43% of the internet runs on WordPress. That's not a compliment.
It means almost half of all websites are built on architecture from 2003.
WordPress is a monolithic PHP application that you need to host, patch, secure, and regularly resuscitate after a plugin update blows everything up.
Cloudflare knows this. And they did something about it. On April 1, 2026, they launched EmDash: a fully open-source CMS built on Astro and their own edge infrastructure. No PHP, no MySQL dumps to restore at 3 AM. Instead: TypeScript, SQLite, and a content model defined as code.
Why this matters, even if you're not a developer
If you're responsible for a website, whether you build it yourself or have it built, WordPress puts you in a peculiar dilemma. The ecosystem is enormous, the community is huge, there are 60,000 plugins. But that very ecosystem is the problem.
Every plugin runs with the same privileges as your entire site. One vulnerable contact form and your server is wide open. The solution? Managed hosting at €30-300 per month. Or endless updating and hoping for the best.
EmDash takes a fundamentally different approach.
Plugins run in sandboxes: isolated Workers with a capability manifest. A plugin that handles image processing can't access your database. A form plugin can't write files. That's not a feature; it's the design principle.
What it is, technically
EmDash is built as an Astro integration. Your site is an Astro project, and EmDash adds the CMS: a database (SQLite locally, Cloudflare D1 in production), media storage (filesystem locally, R2 in production), and a complete admin interface with forms, media management, menu management and SEO tooling.
Define your entire site in one JSON file. Schema, content, taxonomies, menus. All in a seed.json. One command and you have a working site with admin.
Content as structured JSON instead of HTML blobs. The same content can power a website, an app, an email template, or an API response.
Plugins run in isolated Workers. A plugin declares what it needs (read:content, email:send) and nothing else. 96% of WP vulnerabilities come from plugins.
No caching layers needed. Content is served directly from Cloudflare's edge with low latency worldwide. Core Web Vitals out of the box.
And it's AI-ready: every EmDash instance has a built-in MCP server that lets AI agents read and edit your content.
// DEMO: SETUP
First login: creating a passkey and exploring the admin.
Our experience: AIDevTools.app
We tested EmDash by building a marketing site for AIDevTools.app, a platform that helps developers compare AI coding tools. Three pages, ten content types, 66 editable entries, complete admin interface.
What we built
The key lesson: EmDash thinks in collections, not free-form content blocks. Where WordPress throws everything into a single editor, EmDash forces you to think about your content structure upfront. FAQ items are a collection. Features are a collection. Statistics are a collection. Each with their own fields, validation and sorting.
That feels like extra work at first. But the result is that everything is editable in the admin. Not Gutenberg blocks you can shuffle around but don't really understand, but real form fields with labels and validation. A marketer can update the FAQ without calling a developer.
// DEMO: ADMIN IN ACTION
Editing content in the EmDash admin: click, edit, done.
The elephant in the room: Cloudflare lock-in
Let's address this right away. EmDash is open-source (MIT license), but it's built by Cloudflare, for Cloudflare. The production stack runs on Workers, D1, R2 and KV. That's Cloudflare four times over.
EmDash
Lock-in at infrastructure level. Your code and content are yours. Runs locally on Node.js with SQLite. Deployable on Netlify, Vercel, Railway, any VPS.
WordPress
Lock-in at application level. Tied to PHP, MySQL, a hosting stack you'd rather not manage, and a plugin ecosystem that can break your site.
What it's not yet
EmDash is version 0.1.0. You need to know that.
Documentation is thin.
You need to be willing to read source code. You'll discover things halfway through.
No image field type.
You store image paths as strings. Workable, but not elegant.
Passkey-first setup.
Modern, but can confuse non-technical users.
Small community.
You're an early adopter, with everything that entails. No plugin marketplace, no community plugins.
On the other hand: it's Cloudflare. Not a solo developer with a side project, but a publicly traded company investing $1.5 billion annually in infrastructure. The chance this project still exists in five years is significantly higher than the average headless CMS startup.
Who is this for?
Who've had enough of WordPress maintenance and want a modern, TypeScript-first CMS with a developer experience that matches how you build websites in 2026.
Looking for a CMS that treats content as structured data, with clear permissions, version control and API-first architecture.
Who want to avoid WordPress security risks without switching to a proprietary headless CMS with enterprise pricing and vendor lock-in.
Our verdict
EmDash is the first CMS in years that excites us. Not because it can do everything WordPress can. It can't, not by a long shot. But because it shows what a CMS should look like if you designed it today, without twenty years of backwards compatibility baggage.
Schema as code. Sandboxed plugins. Edge-first. AI-ready. And a content model that finally separates content from presentation in a way that actually works in practice.
We're going to use it for client projects. Not for everything. For an online store with WooCommerce-like functionality it's too early. But for marketing sites, corporate sites and content platforms? EmDash is already a serious alternative.
Stack & references
For the professionals who want to know the details:
Technology
Astro 6, TypeScript, SQLite/D1, R2, Cloudflare Workers, Portable Text, Node.js standalone adapter for non-Cloudflare hosting.
Our test case
AIDevTools.app marketing site -3 pages, 10 collections, 66 content entries, 9 Astro components, 2 taxonomies. Seed file of ~400 lines of JSON defines the complete schema + content.
Architecture lesson
Use collections with typed fields, not custom Portable Text blocks. The admin UI doesn't render custom PT blocks. You'll see an opaque block instead of a form.
Deploy options
Cloudflare Pages + Workers (native), Netlify (Node adapter), Vercel (Node adapter), Docker/VPS (standalone Node).
Considering a CMS migration?
We're happy to think along about the right approach, whether that's EmDash, a headless CMS, or a different direction entirely.
