- Cloudflare has launched its very own CMS – EmDash
- EmDash plugins are secure by design, WordPress has a queue of 800 to test
- WordPress users can easily migrate to the "AI native CMS" that is EmDash
Cloudflare has lifted the wraps off EmDash, a new open source CMS that it deems to be the "spiritual successor" to WordPress.
The company explained an overwhelming majority (96%) of WordPress vulnerabilities come from plugins, which have full access to the database and filesystem, and run in the same environment as the core code without any isolation.
To tackle this, Cloudflare is putting each EmDash plugin in an isolated sandbox, called Dynamic Workers, with plugins having to declare exactly which permission it needs upfront.
Cloudflare says EmDash is more secure than WordPress
In its announcement, Cloudflare criticized the fact that existing WordPress plugins must be trusted, and that their availability on centralized plugin marketplaces serves to give them a good reputation. WordPress.org currently manually reviews and approves every plugin for the platform, and there's a queue of around 800 plugins right now that need to be verified.
Instead of this trust, EmDash plugins must be secure by design. And because developers can ship plugins with any license running independently of EmDash that run in secure sandboxes, Cloudflare is able to do away with the marketplace lock-in it criticizes.
Better still, EmDash is built to the scale-to-zero principle, meaning that it only bills for CPU time when it's actually operating – "it scales back down to zero if there are no requests," the company wrote.
"We’ve bet on this architecture at Cloudflare in part because we believe in having low cost and free tiers, and that everyone should be able to build websites that scale," Senior Product Manager Matt Taylor and Senior Principal Systems Engineer Matt Kane added.
For the front end, EmDash is powered by Astro which allows users to build themes of pages, layouts, components, styles and and more.
Finally, Cloudflare describes EmDash as an "AI native CMS" that includes Agent Skills, CLI and a built-in MCP server.
Users wishing to migrate from WordPress can either import their WXR file or do so by, funnily enough, installing a plugin (EmDash Exporter).
