Cloudflare just dropped something interesting. They’re calling it EmDash — an open-source content management system (CMS) they describe as the “spiritual successor to WordPress.”
They announced it April 1st (they swear it isn’t a joke), and it’s positioned as the modern alternative to WordPress. Not so much to fix anything that WordPress got wrong, but more to build what WordPress would look like if they started today, instead of 25 years ago.
Here’s what I’m thinking so far:
What’s compelling about EmDash
WordPress has genuine security problems.
Cloudflare claims 96% of WordPress vulnerabilities originate in plugins. I don’t know where they get that specific data, but there’s not really an argument that plugins aren’t a common source of vulnerabilities in WordPress.
EmDash addresses this by sandboxing plugins so they can’t touch your database or filesystem without explicit permission. That’s genuinely better architecture.
It’s also serverless, meaning you’re not paying for a server sitting idle between visitors. Youonly pay for actual traffic. For sites that scale, that’s a meaningful cost difference.
And it’s AI-native from the ground up. It has a built-in MCP server, agent access, migration tools. Not bolted on as an afterthought.
What gives me pause
The plugin isolation, which is the primary reason to consider this thing, only works on Cloudflare’s infrastructure. Run it somewhere else, and you lose the feature that justifies its existence. Open source in name, Cloudflare-dependent in practice.
It’s also only two months old, built largely with AI coding agents. Impressive speed of development, but not the same as battle-tested. Color me still a bit skeptical about AI coding.
And there’s no plugin ecosystem yet. No community. No one who’s run it through a real production environment for a year and lived to tell about it. These are all things WordPress has in spades.
My take
If you’re on WordPress today, stay there for now. The switching costs are real, and EmDash hasn’t earned the trust yet. But this is worth watching because the problems it’s solving are real, and Cloudflare has the infrastructure muscle to actually follow through.
Check back in 12 months.
