Cloudflare launches EmDash as AI-native spiritual successor to WordPress with serverless design

Cloudflare previews AI rebuild of Wordpress in TypeScript

The world's most popular CMS has been remade with the help of AI. Cloudflare has released EmDash version 0.1, described as a rebuild of the WordPress CMS (content management system) but using TypeScript rather than PHP. In contrast to the one week claimed for recreating Next.js using agentic AI, Cloudflare's product manager Matt Taylor and software engineer Matt Kane said that it took all of two months to create EmDash. Further, the code for EmDash is based on Astro, an open source JavaScript framework acquired by Cloudflare in January this year, so is not altogether newly generated by AI. Technically EmDash is an Astro integration. "I'm the main engineer on this. I've also been on the Astro core team for two years, so I do think I understand real open source software and community. As the post implies, I did use a lot of agent time on this, but this isn't a vibe-coded weekend project. I've been working full time on this since mid-January," said Kane on Hacker News. According to the introductory post, "while EmDash aims to be compatible with WordPress functionality, no WordPress code was used to create EmDash." The new project is open source on GitHub under the MIT license. "The effort needed to be certain it was safe to MIT license EmDash really drove home why it was important to MIT license it. For a lot of enterprises, GPL software is free only if your lawyers are free," said Kane. WordPress is used by 42.5 percent of all websites and 59.8 percent of all CMS systems based on stats from w3techs. That makes it a huge target market, with Cloudflare's goal being to get some of those sites to migrate to run on its Workers platform. Cloudflare Workers are based on V8 isolates, where V8 is the JavaScript engine used by Google's Chrome web browser. An isolate is a sandboxed instance of V8 and is lightweight. This means that, unlike WordPress, EmDash is serverless and scales to zero if there are no requests, or scales up to millions of instances when busy. "Name is a joke but the project is real," said Kane, in answer to a query about whether this project was an April fool, since it was announced on April 1st. Perhaps it will be renamed soon; but 'EmDash' may be playing on the notion that use of the em dash is a sign of AI authorship. This is not normally something to be proud of, but we note that the company describes EmDash as AI native, with a built-in MCP (model context protocol) server, with full admin access, and Agent Skills configuration files for tasks such as converting WordPress themes. The rationale for EmDash, aside from being a marketing pitch for Workers, is that along with AI integration, it is more secure and more easily scaled than WordPress. WordPress plugins and themes are vulnerable to security issues since they are generally not isolated. EmDash plugins run in a sandbox and have defined permissions, such as "read:content" and "email:send" in the case of an email plugin. EmDash authentication uses Passkeys by default, with a fallback to emailed magic links, and no support for passwords. This is a step up from simple username/password, though we encountered problems with the early code as our local setup on Linux did not work with the passkey and the magic link returned "page not found." No doubt this will be fixed soon. The project includes a WordPress migration tool but this only imports content. Most WordPress sites make extensive use of plugins and themes, coded in PHP. This means that replicating an existing site in EmDash will not be easy, requiring re-coding of themes and plugins perhaps with AI assistance as mentioned above. It is also possible that existing plugins and themes will be converted by others. Joost de Valk, who created the Yoast SEO plugin for WordPress, is an early enthusiast for EmDash. According to De Valk, "every architectural decision in EmDash seems to have been made with the same question: what if an AI agent needs to do this?" One of the consequences is that if an AI agent is asked to build a new website using EmDash, it will have an easier time thanks to the AI-friendly design, such as documentation "structured for machine consumption," said De Valk. Points against EmDash are that is has no plugin ecosystem yet, no community, and that Cloudflare integration introduces friction for those who prefer to self-host or host elsewhere. The EmDash readme states that "It runs best on Cloudflare, but it's not locked to it." When self-hosting, there is currently no support for sandboxed plugins. Despite the above, De Valk stated that he plans to develop "on and with EmDash." Regardless of its future, EmDash is a project that raises key questions, first about how AI is reshaping software design, and second about the notion that one can migrate from one application to another by instructing AI to replicate the bits of it that are needed. ®

'A more secure, scalable platform that runs on modern infrastructure and supports AI-native workflows': Why Cloudflare's new EmDash is the "spiritual successor" to WordPress

Our exclusive interview with Matt Taylor, Senior Product Manager at Cloudflare Cloudflare's recent launch of EmDash marks one of the most ambitious attempts in years to rethink the foundations of content management on the web. WordPress has dominated the space for nearly a quarter of a century, powering over 40% of all websites and allowing millions of people and businesses to publish content online. Its success helped democratize publishing, but its architecture -- first introduced 24 years ago -- was designed for a very different era of the internet. Today's web is shaped by serverless infrastructure, distributed computing, and increasingly by AI-driven workflows, and many of WordPress's core assumptions no longer reflect that reality. One of the most persistent challenges facing WordPress is security, particularly around plugins. While they have always been central to WordPress's flexibility, they are also its greatest vulnerability. A fully open source, serverless CMS Industry data shows the overwhelming majority of WordPress security issues originate from plugins, largely because they run with broad access to a site's core systems. This creates a model where flexibility comes at the cost of trust, forcing administrators to rely heavily on reputation, manual reviews, and marketplace controls to decrease risk. This is where EmDash comes in. Intended as a modern alternative, it has been built specifically to address these long-standing structural issues. Designed as a fully open source, serverless CMS written in TypeScript, it introduces a fundamentally different plugin architecture in which extensions operate within isolated sandboxes and can only perform actions they explicitly request. EmDash, which you can play around with here, also reflects changes in how today's websites are built and managed, including native integration with AI tools, automated workflows, and new payment mechanisms for machine-to-machine access. Rather than attempting to replace WordPress outright, EmDash represents an effort to evolve the publishing model. I spoke to Matt Taylor, Senior Product Manager at Cloudflare to find out more. * Let's start with the most obvious question. Why did Cloudflare decide to launch a "spiritual" successor to WordPress? We built EmDash to modernize what WordPress started, for today's web. WordPress was created over two decades ago for a very different Internet. Since then, hosting has shifted toward serverless infrastructure, where applications can scale to zero, and many capabilities that once required plugins -- like storage, authentication, and payments -- are now built directly into the platform. As a result, the plugin model has become both less necessary and an increasing security risk, while AI is reshaping how software is built and how content is created. EmDash is designed to address these shifts directly: a more secure, scalable platform that runs on modern infrastructure and supports AI-native workflows. * Why choose to do it now, rather than before? Because the economics of publishing are now under real pressure in ways they weren't before. The Internet is entering an AI-driven phase where agents are consuming content at scale, often without attribution, visibility, or compensation for the creators. That puts publishers and content owners at risk of losing control over the very assets their businesses depend on. Luckily, technology has reached a point where a different model is possible. With AI, serverless infrastructure, and new approaches to payments and access, there's now an opportunity to rebuild how publishing works -- so content can be discovered, protected, and monetized in a way that's sustainable in an AI-driven Internet. * You already have Payload on Workers as a CMS product. What will happen to that project? Payload is a CMS designed to be run 'headless', which means you bring your own frontend and link it up to Payload. EmDash, by comparison, is more like WordPress, in being full-stack and containing both a frontend and administration interface. The Payload template is operated by the Payload team, who are now at Figma, and we expect no change to their support for that template. * Auttomatic has been very, very proactive when it comes to defending its brand. I assume that Cloudflare had a word with Matt Mullenweg before adopting the "spiritual successor to WordPress" tagline rather than say, alternative to WP. As Matt noted in his blog post, we met with him beforehand to give him a demo on what we were going to release to hear his thoughts. WordPress has done some incredible things for the Internet over its life, as we have said, but it is architecturally stymied, and is simply not the default choice of new developers. We wanted to build something for this generation, which is spiritually to them what WordPress was to us when we were young developers. * What's the support plan for EmDash and how are you planning to develop the Em-Dash community? Dynamic Workers are in public beta and have no free tier at the moment, but are included on the $5 Workers plan. Cloudflare has a history of launching new products to paid customers first, before making them available via our generous free tier. For example, we just launched a free queues tier: https://developers.cloudflare.com/changelog/post/2026-02-04-queues-free-plan/ * You mentioned that your AI coding agents have built this entire platform in 60 days. Can you tell us more? Agents are becoming more capable every day. Matt Kane orchestrated thousands of agentic sessions, each planning, coding, testing and verifying against one another. As with the work we did on Vitest, the experience required to understand good practice -- and the quality of your specifications -- are now some of the most important skills in software engineering. A lot of what made up EmDash pre-release were dozens of files of extremely detailed instructions on what the system should do, how it should perform it, and how it would know when it didn't hit the mark. This context is critical for agents. * WordPress is an open source project. EmDash is an open source project. Why didn't you contribute or get your own WP fork like others before? EmDash was rebuilt from the ground up without using any WordPress code. That allowed us to address long-standing issues -- particularly around plugin security and legacy architecture -- and design for serverless environments from the start. It also enabled us to adopt a permissive license and create a system that is not constrained by past design decisions. * Why did Cloudflare choose the MIT license rather than GPL? Is it a deliberate move towards a more organized ecosystem? We have noticed that the GPL license for WordPress, which is known as a 'viral' copyleft license, restricts the commercial opportunities around developing in its proximity, and we wanted to make EmDash more permissive. Lawyers get very worried when you mention including GPL code at software companies, and we didn't want EmDash to be on their radar. * What is the current roadmap for EmDash? How far are we from an autonomous CMS managed entirely by AI agents? Closer than you might think: there are already plugins for CMSs like WordPress that are entirely autonomously operated, with humans providing the most basic of approvals. From our perspective we're more interested in how an AI agent can assist you in managing your CMS and its content. Though folks are welcome to build on the APIs we have in EmDash to provide an entirely autonomous CMS if they wish! * One of my colleagues highlighted the trend of infrastructure firms launching, buying or sponsoring OSS projects that run best or prioritize the vendor's own stack. Is that sustainable? Is it in the spirit of OSS? We want users to have a range of options for building on the web. Where we can support projects to broaden that range, we historically have to the benefit of the wider ecosystem. As an example, vinext was created to address challenges with deploying Next.js outside of Vercel, but vinext was not built exclusively for Cloudflare and can improve the experience of Next.js users on other platforms like Netlify, AWS, and Google Cloud. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button! And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.

Cloudflare debuts EmDash to challenge aging WordPress with AI-native CMS - SiliconANGLE

Cloudflare debuts EmDash to challenge aging WordPress with AI-native CMS 24 years ago, two young coders launched a fork of the b2/cafelog log code called WordPress, a content management system for the then-emerging blogging world that over two decades later has grown into the most used CMS on the planet, with WordPress estimated to power around 40% of sites on the internet. While WordPress has been highly successful, not only spawning Automattic Inc., the company behind WordPress.com, but also supporting millions of sites, it was built in a vasty different era from today. And while WordPress does still offer value today, it doesn't reflect modern technology and coding standards, leaving the door open for new players and alternatives. Enter Cloudflare Inc., which today announced the launch of EmDash, an open-source CMS that is designed as a modern alternative to WordPress and is built to reflect how websites are now deployed and operated on distributed infrastructure. Designed using artificial intelligence-assisted coding workflows and intended to align with serverless and edge-based architectures, EmDash targets structural limitations in WordPress, particularly its plugin model, where third-party extensions often have broad access to core systems and data. One of the ongoing issues with WordPress over the years has been plugins, which are responsible for the majority of WordPress vulnerabilities and create a persistent attack surface across sites that rely on them. Cloudflare's offering takes a different approach to WordPress by isolating plugins within sandboxed environments and enforces explicit permission controls over what each plugin can access to prevent a single compromised plugin from affecting the broader system. EmDash was built using TypeScript and leverages modern frameworks such as Astro, with an architecture designed to run across distributed networks rather than centralized servers. The new CMS is compatible with Node.js environments and is optimized for deployment on Cloudflare's global edge network, reducing reliance on conventional hosting stacks. The new offering also introduces AI-native capabilities that are designed to allow EmDash to be managed programmatically by AI agents for tasks such as content migration, restructuring and schema changes that are typically handled through manual workflows or one-off scripts. The new CMS provides structured context and interfaces to allow agents to automate repetitive CMS operations, including updating content fields, reorganizing data and adapting existing site structures. EmDash includes components such as agent skills that define available capabilities, plugin hooks and guidance for extending functionality, along with a command-line interface that enables programmatic interaction with both local and remote instances. Each deployment also includes a built-in Model Context Protocol server, allowing agents to perform administrative actions such as content management, media uploads and schema updates through standardized interfaces equivalent to those available in the administrative user interface. On the authentication side, EmDash uses passkey-based authentication by default, meaning there are no passwords to leak and no brute-force vectors to defend against. EmDash is being offered fully open source with an MIT license and is available now on GitHub.