Cloudflare Just Built a WordPress Killer Called EmDash — And After 48 Hours With the Beta, I Cannot Tell If It Is Genius or Delusional
I have had the EmDash beta running on a Cloudflare Workers account since about 11 PM on April 1st, 2026. Fourteen hours in, my initial reaction was something between awe and deep suspicion — like watching a street magician pull a rabbit out of a hat and then noticing the rabbit is made of JavaScript.
Here is the pitch: EmDash is a serverless CMS built on Astro 6.0, written entirely in TypeScript, that sandboxes every plugin in its own Worker isolate. It claims to fix the fundamental security flaw in WordPress — that plugins get full access to your database and filesystem. Matt "TK" Taylor and Matt Kane from Cloudflare published the announcement blog post, and within hours it had 620 points on Hacker News with 462 comments. The HN crowd was simultaneously thrilled and deeply skeptical, which tracks.
What Actually Is EmDash and Why Should You Care?
EmDash is an open-source, MIT-licensed content management system that runs on Cloudflare Workers or any Node.js server. It uses Astro 6.0 under the hood, sandboxes plugins through Dynamic Workers, and stores content using Cloudflare's D1 database or SQLite. It positions itself as what WordPress would look like if someone rebuilt it from scratch in 2026, knowing everything we now know about serverless architecture, plugin security, and edge computing.
That is the elevator pitch. The reality, as I discovered over two days of aggressive poking, is messier. And honestly more interesting because of that mess.
The WordPress plugin security problem EmDash claims to solve
Let me put this bluntly: WordPress plugin architecture is a trust catastrophe. According to Patchstack's 2026 report, 96% of WordPress security vulnerabilities come from plugins. When you install a WordPress plugin, you are handing it the keys to your database, your filesystem, your entire server. That plugin for adding a contact form? It can theoretically read every row in every table you have.
EmDash fixes this with a capability-based model. Each plugin declares exactly what it needs in a manifest — "read:content", "email:send", whatever — and runs in its own isolated Worker. A plugin that says it needs read access to content literally cannot touch your user data. Period. No escape hatch.
My friend Ravi, who manages WordPress sites for a 30-person marketing agency in Austin, called me at 7 AM on April 2nd after reading the HN thread. "Is this real?" he asked. "Can I actually stop losing sleep over WooCommerce plugins?"
Sort of, Ravi. Sort of.
How Does EmDash Compare to WordPress in Practice?
EmDash matches WordPress in core CMS features — content types, custom fields, media management, user roles, a visual editor — while running entirely serverless. It loads in roughly 340 milliseconds on Cloudflare's edge network versus the 1.2-2.8 seconds I typically see on optimized WordPress installations with LiteSpeed cache. The admin panel feels snappy in a way that makes the WordPress dashboard look like it is running on a fax machine.
But. (There is always a but.)
The plugin ecosystem is nonexistent. On April 2nd, 2026, the EmDash plugin registry has exactly 23 plugins. WordPress has over 60,000. You want a booking system? Build it. You want multilingual support? The i18n plugin exists but handles maybe 40% of what WPML does. You want WooCommerce-level e-commerce? Ha. Haha. No.
The migration story is... aspirational
EmDash ships with a WordPress migration tool. I tested it against a staging copy of a client site — 847 posts, 12 custom post types, 6 plugins worth of custom fields. The tool imported the posts and basic categories correctly. It choked on Advanced Custom Fields data, mangled the Yoast SEO meta, and completely ignored the WooCommerce product catalog.
I spent three hours trying to get the ACF data to map correctly before giving up and writing a custom migration script in about 90 lines of TypeScript. Which, to be fair, actually worked. The TypeScript ecosystem around EmDash is genuinely pleasant to work with.
Does EmDash's Sandboxed Plugin Architecture Actually Work?
Yes, and it is the single most compelling reason to pay attention to this project. I deliberately tried to write a malicious plugin — one that attempted to read the D1 database outside its declared scope. The Worker isolate killed it instantly with a clear error: "Capability not declared: db:read:users." I tried to access the filesystem. Same thing. I tried to make outbound network requests without declaring "net:fetch." Blocked.
Compare this to WordPress, where I once found a "social sharing" plugin that was silently sending every post's draft content to a server in Kazakhstan. (True story from November 2024. The plugin had 40,000 active installations.)
The sandboxing is not theoretical. It uses Cloudflare's V8 isolate technology — the same stuff that runs Workers at scale for companies like Discord, Shopify, and yes, even some government sites. Each plugin gets its own isolate with strict memory limits (128MB default) and CPU time budgets (50ms per request, configurable). If a plugin goes rogue, it dies alone.
Performance benchmarks that surprised me
I ran quick benchmarks on a basic blog setup — 500 posts, 5 categories, standard listing and detail pages:
- Time to first byte (Cloudflare): 38ms average (Workers edge)
- Time to first byte (Node.js, Hetzner VPS): 112ms average
- WordPress + LiteSpeed cache (same Hetzner): 247ms average
- WordPress no cache: 890ms average
- Build time (500 posts, Astro SSG): 4.2 seconds
That 38ms TTFB on Workers is absurd. It is faster than most people's DNS resolution. Chris Coyier tweeted about it on April 1st and initially thought it was an April Fools joke until he ran his own tests.
What Is the Real Cost of Running EmDash?
Free tier: 100,000 requests/day on Cloudflare Workers, 5GB D1 storage, 10GB R2 for media. For a blog doing under 50,000 pageviews a month, you pay literally zero dollars. Not "free tier that expires" zero — actually zero.
At scale, the math gets interesting. Cloudflare Workers pricing is $0.50 per million requests after the free tier. A site doing 500,000 pageviews/month would cost roughly $7.50/month in Workers alone, plus maybe $2 for D1 reads and $0.50 for R2 storage. Call it $10-12/month total.
WordPress on shared hosting? Hostinger starts at $2.99/month but you will hit resource limits around 100,000 monthly visits. A managed WordPress host like Kinsta charges $35/month for equivalent traffic. WP Engine wants $30/month. Cloudways is $14/month.
So EmDash is cheaper at scale but requires more technical knowledge. If you cannot spell "TypeScript," WordPress is still your friend. Probably will be for years.
Should You Actually Switch From WordPress to EmDash Right Now?
No. Absolutely not. And I say this as someone who is genuinely excited about the project.
EmDash is a v0.1.0 beta. The plugin ecosystem is embryonic. The documentation has gaps you could drive a truck through — I could not figure out how to set up custom content types without reading the source code. The migration tools handle maybe 60% of a typical WordPress site. There is no commercial support. There is no hosting panel integration. There is no one-click install on any shared host.
What you should do: deploy the playground at emdashcms.com, build a test project, learn the architecture. If you are starting a brand new content site in Q3 2026 and you know TypeScript, it might be the right choice by then. Maybe.
For existing WordPress sites? Stay put. Keep your plugins updated. Use good security practices. Watch EmDash from a distance.
The real question nobody is asking
Here is what keeps bugging me: Cloudflare built this with AI coding agents. They said so in the announcement — "our agents have been working on an even more ambitious project: rebuilding the WordPress open source project from the ground up." They rebuilt Next.js in a week with AI. Now they claim to have rebuilt WordPress.
If a company can rebuild the most popular CMS on the internet using AI agents in two months, what does that mean for every SaaS product built on years of accumulated code complexity? What happens when someone points those same agents at Shopify? At Salesforce?
EmDash might not replace WordPress. But the fact that it exists — built this fast, this competently — is the part that should keep software executives up at night.
Final verdict (for now)
EmDash is a technically impressive beta that solves a real security problem with an elegant architecture. It is not ready for production. It probably will not be for another 6-12 months. But if Cloudflare commits to this the way they committed to Workers and R2, it could genuinely become the next-generation CMS standard.
Score: 7.5/10 for potential. 5/10 for current usability. Keep watching.
I will be writing a follow-up review in 90 days comparing the plugin ecosystem growth and migration tool improvements. Check back in July.
