Cloudflare has unveiled an early developer preview of EmDash, an open source content management system aimed at improving how organisations build and manage websites.
Content management systems underpin how websites are created, edited and published without manual coding, with WordPress remaining the dominant platform globally, powering more than 40% of sites.
EmDash is positioned as a modern alternative, built on a cloud-first architecture and designed for deployment either across Cloudflare’s global network or within existing infrastructure.
The platform is free and open source, reflecting a shift toward more flexible and scalable web development models.
Security is a central focus. Traditional CMS platforms rely heavily on third-party plugins, which often have broad access to site data and systems, making them a common source of vulnerabilities.
EmDash introduces an isolation model where each plugin runs in a separate environment with tightly defined permissions, limiting the impact of any single compromised component.
The platform also signals a shift in web monetisation. EmDash includes native support for pay-per-use access models, enabling publishers to charge for content consumption by users, automated tools and AI agents, rather than relying solely on subscription models.
Adressing The WordPress Plugin Security Gap
WordPress’ plugin model continues to expose sites to risk, with 96% of known vulnerabilities linked to plugins. In 2025, the number of high-severity flaws identified across the ecosystem exceeded the combined total of the previous two years.
At the core of the issue is architecture. Plugins are built as PHP scripts that integrate directly into WordPress, with no isolation layer.
This gives them broad access to the site’s database and filesystem, effectively requiring full trust that each plugin can safely handle malicious input and edge cases.
EmDash introduces a different approach. Each plugin operates within an isolated sandbox known as a Dynamic Worker, with access to data controlled through declared permissions in its manifest.
Built on modern web frameworks, EmDash is designed to deliver improved performance, reduced infrastructure overheads and greater flexibility, with migration tools available to help organisations transition existing WordPress sites.
