back to top
HomeTechEmDash: Cloudflare rebuilt WordPress for the agent-first web

EmDash: Cloudflare rebuilt WordPress for the agent-first web

EmDash is what Cloudflare rebuilt WordPress for the agent-first web
Mohit Geryani
By Mohit Geryani
0
Last updated:
- Advertisement -

WordPress has a problem it cannot fix from the inside. Not a performance problem. Not a features problem. A structural one. 96% of its security vulnerabilities come from plugins, and the reason is simple. Every plugin gets access to everything. The database, the filesystem, the entire execution context. That is how it was built in 2003 and that is how it still works today.

Cloudflare looked at that and decided patching was the wrong answer. EmDash is their attempt to start over. Built in TypeScript, Its serverless & powered by Astro & MIT licensed. No PHP, legacy architecture or plugins that can silently access your entire database.

I want to be straight about what this is right now. It is a v0.1.0 developer preview. You are not migrating your production site today. But the architecture decisions behind it are serious enough that if you build on WordPress, run a plugin business, or host WordPress sites for clients, you should understand what Cloudflare just shipped.

Table of contents

What EmDash actually is?

Emdash WordPress Alternative

EmDash is a CMS written entirely in TypeScript, serverless by default, powered by Astro under the hood. It is MIT licensed & fully open source. You can deploy it to Cloudflare in one click or run it on any Node.js server you already have. No PHP. No legacy architecture carrying two decades of decisions made when AWS EC2 did not exist yet.

Cloudflare is calling it the spiritual successor to WordPress. That is a big claim for a v0.1.0 preview. But the architecture decisions behind it are not marketing. They are solving problems WordPress structurally cannot solve without breaking everything built on top of it. The plugin problem is where that starts.

Emdash

The plugin problem and how EmDash actually fixes it

Every WordPress plugin is a PHP script with direct access to your database and filesystem. When you install a plugin you are trusting that its author handled every edge case, every malicious input, every security scenario perfectly. Most of the time that trust is misplaced.

That is not a solvable problem inside WordPress. The architecture is 24 years old. Fixing it would break every plugin ever written.

EmDash starts from scratch and the difference is immediate. Every plugin runs in its own isolated sandbox. Instead of handing the plugin keys to everything, EmDash asks the plugin to declare upfront exactly what it needs. Read access to content. Permission to send email. Access to one specific hostname. Nothing else.

It works like OAuth. Most developers already understand this pattern. When you connect a third party app to your Google account, you see a screen listing exactly what it is asking for. Read your calendar. Send email on your behalf. You approve or you do not. EmDash plugins work the same way at install time.

A plugin that notifies editors when a post goes live needs two things: content:afterSave to hook into the publish event, and email:send to fire the notification. That is all it gets. It cannot touch your database. It cannot make external network requests unless it explicitly declared a specific hostname it needs. The plugin could have ten thousand lines of code and it still cannot do anything outside those two declared capabilities.

This also breaks the stranglehold of the WordPress plugin marketplace. WordPress.org manually reviews every plugin because the security risk of unreviewed plugins is genuinely dangerous. That review queue currently sits at over 800 plugins and takes at least two weeks. EmDash does not need that gate because the sandbox makes the risk manageable without a centralized approver.

Try Emdash

Built for a web where humans & agents browse

WordPress was built for humans with browsers. That was the right call in 2003. It is a liability now.

EmDash does not replace the human experience. Your readers still visit, read, and subscribe the same way. But EmDash is also ready for what WordPress is not: AI agents browsing, fetching, and paying for content on behalf of users.

Every EmDash instance ships with a built-in MCP server, a CLI your agents can talk to directly, and x402 payment support baked into the core.

x402 is an open standard for internet-native payments. When an agent hits a paywalled page it receives a 402 Payment Required response, pays on demand, and gets through. No subscription flow. No human in the loop. You set a price, add a wallet address, done.

The web’s ad model was built around humans seeing ads. That breaks when the visitor is an agent. EmDash treats that as a core infrastructure problem, not an afterthought.

The WordPress migration path

If you are already on WordPress, getting your content into EmDash is straightforward. Export a WXR file from your WordPress admin and import it directly. If you want something cleaner, install the EmDash Exporter plugin on your existing site. It sets up a secure endpoint, protected by a WordPress Application Password you control, and the migration takes a few minutes.

Media comes across automatically. Custom post types built with plugins like Advanced Custom Fields can be mapped to proper EmDash collections during import, each stored in its own table rather than squeezed into WordPress’s posts table like they were never meant to be there.

What does not migrate is your theme. EmDash themes are Astro projects. If your current theme is heavily customized, rebuilding it is real work. That is the honest cost of switching and worth factoring in before you get excited about everything else.

Is it actually ready

No. And Cloudflare is not pretending otherwise. EmDash is v0.1.0 preview. It is an early developer beta. You should not migrate a production site today. The plugin ecosystem does not exist yet. The theme library is essentially empty. You are looking at a foundation, not a finished house.

But the foundation is serious. The architecture decisions are not cosmetic. Sandboxed plugins, agent-native infrastructure, serverless by default, MIT licensed. Many of these are not things you can retrofit into WordPress. They required starting over.

Cloudflare building this matters too. This is not a solo developer’s side project that might disappear in six months. The same company running the infrastructure for a significant portion of the internet decided WordPress’s core problems were worth solving from scratch.

Watch it. Try the playground. If you build plugins or themes professionally, now is the right time to pay attention. Production use can wait.

Don’t miss any Tech Story

Subscribe To Firethering NewsLetter

You Can Unsubscribe Anytime! Read more in our privacy policy

LEAVE A REPLY

Please enter your comment!
Please enter your name here

YOU MAY ALSO LIKE
Anthropic Secretly Tracked Claude Code Users. Then Called It an Experiment

Anthropic Secretly Tracked Claude Code Users. Then Called It an “Experiment.”

Mohit Geryani - 0
There's a version of this story where Anthropic was trying to protect itself from large-scale model theft. There's another where one of the AI industry's biggest privacy advocates quietly crossed a line its own users never expected. What makes this headline important isn't just that hidden tracking code existed. It's that the company behind it was Anthropic. Just months ago, Anthropic publicly refused to let the Trump administration use Claude to surveil American users. The company defended that position in court, arguing that AI companies shouldn't become tools for government surveillance. That stance became part of Anthropic's identity. Then came a very different decision. In March, Anthropic quietly added hidden tracking markers to Claude Code that flagged users' timezones, proxy connections, and potential ties to Chinese AI labs. The code remained unnoticed until security researcher Thereallo discovered it last week. After the discovery went public, an Anthropic engineer confirmed it on X, described it as an "experiment" intended to combat account abuse and model distillation, and said the company had already planned to remove it. The tracker was taken down shortly afterward. The bigger question isn't whether Anthropic had a reason. It's whether a company that built its reputation on privacy can afford to hide surveillance from the very developers it asks to trust its tools.
Leanstral AI

Leanstral 1.5: Mistral’s AI Built to Prove Math Ended Up Finding Real Software Bugs

Mohit Geryani - 0
Mistral built Leanstral to do something most AI models don't attempt, write formal mathematical proofs that a compiler can verify as correct. Not "pretty sure this is right" correct. Mechanically, provably, no-exceptions correct. That's a narrow use case, and the audience for it is small. What nobody expected was that a model trained on IMO-level math problems and abstract algebra benchmarks would end up running against open-source codebases and finding bugs that testing and fuzzing had both missed. Five of them previously unreported on GitHub.
Open Source AI Coding Agents That Don't Need a Subscription

7 Open Source AI Coding Agents That Don’t Need a Subscription

Mohit Geryani - 0
Open almost any "best AI coding tools" list and you'll see the same names: Cursor, GitHub Copilot, Claude Code. They're good tools but they're also closed source and paid. What's changed over the past year isn't the quality of those products, it's how quickly the open-source alternatives have caught up. Some can orchestrate multiple agents, remember your projects across sessions, and automate complex development workflows. Many let you bring your own model, whether that's a local LLM, OpenRouter, OpenAI, GLM-5.2, Ornith, DeepSeek, or something else entirely. More importantly, you're in control. You decide where your code runs, which model powers it, and how your workflow evolves without being locked into a single company's ecosystem. If you've only looked at the paid options, these are the open-source AI coding tools worth knowing about.