EmDash: an open-source CMS with sandboxed plugins, and what it means for WordPress
EmDash is a free, open-source content management system built on Astro, the web framework known for lean, largely static pages. Cloudflare released it as version 1.0 on 28 September 2026, under the MIT licence. Its central idea is plugin safety: an EmDash plugin from its registry runs in a sandbox and can reach only what it declared up front, and you see those permissions before you install it. For a new content-led site, EmDash pairs Astro's lean pages with an editing screen. WordPress keeps its place for sites that depend on its huge range of plugins. It needs a server that runs Node.js, which at Noiz means a Cloud server.
What EmDash is
EmDash was first shown in April 2026 as an early preview, described by Cloudflare as a spiritual successor to WordPress, written in TypeScript. Version 1.0 followed on 28 September 2026, and the project calls it stable and ready for production.
- Built on Astro. Pages are Astro pages, so a site keeps Astro's habit of sending little JavaScript to the browser.
- Open source. EmDash uses the MIT licence. Cloudflare says no WordPress code was used, which is what allows that licence.
- Not WordPress-compatible. EmDash does not run PHP, WordPress themes or WordPress plugins. It can import WordPress content, but a site's design and any custom plugin behaviour have to be rebuilt.
Why sandboxed plugins matter
In WordPress, a plugin runs inside the same PHP process as the rest of the site, with the same access to the database, the files and the network. That is what makes WordPress plugins so capable, and it is also why one badly written or compromised plugin can affect the whole site.
EmDash takes a different approach for plugins installed from its registry:
- Least privilege by default. A sandboxed plugin can read and write only its own storage. Anything more, such as reading content or making network requests, needs a capability it declares in its manifest. If it did not declare it, the sandbox withholds it.
- Network access by list. A plugin may contact only the hosts it lists, unless it declares unrestricted network access.
- Permissions shown before install. The registry shows a plugin's capabilities, and the admin screen asks you to consent to them.
- Checked on every update. Before installing or updating, EmDash checks the package's checksum, name, version and requested permissions, and stops if a check fails.
Two caveats from the documentation. Plugins added directly to a site's code as "native" plugins run with full access, like a WordPress plugin, so treat them with the same care. And the documentation warns against switching the sandbox off in production.
The plugin registry
EmDash's plugin registry is built on the AT Protocol, with publishers signing their packages and releases. At the 1.0 release it carried free plugins, with paid plugins planned, and Cloudflare named the first ecommerce plugin. The catalogue is young compared with WordPress's; check that the plugins you need exist before you commit.
Moving from WordPress
EmDash can import a WordPress site's content from a standard WordPress export file, or more completely through its exporter plugin installed on the WordPress site, which also brings settings, SEO fields, media details, comments and menus. Media is copied into EmDash's storage and links are rewritten.
What does not move is the theme and the plugins. A WordPress site that depends on WooCommerce, a booking plugin or a membership system is a rebuild, not a move.
What EmDash needs to run
EmDash is an application, not a static site. Its documentation says an EmDash site needs server rendering, because the editor, the API and current content are served at request time, and that the public pages and the editor are one deployed application.
- A runtime. Cloudflare Workers, or any Node.js server running Node.js 22.16 or later.
- A database. SQLite on a persistent disk, PostgreSQL or a compatible service.
- A process that stays running, because scheduled publishing and plugin tasks run inside it.
Individual pages can be pre-built, which keeps them quick to serve, but they then show edits only after the next build.
What it means for WordPress
EmDash does not replace WordPress, and it does not need to. It shows a different answer to the problem that causes most WordPress worry: plugins with more access than they need. That is good for everyone who builds websites.
| EmDash | WordPress | |
|---|---|---|
| Best for | New, content-led sites built by a developer | Sites that need a particular plugin, a shop, bookings or memberships |
| Plugins | Few, sandboxed with declared permissions | Tens of thousands, with full access |
| Built with | TypeScript and Astro | PHP |
| Hosting | A Node.js server or Cloudflare Workers | Any PHP hosting |
If your next site is a brochure, a blog or documentation that a small team edits, EmDash is worth a serious look. If your site depends on WordPress plugins, keep WordPress, and keep it updated; WordPress Care does that for you.
Running EmDash with Noiz
EmDash needs a server where you control the Node.js process, its database and its plugin sandbox. A Noiz Cloud server is a self-managed virtual server with full root access over SSH, running Ubuntu or Debian, so you can install and run EmDash there yourself.
If you want Astro's lean pages without an editor, plain Astro or Hugo static sites run on Noiz Legacy hosting.
If you would like to talk through the site you have in mind, open a ticket.
Sources
Checked 19 October 2026. EmDash changes quickly; these facts are as at October 2026.
- Cloudflare blog: EmDash 1.0 and the plugin registry (28 September 2026)
- Cloudflare blog: introducing EmDash (1 April 2026)
- EmDash repository
- EmDash: architecture
- EmDash: deploy to Node.js
- EmDash: database options
- EmDash: plugin sandbox
- EmDash: capabilities and security
- EmDash: plugin registry
- EmDash: migrate from WordPress
- Astro joins Cloudflare (16 January 2026)
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
