Cloudflare dropped EmDash on April 1 and spent the first paragraph of their announcement clarifying it was not a joke. Fair enough. Two engineers built a working content management system in two months using AI agents. That detail alone should make anyone paying attention to software development stop and think about what is actually changing.

The CMS itself is open source under an MIT license and runs on any Node.js server. Cloudflare built it on top of Astro, a JavaScript framework they acquired in January 2026. The lead engineer, Matt Kane, was already on the Astro core team for two years before Cloudflare brought Astro in-house. So the "built from scratch" framing in the announcement is a little generous. EmDash is more accurately an Astro integration built with heavy use of AI coding tools. Kane said as much himself, pushing back on anyone calling it a weekend vibe-coding project. Two months with a strong foundation and good tooling is still impressive. It changes the question from how they built it to what it actually does.

The Plugin Security Argument

Cloudflare's main complaint about WordPress is plugin security. Their number: 96% of WordPress security issues come from plugins. That stat is from Cloudflare's own blog post, worth noting. Independent research from Patchstack puts high-severity exploitable vulnerabilities at closer to 17% of total plugin issues. The gap matters because the headline number is doing a lot of work in the EmDash pitch.

The underlying problem is real though. A WordPress plugin runs in the same environment as WordPress itself. It can read your database, write to your filesystem, do almost anything. When you install a plugin, you are extending a lot of trust to whoever wrote it. EmDash takes a different approach: each plugin runs in its own isolated sandbox called Dynamic Workers, and has to declare upfront exactly what it needs access to, similar to how mobile apps request permissions. If a plugin only needs to send email, it only gets permission to send email. Nothing else.

This is worth saying clearly because it gets buried. EmDash is open source and you can run it on your own server. But the plugin isolation that is the whole point of the security story runs on Cloudflare Workers. Take it off Cloudflare and you have a TypeScript CMS with a clean architecture and no plugin ecosystem yet. That is not nothing, but it is different from the pitch.

WordPress, to its credit, does patch security vulnerabilities and pushes updates regularly. Keeping your plugins updated is genuinely one of the most important things any WordPress site owner can do. The problem is that many organizations install plugins, customize their WordPress instance heavily, and then become reluctant to update because they are not sure what will break. If you have a developer who built your WordPress setup, you probably need that same developer involved when major plugin or core updates come through. The flexibility that makes WordPress powerful is the same thing that makes maintenance a real responsibility.

Who Is Actually Going to Use This

Matt Mullenweg, who co-founded WordPress and runs Automattic, responded on April 2. His argument was not really about plugin sandboxing. It was about what WordPress was built to do: run anywhere, on any hardware, for anyone who wants to publish something. A cheap shared host in Indonesia. A Raspberry Pi at home. Mullenweg's point is that EmDash is optimized for Cloudflare's own infrastructure and that makes it a different kind of product, whatever the open source license says.

He is not wrong about the audience gap. Cloudflare sells to developers, security teams, and infrastructure buyers. The person who decides what CMS a company runs is usually in marketing or digital experience, not the engineering team managing Cloudflare's security products. EmDash does not bridge that gap today. A marketing team is not going to evaluate a v0.1 command-line-first TypeScript framework with no themes, no plugin directory, and a setup process that requires developer involvement. Cloudflare's email product tells the same story. It is developer infrastructure for routing and sending transactional email from Workers, nothing like a marketing email platform.

Joost de Valk, who built Yoast SEO, the most widely used SEO plugin for WordPress, was one of the more enthusiastic early voices on EmDash. He noted that every design decision in it seems to have been made with AI agents as the primary user, not a human content editor. That framing is accurate and also tells you something about the intended audience. De Valk is now at Network Solutions, part of Newfold Digital, the same parent company that acquired Yoast in 2021 and has been consolidating its web brands, most recently merging Web.com into Network Solutions in June 2025.

Where I Land on This

I run my own blogs on Google Blogger. The appeal is simplicity. There are no plugins to update, no security patches to chase, no hosting decisions to make. The tradeoff is that customization is almost nonexistent out of the box. What I do instead is use Claude Code to design each post and structure the layout in HTML and XML by hand. My familiarity with both from working on the early web means I can catch what a language model misses and make changes when I need to. It works for me but it is not something I would recommend to most people.

For anyone starting a publishing presence today, WordPress is still what I recommend. You own your content completely. You can move your hosting whenever you want. The plugin ecosystem covers almost any need, and the WordPress team keeps adding capabilities. WordPress now has its own MCP server, which means AI agents can work with it directly. That is not nothing in 2026. The one thing I would be direct about: if you have customized your WordPress installation significantly, keep a developer relationship active. Plugin updates and WordPress core updates can break things in customized setups, and you want someone who knows your configuration when that happens.

EmDash I genuinely want to try. The architecture is interesting, the AI-native design is ahead of where the CMS market is generally, and the MIT license makes it accessible to enterprise teams whose legal departments move slowly on GPL software. If you are already deep in the Cloudflare ecosystem and want your publishing infrastructure to live there too, this is worth a look now. For everyone else, check back when there is a plugin ecosystem and a community behind it.