural approach. It is fully serverless, built on Cloudflare Workers’ V8 isolate architecture, the same JavaScript engine that powers Google Chrome.

EmDash runs on Cloudflare’s global edge network. Your site is served from a location close to each visitor, enabling fast load times without complex caching plugins. EmDash also uses a scale-to-zero model. The system activates only when requests arrive and idles when there is no traffic. Billing is based on actual CPU compute time, not pre-allocated server capacity.

Security: The Crisis That Sparked EmDash

Security is where the two platforms differ most. It is also the main reason EmDash was built.

The WordPress Security Problem

According to Patchstack data cited by Cloudflare, 96% of WordPress security vulnerabilities come from plugins. This problem is getting worse. In 2025 alone, more high-severity vulnerabilities were found in the WordPress ecosystem than in the two prior years combined.

The root cause is architectural. A WordPress plugin is a PHP script that hooks directly into WordPress core. It gets unrestricted access to the site’s database and filesystem. There is no isolation. Installing a plugin means trusting it completely.

This risk has forced WordPress.org to manually review every plugin submitted to its marketplace. At the time of EmDash’s announcement, that review queue had over 800 plugins, with a wait time of at least two weeks. Developers rely on reputation and ratings as a trust signal, not any architectural guarantee.

EmDash’s Solution: Dynamic Workers and Capability-Based Security

EmDash solves this with a different architecture. Each plugin runs in its own isolated sandbox called a Dynamic Worker. Instead of granting direct database and filesystem access, EmDash only gives a plugin the specific capabilities it declares in its manifest file. This works like OAuth scopes.

For example, a plugin that sends a notification email after content is published must declare only two capabilities: read:content and email:send. It cannot access the database, the filesystem, or make external network calls beyond what is explicitly permitted. If it needs to call an external API, it must declare the exact hostname. Nothing else is accessible.

This also removes marketplace lock-in. Because plugins are sandboxed and have declared permissions, platform administrators can make trust decisions based on what a plugin requests, not just its marketplace reputation. Plugin authors also choose their own license. No GPL inheritance is forced on them.

Authentication: Passkeys by Default

EmDash uses Passkeys as the default authentication method, with a fallback to emailed magic links. Traditional username and password login is not supported. This reflects a modern, phishing-resistant security approach.

Under the Hood: The Technical Stack

Built on Astro 6.0: EmDash’s theming system is powered by Astro, which Cloudflare acquired in January 2026. Cloudflare describes it as the fastest web framework for content-driven websites. Themes are Astro projects made up of standard pages, layouts, components, CSS, and a seed file defining content types. This makes theme development familiar to modern TypeScript developers. Large language models are already well-trained on Astro, making EmDash themes more AI-friendly than WordPress counterparts.

D1 Edge SQLite: Instead of MySQL, EmDash uses Cloudflare’s D1, an SQLite database that runs at the edge alongside the site. No remote database round-trips.

Portable Text (Structured JSON): Content is stored as structured JSON rather than raw HTML with block editor comments. This makes it cleaner to parse, migrate, and process.

Native MCP (Model Context Protocol): Unlike WordPress, which relies on third-party plugins to connect AI models, EmDash has native MCP support. This lets AI agents directly manage and interact with site content through a standardized protocol.

x402 Micropayments: Every EmDash site includes built-in support for x402, an open standard for internet-native payments. Website operators can charge for content access without extra development, including billing AI agents and automated clients on a pay-per-use basis.

Self-Hosting: EmDash can be deployed to a Cloudflare account or run on any Node.js server. Sandboxed plugins currently only work on Cloudflare’s infrastructure, which is a limitation for those who prefer to fully self-host.

User Experience and Ecosystem: Where WordPress Still Wins

WordPress leads in creative freedom and accessibility. With visual page builders like ElementsKit and Elementor, non-developers can design high-performance websites. The ecosystem includes over 60,000 plugins and thousands of themes covering SEO, e-commerce, and more.

EmDash is a developer-first platform in its current state. It requires knowledge of TypeScript and Astro. Its architecture is faster and more secure, but it has no plugin ecosystem yet, no established community, and no visual drag-and-drop builder. Critics have noted that its UI sits in an “uncanny valley,” familiar enough to feel intentional but unpolished enough to feel unfinished. Its use of TinyMCE as an editor feels like a step backward to many. Matt Mullenweg, WordPress’s co-founder, suggested EmDash should adopt Gutenberg, which WordPress created and explicitly licensed for use by other CMSes, and “build from first principles.”

EmDash’s AI-friendliness is a real advantage. It is built on Astro and TypeScript, frameworks AI models are already well-trained on. An AI agent can more easily scaffold and build a new EmDash site compared to a WordPress site. Documentation is also structured for machine consumption.

Migrating from WordPress: What to Expect

EmDash ships with a WordPress migration tool, but it only imports content such as posts, pages, and media. Here is what does and does not transfer:

Content and media: Transferable, though custom post types require manual schema creation in EmDash.

Plugins: Not compatible. WordPress plugins are PHP scripts. EmDash requires native TypeScript plugins with sandboxed architecture. The ecosystem is new, so equivalents may not yet exist.

Themes: Not directly compatible. WordPress themes rely on PHP templating and functions.php. Cloudflare provides an Agent Skill to help port themes to Astro and EmDash.

EmDash is not yet suitable for migrating production WordPress sites. It is best tested on new projects during this v0.1.0 developer preview phase.

Feature Comparison at a Glance

Real-World Criticisms and Early Reactions

Developer reception has been mixed but engaged. Beyond Mullenweg’s feedback, technical reviewers have flagged several rough edges:

The admin UI feels like an “uncanny valley,” familiar but unfinished. TinyMCE as the content editor is seen as a step back from modern block editors. Passkey authentication, while forward-thinking, had issues in early testing on Linux setups. When self-hosting on Node.js outside Cloudflare, sandboxed plugin support is not available. EmDash is a direct marketing vehicle for Cloudflare Workers, which some in the open-source community view with skepticism, even if the platform is not technically locked in.

The Verdict: Which Should You Choose?

The choice depends on your goals.

Choose WordPress if:

You need to launch quickly with a rich feature set. Your team relies on visual builders and non-developer workflows. You need one of tens of thousands of existing plugins for e-commerce, SEO, membership, or other functionality. You are running a content-heavy site, news publication, or standard business page. You cannot wait for an ecosystem to mature.

Choose EmDash if:

You are building a specialized application where security and performance are top priorities. Your team knows TypeScript and modern JavaScript frameworks like Astro. You want to move away from traditional server hosting and go serverless. You are building AI-native products that benefit from native MCP support and pay-per-use micropayments. You are a developer who wants to contribute to a new open-source CMS from the ground up.

Conclusion: A Glimpse Into the Future of the Web

EmDash is not a “WordPress killer,” not yet, and perhaps not ever in that framing. It is a well-considered proposal for how a modern CMS should be built: secure by design, serverless by default, AI-native from day one, and free from two decades of backward-compatibility baggage.

For most users, WordPress remains the practical, proven choice. Its ecosystem, community, and accessibility are hard to match. But for developers building the next generation of web applications, EmDash points clearly to where the web is heading.

The smart move today is to keep using WordPress for production sites while watching and potentially contributing to EmDash’s development. Try it on new projects. Give feedback. The project is available on GitHub under the MIT license and a playground is accessible at emdashcms.com.