What is EmDash?
Cloudflare announced EmDash, a full-stack serverless JavaScript CMS built on Astro 6.0. It's essentially a complete rebuild of WordPress from scratch using modern technology—but with a revolutionary approach to plugin security.
Key Innovation: EmDash runs plugins in sandboxed Worker isolates with capability manifests. Unlike WordPress plugins that have full access to your database and filesystem, EmDash plugins can only do exactly what they declare in their manifest.
Why This Matters
- Security: 96% of WordPress security vulnerabilities come from plugins. EmDash's sandboxed architecture fundamentally solves this.
- License Freedom: MIT licensed (not GPL), so developers aren't locked into a single marketplace.
- Agent-Ready: Built-in MCP server lets AI agents manage content and schema programmatically.
- Portable: Works on Cloudflare (D1 + R2 + Workers) or any Node.js server with SQLite.
The Problem It Solves
WordPress powers 40% of the internet but carries 24 years of technical debt. Running WordPress today means managing PHP alongside JavaScript, layering caches for performance, and praying your plugins don't have vulnerabilities.
EmDash is what WordPress would look like if you started from scratch with today's tools:
- TypeScript everywhere
- Serverless by default
- Plugins run in isolated sandboxes
- Structured content via Portable Text (not serialized HTML)