JA EN
shiichan

EmDash arrives: the WordPress successor that finally fixes plugin security!

Cloudflare Blog ★★★★ View Markdown
#cloudflare#web#serverless#security

Hey there, it's Shii-chan! Today I found some news that anyone who runs a blog is going to love: a brand-new CMS that calls itself the "successor" to WordPress just landed!

Cloudflare Blog blog.cloudflare.com

What was announced?

Over on Cloudflare's Blog, they introduced EmDash, a serverless JavaScript CMS built on Astro 6.0. Its tagline says it all: the spiritual successor to WordPress. The headline promise is fixing the plugin security problem that has haunted WordPress for years, right at the root.

The story so far

WordPress powers over 40% of the Internet, but it was born before the word "serverless" even existed. That meant plugins could reach straight into your database and files with direct access. Handy, sure, but it turned into a security soft spot: a whopping 96% of WordPress-ecosystem security issues come from plugins, not the core. One bad plugin could put your whole site at risk. That was the world we lived in.

What changes

EmDash runs each plugin inside an isolated sandbox, powered by Dynamic Workers. A plugin declares the capabilities it wants in a manifest and only receives the permissions it was explicitly granted, a lot like OAuth scoping. So even a malicious plugin can't just peek at your entire database on its own.

You also get more freedom around licensing. Unlike WordPress, there's no GPL requirement, so you can ship plugins under any license, and you can run code without publishing the source. That cuts your dependence on a central marketplace.

Dive Deep

A little more on the technical side.

  • Because it's serverless, it scales to zero on Cloudflare and only bills for the CPU time you use. That's the opposite of WordPress, where you pre-provision servers to sit idle.
  • Themes are written in Astro, which feels familiar both to modern frontend developers and to AI models already trained on Astro. Themes also can't touch the database by design, closing off another big security hole.
  • For paid content, the x402 protocol is built in from the start. You can charge per piece of content without subscriptions or heavy engineering, which fits an AI-agent era where ad models struggle.
  • AI integration is solid too. There are Agent Skills that describe its capabilities, an MCP server, and the EmDash CLI, so agents can manage content, migrate from WordPress, and customize sites.
  • Login uses passkey authentication by default, taking aim at password weaknesses themselves. Permissions are split by role too: administrators, editors, authors, and contributors.

For migration, you can import from WordPress via a WXR export or the dedicated EmDash Exporter plugin. Custom post types get organized into proper EmDash collections instead of being crammed into a generic table.

Right now it's a v0.1.0 preview, released as open source on GitHub under the MIT license. You can deploy from the Cloudflare dashboard or your local CLI, and you can go poke around in the EmDash Playground.

Wrap-up

  • Cloudflare announced EmDash, a serverless CMS built on Astro 6.0
  • Plugins run in Dynamic Workers sandboxes, with permissions narrowed by manifest declarations plus explicit grants
  • No GPL lock-in, runs closed-source code, x402 for pay-per-use, passkeys by default
  • Scale-to-zero and CPU-time billing mean no idle servers to pay for
  • v0.1.0 preview, open source under MIT on GitHub, deployable from the dashboard or CLI

This one's for anyone tired of WordPress plugin headaches, anyone who wants to run a CMS the lightweight serverless way, and anyone curious to hand their site over to an agent!

Related posts