'A more secure, scalable platform that runs on modern infrastructure and supports AI-native workflows': Why Cloudflare's new EmDash is the "spiritual successor" to WordPress

Cloudflare’s recent launch of EmDash marks one of the most ambitious attempts in years to rethink the foundations of content management on the web.

WordPress has dominated the space for nearly a quarter of a century, powering over 40% of all websites and allowing millions of people and businesses to publish content online. Its success helped democratize publishing, but its architecture — first introduced 24 years ago — was designed for a very different era of the internet.

Today’s web is shaped by serverless infrastructure, distributed computing, and increasingly by AI-driven workflows, and many of WordPress’s core assumptions no longer reflect that reality.

One of the most persistent challenges facing WordPress is security, particularly around plugins. While they have always been central to WordPress’s flexibility, they are also its greatest vulnerability.

A fully open source, serverless CMS

Industry data shows the overwhelming majority of WordPress security issues originate from plugins, largely because they run with broad access to a site’s core systems.

This creates a model where flexibility comes at the cost of trust, forcing administrators to rely heavily on reputation, manual reviews, and marketplace controls to decrease risk.

This is where EmDash comes in. Intended as a modern alternative, it has been built specifically to address these long-standing structural issues.

Designed as a fully open source, serverless CMS written in TypeScript, it introduces a fundamentally different plugin architecture in which extensions operate within isolated sandboxes and can only perform actions they explicitly request.

EmDash, which you can play around with here, also reflects changes in how today's websites are built and managed, including native integration with AI tools, automated workflows, and new payment mechanisms for machine-to-machine access.

Rather than attempting to replace WordPress outright, EmDash represents an effort to evolve the publishing model. I spoke to Matt Taylor, Senior Product Manager at Cloudflare to find out more.

• Let's start with the most obvious question. Why did Cloudflare decide to launch a "spiritual" successor to WordPress?

We built EmDash to modernize what WordPress started, for today’s web. WordPress was created over two decades ago for a very different Internet. Since then, hosting has shifted toward serverless infrastructure, where applications can scale to zero, and many capabilities that once required plugins — like storage, authentication, and payments — are now built directly into the platform.

As a result, the plugin model has become both less necessary and an increasing security risk, while AI is reshaping how software is built and how content is created.

EmDash is designed to address these shifts directly: a more secure, scalable platform that runs on modern infrastructure and supports AI-native workflows.

• Why choose to do it now, rather than before?

Because the economics of publishing are now under real pressure in ways they weren’t before. The Internet is entering an AI-driven phase where agents are consuming content at scale, often without attribution, visibility, or compensation for the creators. That puts publishers and content owners at risk of losing control over the very assets their businesses depend on.

Luckily, technology has reached a point where a different model is possible. With AI, serverless infrastructure, and new approaches to payments and access, there’s now an opportunity to rebuild how publishing works — so content can be discovered, protected, and monetized in a way that’s sustainable in an AI-driven Internet.

• You already have Payload on Workers as a CMS product. What will happen to that project?

Payload is a CMS designed to be run ‘headless’, which means you bring your own frontend and link it up to Payload. EmDash, by comparison, is more like WordPress, in being full-stack and containing both a frontend and administration interface.

The Payload template is operated by the Payload team, who are now at Figma, and we expect no change to their support for that template.

• Auttomatic has been very, very proactive when it comes to defending its brand. I assume that Cloudflare had a word with Matt Mullenweg before adopting the "spiritual successor to WordPress" tagline rather than say, alternative to WP.

As Matt noted in his blog post, we met with him beforehand to give him a demo on what we were going to release to hear his thoughts. WordPress has done some incredible things for the Internet over its life, as we have said, but it is architecturally stymied, and is simply not the default choice of new developers.

We wanted to build something for this generation, which is spiritually to them what WordPress was to us when we were young developers.

• What's the support plan for EmDash and how are you planning to develop the Em-Dash community?

Dynamic Workers are in public beta and have no free tier at the moment, but are included on the $5 Workers plan.

Cloudflare has a history of launching new products to paid customers first, before making them available via our generous free tier. For example, we just launched a free queues tier: https://developers.cloudflare.com/changelog/post/2026-02-04-queues-free-plan/

• You mentioned that your AI coding agents have built this entire platform in 60 days. Can you tell us more?

Agents are becoming more capable every day. Matt Kane orchestrated thousands of agentic sessions, each planning, coding, testing and verifying against one another. As with the work we did on Vitest, the experience required to understand good practice — and the quality of your specifications — are now some of the most important skills in software engineering.

A lot of what made up EmDash pre-release were dozens of files of extremely detailed instructions on what the system should do, how it should perform it, and how it would know when it didn’t hit the mark. This context is critical for agents.

• WordPress is an open source project. EmDash is an open source project. Why didn't you contribute or get your own WP fork like others before?

EmDash was rebuilt from the ground up without using any WordPress code. That allowed us to address long-standing issues — particularly around plugin security and legacy architecture — and design for serverless environments from the start. It also enabled us to adopt a permissive license and create a system that is not constrained by past design decisions.

• Why did Cloudflare choose the MIT license rather than GPL? Is it a deliberate move towards a more organized ecosystem?

We have noticed that the GPL license for WordPress, which is known as a ‘viral’ copyleft license, restricts the commercial opportunities around developing in its proximity, and we wanted to make EmDash more permissive.

Lawyers get very worried when you mention including GPL code at software companies, and we didn’t want EmDash to be on their radar.

• What is the current roadmap for EmDash? How far are we from an autonomous CMS managed entirely by AI agents?

Closer than you might think: there are already plugins for CMSs like WordPress that are entirely autonomously operated, with humans providing the most basic of approvals.

From our perspective we’re more interested in how an AI agent can assist you in managing your CMS and its content. Though folks are welcome to build on the APIs we have in EmDash to provide an entirely autonomous CMS if they wish!

• One of my colleagues highlighted the trend of infrastructure firms launching, buying or sponsoring OSS projects that run best or prioritize the vendor’s own stack. Is that sustainable? Is it in the spirit of OSS?

We want users to have a range of options for building on the web. Where we can support projects to broaden that range, we historically have to the benefit of the wider ecosystem.

As an example, vinext was created to address challenges with deploying Next.js outside of Vercel, but vinext was not built exclusively for Cloudflare and can improve the experience of Next.js users on other platforms like Netlify, AWS, and Google Cloud.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.