--- title: Cloudflare built a new cms. Is it ready for your next site? author: Honza description: EmDash is Cloudflare's open-source CMS built on Astro with sandboxed plugins. What it gets right, what's missing, and the question it raises. date: 2026-04-02 url: "https://www.nuasite.com/blog/cloudflare-emdash-ready-for-your-next-site" type: collection generatedAt: "2026-04-08T16:04:01.481Z" source: src/content/blog/cloudflare-emdash-ready-for-your-next-site.md --- Managing a website means depending on someone else's infrastructure. Always has. WordPress, Webflow, Squarespace — you get a site that works, and you get a landlord along with it. Cloudflare just decided to build their own. They're calling it [EmDash](https://blog.cloudflare.com/emdash-wordpress/) — an open-source CMS, "spiritual successor to WordPress," built on Astro. 565 points on Hacker News in a day. Over 400 comments. Some people are excited. Some are skeptical. And buried in the thread, someone asked the question that matters more than EmDash itself. --- ## What EmDash actually is EmDash is a CMS. A proper one — admin panel, content management, themes, plugins, user auth. Think WordPress rebuilt from scratch with 2026 assumptions. The foundation is Astro, which is the right call. Static-first, file-based, fast. Themes are just Astro projects. If you know Astro, you already know how to build for EmDash. The headline feature is sandboxed plugins. WordPress gives every plugin full access to everything — your database, your filesystem, your user table. A contact form plugin can read customer data. A gallery plugin can modify your config. [According to Patchstack](https://blog.cloudflare.com/emdash-wordpress/), 96% of security issues for WordPress sites originate in plugins. EmDash fixes this with Dynamic Workers. Each plugin runs in its own sandbox and declares exactly what it can access: `read:content`, `email:send`, whatever. A contact form gets the form API. Nothing else. Principle of least privilege, applied to CMS extensions. It also ships with passkey auth (no password databases), a WordPress WXR importer, an MCP server for AI agents, and built-in x402 micropayment support. For a v0.1.0 built in two months using AI coding agents, that's covering a lot of ground. --- ## What the community actually said The [HN thread](https://news.ycombinator.com/item?id=47602832) is worth reading in full. Two reactions dominated. The security crowd loved it. Sandboxed plugins are a real answer to a real problem. WordPress has 60,000+ plugins reviewed by not enough people — the review queue is 800+ deep with a two-week wait. EmDash's architecture means a badly written plugin can't tank your whole site. That matters. But the skeptics asked harder questions. One commenter nailed the infrastructure concern: > "Reminds me of Vercel and NextJS, where a popular framework design is constrained by, or optimally runs, on their infra... Vendor lock-in plays are a big red flag." The plugin sandbox — EmDash's main selling point — requires Cloudflare Workers. Deploy on a regular Node.js server and the sandbox degrades. The code is MIT licensed. The security model is Cloudflare-dependent. Those are different things. Another commenter cut straight to the positioning: > "So this product has nothing to do with WordPress, it's just another CMS that mentioned WP only because they created a migration plugin that won't work on 90% of existing WP sites and won't work on 100% of WooCommerce sites." Blunt, but the migration gap is real. EmDash imports WordPress WXR exports — posts and pages as text. Not your theme. Not your plugin functionality. Not WooCommerce. Not custom post types. If you have a 30-page business site with contact forms, a booking system, and an events calendar, EmDash imports the text. You rebuild the rest. Joost de Valk — founder of Yoast SEO, deep WordPress insider — [wrote a detailed review](https://joost.blog/emdash-cms/) calling it a CMS "built for 2026." He sees the AI-agents angle as the real differentiator. But even he's talking about potential, not production-readiness. --- ## The zero-plugins problem WordPress won for a specific reason, and it wasn't code quality. One HN commenter said it well: > "EmDash solves a developer problem (sandboxed plugins, TypeScript, Workers) by building a developer product. Nothing wrong with that. But calling it a WordPress successor misses why WordPress won in the first place. It wasn't the code quality. It was the guy who runs a bakery being able to edit his own website on a Sunday morning." WordPress has 60,000 plugins. EmDash has zero. Not "a few early ones." Zero. The architecture for a plugin marketplace exists and it's well-designed. But architecture isn't adoption. Adoption is thousands of developers building things over years because there are millions of users who need them. That's a chicken-and-egg problem you can't skip with good engineering. Cloudflare has the resources to push through it. Maybe they will. But right now, EmDash is a beautifully designed empty room. --- ## The question buried in the thread Here's the comment that stuck with me: > "Plugins were a workaround for the fact that most people couldn't write code. That's increasingly not true." If AI agents can write and modify code directly — add a contact form, build a booking widget, change a layout — what's the plugin system solving? Plugins exist because non-developers needed a way to extend sites without writing code. But when "writing code" means telling an AI what you want, the abstraction layer between you and the code starts looking like overhead. EmDash's thesis: the CMS is broken, so build a better CMS. Sandboxed plugins. Modern auth. TypeScript. Edge-first. Every piece of that makes sense. But it's still a CMS. Still a running server. Still a database. Still security updates. Still a dependency on someone else's runtime for the features that make it worth choosing. So the question: is the answer a better CMS, or is it no CMS at all? --- ## Why I went a different direction So what do you do if you're not starting from scratch? I'm building [Nua Site](https://www.nuasite.com/), and I think about this constantly. EmDash and Nua both use Astro — but for opposite reasons. EmDash wraps Astro in a CMS infrastructure so you can build and manage a new site. Nua converts your existing site *into* Astro files so you can stop needing infrastructure. EmDash replaces one layer (WordPress + PHP) with a different layer (EmDash + Cloudflare Workers). Better, genuinely. But still a layer. Still plugins, a database, a process that needs to be running, security patches that need applying. Nua produces static files. Nothing runs. Nothing to patch. If Nua disappeared tomorrow, your site still works. It's just HTML, CSS, and Astro components in a folder. EmDash starts from nothing — you build a new site. Nua starts from what you already have — the design you paid for, the content that's already there — and makes it yours as code. And it works from any live URL, not just WordPress exports. Webflow, Squarespace, Wix, whatever you're on. I'm not saying EmDash is wrong. I'm saying it answers a different question. "How do I build a better website from scratch?" is a valid question. It's just not the one most stuck website owners are asking. They're asking: "How do I stop depending on this platform without losing what I've built?" --- ## Who this is for **Watch EmDash if you're:** - A developer excited about building something new on modern infrastructure - Comfortable with beta software and an empty plugin marketplace - Already on Cloudflare and planning to stay - Looking for a long-term bet on what CMSes should become **Look at Nua if you:** - Have a site that works and you just want to own the code — not start over - Need non-technical people to edit text and swap photos without calling a developer - Want something you can deploy today — [$3/page](https://www.nuasite.com/pricing), free preview included **Neither if you:** - Run a complex multi-channel content operation that genuinely needs a headless CMS - Have 50+ editors with editorial workflows and localization pipelines - Need WordPress's 60,000 plugins — nothing replaces that library overnight --- ## FAQ **Does EmDash import from Webflow, Squarespace, or Wix?** No. WordPress WXR exports only, and that covers content — not themes, plugins, or custom functionality. **Is EmDash production-ready?** No. It's v0.1.0 preview, early developer beta. Cloudflare is transparent about this. **Both use Astro — what's the actual difference?** EmDash wraps Astro in a CMS so you manage content through an admin panel. Nua converts your existing site into Astro files — no CMS, no admin panel, just code you own. **What does "sandboxed plugins" mean in practice?** Each EmDash plugin runs in an isolated Cloudflare Worker and can only access what it declares. So a gallery plugin can't read your user data. Good security model — but it requires Cloudflare's runtime to work. **Can I try Nua without committing?** Yes. [Send your URL](https://www.nuasite.com/) and see your site converted to Astro. Your old site stays live until you decide to switch. Take your time. --- ### For agencies and developers Running WordPress sites for clients means running the update treadmill for every one of them. EmDash might fix the plugin security problem — once the marketplace exists. If you need an answer today: $3/page, production-ready Astro output, deploy wherever your clients need it. **[See the agency plan →](https://www.nuasite.com/agencies)**