Cloudflare EmDash CMS: Is It Really a WordPress Killer? (We Tested It)

What Just Happened

Cloudflare just dropped a bomb on the web development world. On April 1st — and no, it wasn't a joke — they released EmDash, an open-source CMS they're calling "the spiritual successor to WordPress." Built entirely in TypeScript, running on Astro 6.0, with free serverless hosting on Cloudflare Workers.

The internet is divided. WordPress loyalists are calling it vaporware. Developers are calling it the future. Matt Mullenweg (WordPress creator) published a response within 24 hours. We deployed it ourselves, built a real website, tested the admin panel, and pushed it to production. Here's what we found.

What Is EmDash?

EmDash is a full-stack TypeScript CMS built on Astro 6.0 that runs natively on Cloudflare's serverless infrastructure. It takes the core ideas that made WordPress dominant — extensibility, admin UX, a plugin ecosystem — and rebuilds them on modern foundations. No PHP. No provisioned servers. No plugin security nightmares.

The technical stack: Cloudflare Workers for compute, D1 for the database, R2 for storage, Astro for the frontend framework, and Portable Text (structured JSON) instead of serialized HTML for content storage. Everything runs serverless with scale-to-zero billing — your site costs nothing when nobody's visiting it.

It's MIT licensed (not GPL like WordPress), v0.1.0 beta, and you can deploy it right now with npm create emdash@latest.

The Plugin Security Fix (This Is the Big Deal)

This is the headline feature, and it's genuinely significant. 96% of WordPress security vulnerabilities come from plugins. In 2025 alone, more high-severity WordPress plugin vulnerabilities were found than the previous two years combined. The reason is architectural: a WordPress plugin is a PHP script with full access to the database, filesystem, and user data. Install one bad plugin and your entire site is compromised.

EmDash fixes this at the architecture level. Each plugin runs in its own isolated Worker sandbox via Cloudflare's Dynamic Workers. Instead of full system access, plugins declare exactly what capabilities they need in a manifest:

definePlugin({
  id: "notify-on-publish",
  capabilities: ["read:content", "email:send"],
  hooks: {
    "content:afterSave": async (event, ctx) => {
      if (event.content.status !== "published") return;
      await ctx.email.send({
        to: "editors@example.com",
        subject: `New post: ${event.content.title}`,
      });
    },
  },
});

This plugin can read content and send emails. That's it. No database access, no filesystem, no network calls to arbitrary servers. Even if the plugin has a vulnerability, the blast radius is contained to its declared capabilities. This is the OAuth model applied to CMS plugins — you know exactly what you're granting before you install.

The second-order effect is equally important: because plugins are sandboxed, they don't need a centralized marketplace for trust. WordPress.org manually reviews every plugin (800+ in the queue, 2-week wait). EmDash plugins can be distributed from anywhere — NPM, GitHub, direct URLs — because the security model itself provides the trust boundary.

Building a Real Site with EmDash

We tested this hands-on. Here's what the actual experience looks like.

Step 1: Scaffold

npm create emdash@latest

This prompts you to choose a template (Blog, Marketing, or Portfolio), configure your database (D1 for Cloudflare, SQLite for local), and sets up the project structure. The whole process took about 90 seconds.

Step 2: Local Development

pnpm dev

The admin panel lives at localhost:4321/_emdash/admin. It's clean and functional — visual schema builder, media library with drag-drop uploads, navigation menus, taxonomies, and a rich text editor powered by TipTap. Feels somewhere between WordPress and a modern headless CMS like Contentful.

Step 3: Deploy

Deploying to Cloudflare is a single click from the dashboard or wrangler deploy from the CLI. The site goes live on Cloudflare's global network — 300+ edge locations, automatic SSL, DDoS protection, and scale-to-zero billing. Our test site loaded in under 200ms from three different continents.

Key Features

EmDash vs WordPress: Full Comparison

Who Should Switch (And Who Shouldn't)

Our honest take: EmDash is technically impressive and solves real problems that WordPress can't. But calling it a "WordPress killer" at v0.1.0 is premature. WordPress powers 40% of the web with 23 years of battle-tested plugins, themes, and community knowledge. EmDash will need years to build a comparable ecosystem. For now, it's best suited for developers starting new projects who want modern architecture — not for migrating existing production sites.

That said, if you're building a content-focused site and already use Cloudflare, the combination of free hosting, TypeScript, Astro, and sandboxed security is genuinely compelling. We built our test site in under 30 minutes and deployed it for $0. For context on how we build sites, see our guide to vibe coding and our Claude Code complete guide.