Cloudflare has announced a new content management system called EmDash which it says is the “spiritual successor to WordPress.” Could EmDash be your next content management system? Here are six reasons why EmDash could be the content management system of tomorrow… but not today.
1. EmDash is not user-focused
Cloudflare’s main selling point for its new CMS, as stated in the announcement title, is that it solves WordPress’s security problem. More than 25% of the announcement focuses on plugin security.
The remaining 73% of the ad is dedicated to:
- General information on the evolution of web development.
- Placing WordPress in the context of the history of web development.
- Technical architecture.
- Security and authentication.
- Readiness for x402, which allows users to monetize agentic website traffic.
There are over 2,700 words in this announcement, and the only part that is arguably of direct importance to actual users like bloggers, businesses, and other publishers is the part about plugin security. The rest of the content is focused on the developers and coders and not the user at all.
There are many reasons to choose a CMS, and while security is important for businesses and online publishers, there are other reasons that are much more important.
2. The arguments in favor of plugin security
Cloudflare explains that the security of WordPress plugins is compromised because the plugins are granted full access to a website’s internal files and database. This lack of limits means that if a single plugin has a flaw or malicious intent, it can compromise the entire site. The announcement explains that the vast majority of security vulnerabilities (96%) come from third-party plugins.
What the announcement doesn’t say is that the vast majority of WordPress plugin vulnerabilities are unlikely to be exploitable on a large scale. Only 17% of plugins are high severity, and among them, many of them are not installed on many websites.
Patchstack WordPress Security Research Shows That By 2025:
“1,966 (17%) vulnerabilities had a high severity score, meaning they were likely to be exploited in large-scale automated attacks.
…In addition, our Zero Day program discovered 33 highly critical vulnerabilities in premium components, compared to only 12 in free components.
Many WordPress vulnerabilities are discovered every day, but most of them are low risk and found on rarely used plugins. While plugin security is EmDash’s main selling point, it’s not much of a selling point in the real world.
Cloudflare’s solution for improving plugin security is solid and well-designed. However, a reasonable argument could be made that Cloudflare’s arguments for plugin security overstate its importance in the overall scheme of what users actually do. need.
3. EmDash is designed to solve infrastructure problems
In an article on
Marsland argues that developers may worry about “cleaner abstractions” and “isolated runtimes,” but small business owners worry about things like bookings, SEO, and customer acquisition. He uses the analogy of EmDash being a “tidy desk” for people who aren’t actually looking to tidy their desk but are instead focused on using a CMS that helps them run a business.
“…When very intelligent people rebuild something from scratch, they tend to solve the problems they see most clearly.
And the problems observed by Cloudflare are very real:
- Plugin security (sandboxing, isolation)
- Serverless Scaling
- Modern Developer Experience
- Native AI Programmability
This all makes perfect sense… If you look at the world from inside an infrastructure company.
…If you’re a developer, it’s like someone finally cleaned up your desk. The problem is that most people don’t try to clean their desks.
They try to run a business from this when:
- reply to emails
- social media post
- update their website
- I wonder why traffic dropped”
4. EmDash may not be user-friendly
EmDash is built on Astro, which technically isn’t a CMS; it is a web framework. EmDash wraps Astro around a graphical user interface (GUI) for content management that may look familiar to anyone who has used WordPress. But setting everything up isn’t as simple as the famous five-minute WordPress setup, as it may involve connecting to a GitHub repository and configuring database settings. The same goes for giving the site the look the user wants.
It has a GUI for managing content, but it doesn’t (yet) have a point-and-click website builder like most modern content management systems like WordPress and Wix do.
5. Command Line Interface
I’m old enough to remember what using a desktop computer was like in the 1980s. The interface was essentially a command line interface, with a cursor blinking impatiently at the user, waiting for cryptic commands to make them do something. It wasn’t until 1983 that Apple introduced a graphical user interface (GUI) that made it easier for everyday users to interact with a computer.
If you enjoy typing cryptic commands to operate a computer, then EmDash’s command line interface is for you. At this point, users won’t be able to escape this as they currently cannot create an EmDash site from scratch without resorting to a CLI. Even the “one-click” deployment options in the Cloudflare dashboard eventually require technical setup that is typically handled through the endpoint.
6. EmDash is not ready for most users
I was very excited to read Cloudflare’s announcement of a “spiritual successor” to WordPress, but the more I read, the more it became clear that EmDash was not the solution I was looking for. Yes, I want a successful website. Yes, I want a site that is secure and won’t surprise me one day with Japanese text.
But I don’t want to deal with a CLI and I want an easy to use interface to configure and create an attractive website for myself. EmDash is not ready for general use. It is still in the first developer beta. The version number is 0.1.0, so at this point it’s literally not aimed at the average user.
Hopefully it will one day become a viable competitor to WordPress, but EmDash isn’t one at the moment.
Featured image by Shutterstock/Ollyy
