EmDash vs WordPress: Cloudflare's CMS Bet, Explained

The launch that looked like an April Fools' joke

On April 1, 2026 Cloudflare announced EmDash, calling it “the spiritual successor to WordPress that solves plugin security”. Many readers assumed a joke; it wasn't. EmDash is open source (MIT), written in TypeScript on Astro, with over 12,000 stars on GitHub.

WordPress co-founder Matt Mullenweg pushed back: “Please don't claim to be our spiritual successor without understanding our spirit,” adding that EmDash “was created to sell more Cloudflare services”. Yoast's Joost de Valk called it “the most interesting thing to happen to content management in years”.

Why Cloudflare rebuilt the CMS

WordPress powers over 40% of the web, but plugins are its weak spot: Patchstack research cited by Cloudflare shows that 96% of WordPress vulnerabilities originate there, and 2025 brought more severe flaws than the two previous years combined.

A WordPress plugin is a PHP script with full access to your database and files — like handing a guest the keys to the house. EmDash plugins run isolated in their own sandbox and declare their capabilities upfront; each call is capped at 50 ms CPU, 10 subrequests, 128 MB RAM and 30 s.

Cloudflare moved its own blog first

On August 12, 2026 Cloudflare became its own “Customer Zero” and migrated its blog — a site that spikes past 5,000 requests per second — moving traffic from 1% to 100% in a single day through a proxy Worker.

Latency stayed flat where the old stack spiked, and the site served up to 850 RPS, with caching layers keeping most requests off the database.

In Agents Week the blog published 28 posts in nine days and absorbed a 28,000 RPS DDoS attack on August 10. Lighthouse scores 100 for performance and SEO, 96 for accessibility. EmDash is still pre-1.0.

How to launch a site — and what you can build

A new site starts with one command — npm create emdash@latest — or a one-click “Deploy to Cloudflare” button. A basic site fits the free plan; sandboxed plugins need Workers Paid from $5/month. EmDash runs on any Node.js server too.

WordPress content imports through a wizard, and multilingual publishing is built in: each translation is its own entry, linked in a translation group with automatic fallback.

The agent era is the real difference: every site ships an MCP server (/_emdash/api/mcp), so Claude, ChatGPT or Codex can draft, edit and translate content in plain language at no extra cost, and @emdash-cms/x402 charges for content — even only from AI crawlers. x402 is now a Linux Foundation standard backed by Cloudflare, Coinbase, Visa and Stripe, processing 75.4 million transactions worth $24.2 million in 30 days. Version 1.0 is coming soon.