Cloudflare launches EmDash, an AI-native CMS built to challenge WordPress dominance

Cloudflare previews AI rebuild of Wordpress in TypeScript

The world's most popular CMS has been remade with the help of AI. Cloudflare has released EmDash version 0.1, described as a rebuild of the WordPress CMS (content management system) but using TypeScript rather than PHP. In contrast to the one week claimed for recreating Next.js using agentic AI, Cloudflare's product manager Matt Taylor and software engineer Matt Kane said that it took all of two months to create EmDash. Further, the code for EmDash is based on Astro, an open source JavaScript framework acquired by Cloudflare in January this year, so is not altogether newly generated by AI. Technically EmDash is an Astro integration. "I'm the main engineer on this. I've also been on the Astro core team for two years, so I do think I understand real open source software and community. As the post implies, I did use a lot of agent time on this, but this isn't a vibe-coded weekend project. I've been working full time on this since mid-January," said Kane on Hacker News. According to the introductory post, "while EmDash aims to be compatible with WordPress functionality, no WordPress code was used to create EmDash." The new project is open source on GitHub under the MIT license. "The effort needed to be certain it was safe to MIT license EmDash really drove home why it was important to MIT license it. For a lot of enterprises, GPL software is free only if your lawyers are free," said Kane. WordPress is used by 42.5 percent of all websites and 59.8 percent of all CMS systems based on stats from w3techs. That makes it a huge target market, with Cloudflare's goal being to get some of those sites to migrate to run on its Workers platform. Cloudflare Workers are based on V8 isolates, where V8 is the JavaScript engine used by Google's Chrome web browser. An isolate is a sandboxed instance of V8 and is lightweight. This means that, unlike WordPress, EmDash is serverless and scales to zero if there are no requests, or scales up to millions of instances when busy. "Name is a joke but the project is real," said Kane, in answer to a query about whether this project was an April fool, since it was announced on April 1st. Perhaps it will be renamed soon; but 'EmDash' may be playing on the notion that use of the em dash is a sign of AI authorship. This is not normally something to be proud of, but we note that the company describes EmDash as AI native, with a built-in MCP (model context protocol) server, with full admin access, and Agent Skills configuration files for tasks such as converting WordPress themes. The rationale for EmDash, aside from being a marketing pitch for Workers, is that along with AI integration, it is more secure and more easily scaled than WordPress. WordPress plugins and themes are vulnerable to security issues since they are generally not isolated. EmDash plugins run in a sandbox and have defined permissions, such as "read:content" and "email:send" in the case of an email plugin. EmDash authentication uses Passkeys by default, with a fallback to emailed magic links, and no support for passwords. This is a step up from simple username/password, though we encountered problems with the early code as our local setup on Linux did not work with the passkey and the magic link returned "page not found." No doubt this will be fixed soon. The project includes a WordPress migration tool but this only imports content. Most WordPress sites make extensive use of plugins and themes, coded in PHP. This means that replicating an existing site in EmDash will not be easy, requiring re-coding of themes and plugins perhaps with AI assistance as mentioned above. It is also possible that existing plugins and themes will be converted by others. Joost de Valk, who created the Yoast SEO plugin for WordPress, is an early enthusiast for EmDash. According to De Valk, "every architectural decision in EmDash seems to have been made with the same question: what if an AI agent needs to do this?" One of the consequences is that if an AI agent is asked to build a new website using EmDash, it will have an easier time thanks to the AI-friendly design, such as documentation "structured for machine consumption," said De Valk. Points against EmDash are that is has no plugin ecosystem yet, no community, and that Cloudflare integration introduces friction for those who prefer to self-host or host elsewhere. The EmDash readme states that "It runs best on Cloudflare, but it's not locked to it." When self-hosting, there is currently no support for sandboxed plugins. Despite the above, De Valk stated that he plans to develop "on and with EmDash." Regardless of its future, EmDash is a project that raises key questions, first about how AI is reshaping software design, and second about the notion that one can migrate from one application to another by instructing AI to replicate the bits of it that are needed. ®

Cloudflare debuts EmDash to challenge aging WordPress with AI-native CMS - SiliconANGLE

Cloudflare debuts EmDash to challenge aging WordPress with AI-native CMS 24 years ago, two young coders launched a fork of the b2/cafelog log code called WordPress, a content management system for the then-emerging blogging world that over two decades later has grown into the most used CMS on the planet, with WordPress estimated to power around 40% of sites on the internet. While WordPress has been highly successful, not only spawning Automattic Inc., the company behind WordPress.com, but also supporting millions of sites, it was built in a vasty different era from today. And while WordPress does still offer value today, it doesn't reflect modern technology and coding standards, leaving the door open for new players and alternatives. Enter Cloudflare Inc., which today announced the launch of EmDash, an open-source CMS that is designed as a modern alternative to WordPress and is built to reflect how websites are now deployed and operated on distributed infrastructure. Designed using artificial intelligence-assisted coding workflows and intended to align with serverless and edge-based architectures, EmDash targets structural limitations in WordPress, particularly its plugin model, where third-party extensions often have broad access to core systems and data. One of the ongoing issues with WordPress over the years has been plugins, which are responsible for the majority of WordPress vulnerabilities and create a persistent attack surface across sites that rely on them. Cloudflare's offering takes a different approach to WordPress by isolating plugins within sandboxed environments and enforces explicit permission controls over what each plugin can access to prevent a single compromised plugin from affecting the broader system. EmDash was built using TypeScript and leverages modern frameworks such as Astro, with an architecture designed to run across distributed networks rather than centralized servers. The new CMS is compatible with Node.js environments and is optimized for deployment on Cloudflare's global edge network, reducing reliance on conventional hosting stacks. The new offering also introduces AI-native capabilities that are designed to allow EmDash to be managed programmatically by AI agents for tasks such as content migration, restructuring and schema changes that are typically handled through manual workflows or one-off scripts. The new CMS provides structured context and interfaces to allow agents to automate repetitive CMS operations, including updating content fields, reorganizing data and adapting existing site structures. EmDash includes components such as agent skills that define available capabilities, plugin hooks and guidance for extending functionality, along with a command-line interface that enables programmatic interaction with both local and remote instances. Each deployment also includes a built-in Model Context Protocol server, allowing agents to perform administrative actions such as content management, media uploads and schema updates through standardized interfaces equivalent to those available in the administrative user interface. On the authentication side, EmDash uses passkey-based authentication by default, meaning there are no passwords to leak and no brute-force vectors to defend against. EmDash is being offered fully open source with an MIT license and is available now on GitHub.