Cloudflare's EmDash CMS: Why We're Going All In
Cloudflare spent two months having AI agents rebuild WordPress from scratch. The result is EmDash, and it runs on Astro. We've been building on Astro for over a year. So yeah, we have opinions.
We're going all in on EmDash because we already build on Astro. Cloudflare bought the Astro team in January 2026, then launched EmDash on top of it. Open source. MIT-licensed. TypeScript. But the part that matters: every plugin runs in its own sandbox. Patchstack's 2026 report says 91% of WordPress vulnerabilities come from plugins. EmDash locks each one in a separate Cloudflare Worker. A bad plugin can't touch the rest of your site.
We didn't pivot to get here. We've been writing Astro code for years. When Cloudflare picked Astro as the foundation for their WordPress replacement, it felt like vindication. For Tucson businesses that need a real CMS, we'll recommend EmDash over WordPress from here on out.
What Does EmDash Mean for Small Businesses That Need a CMS?
If your Tucson business needs a blog, staff-edited pages, or content that changes regularly, you don't have to pick WordPress anymore. Internet Crafters can build it on EmDash instead. Sandboxed plugins. Serverless hosting. Lower costs.
WordPress still powers 43.3% of all websites (W3Techs, April 2026). That number is dropping for the first time in a decade. Not hard to see why. Patchstack found that the median time from vulnerability disclosure to first exploit is now five hours. Five hours. Most small business owners don't even check their email that fast.
None of this changes our $550 static sites. A Tucson restaurant or dentist who updates their site twice a year doesn't need a CMS. But the businesses that do? We used to have to point them at WordPress and wish them luck. Not anymore.
How Does EmDash Fix the WordPress Plugin Security Problem?
What's actually different about EmDash.
Sandboxed Plugins
Each plugin gets its own isolated Cloudflare Worker. If one gets compromised, it can't reach your database, your admin panel, or your other plugins. This alone kills 91% of the attack surface that makes WordPress sites so hackable.
Built on Astro
Astro is the framework we've been building on for years. Cloudflare acquired the Astro team in January 2026 and used it as the foundation for EmDash. We didn't have to learn anything new.
Serverless
No server sitting there burning money at 3 AM when nobody's visiting. EmDash runs on Cloudflare Workers. Your hosting bill scales with actual traffic. A Tucson hair salon pays way less than a media company.
AI-Native Management
Built-in MCP server, CLI tools, Agent Skills. AI assistants can manage EmDash sites programmatically. We use AI tools every day already. EmDash was designed for that workflow.
x402 Payments
Micropayments baked in. Paywall content, charge AI agents for crawling, run hybrid free/paid models. No third-party payment plugin required. Most businesses won't use this yet, but it's there when they need it.
Passkey Auth
No passwords to forget, reset, or get phished. Passkeys tied to your device. WordPress still ships with username-and-password login in 2026. Think about that for a second.
WordPress plugins are a security nightmare. Always were. Patchstack counted 11,334 new vulnerabilities across WordPress and its plugins in 2025. That's up 42% from the year before. 36 new plugin vulnerabilities every day. And 46% of affected plugins had no patch available when the vulnerability went public.
EmDash fixes this at the architecture level. Every plugin runs in an isolated Cloudflare Worker. If a plugin gets compromised, it can only reach itself. Your database, admin panel, other plugins? Walled off. Like giving each employee a key to their own office instead of a master key to the building.
We picked Astro years ago because it ships fast static pages by default. Cloudflare bought the Astro team in January 2026 and built EmDash on top of it. We didn't need to learn a new framework or retool our process. Same stack, bigger capabilities.
We were building on Astro before Cloudflare bought the company. That matters.
WordPress had 23 years. The thing replacing it runs on our existing stack.
Why Is Internet Crafters Betting on EmDash So Early?
Honestly? We're not early. Every Internet Crafters site already runs on Astro. Has for years. When Cloudflare announced the acquisition, we didn't have to Google the framework name.
Most agencies are going to spend 2026 and 2027 learning TypeScript, figuring out serverless, and getting comfortable with Cloudflare Workers. We shipped sites on that stack last month.
If you're in Tucson or Southern Arizona and you hire Internet Crafters to build an EmDash site, you're getting a team that already knows the framework inside out. Not a WordPress shop that read a blog post about EmDash last Tuesday and added it to their services page.
WordPress in 2026
- — 11,334 new vulnerabilities in 2025 alone
- — Plugins get full access to your entire site
- — Password-based login still the default
- — PHP monolith on a traditional server
- — GPL license with distribution restrictions
EmDash on Cloudflare
- — Every plugin sandboxed in its own worker
- — Plugins can't access anything outside their sandbox
- — Passkey authentication by default
- — Serverless, scales to zero, runs globally
- — MIT license with no restrictions
Your next site doesn't have to run on WordPress.
We're building EmDash sites now. If you need a CMS, we can build it on something that wasn't designed in 2003.
Is EmDash Free and Open Source?
Yep. MIT license, which is more permissive than WordPress's GPL. No licensing drama. The code is on GitHub, and there's a playground at emdashcms.com if you want to kick the tires without installing anything.
Hosting costs are the other big difference. WordPress managed hosting runs $50 to $200/month at reputable providers. EmDash runs on Cloudflare Workers, which has a free tier that covers most small business traffic. Your bill scales with visitors, not with a server running 24/7.
EmDash also bakes in micropayments through the x402 protocol. Paywall content, charge AI bots for crawling, mix free and paid access. Most Tucson businesses won't need that yet. But it's there, built in, no plugin required.
And there's a WordPress import tool. If you're running WordPress today and you're tired of the update treadmill, Internet Crafters can plan a migration. We're already testing the process with real client sites.
Can I Move My WordPress Site to EmDash Right Now?
11,334
New WordPress vulnerabilities discovered in 2025
91%
Of WordPress vulnerabilities come from plugins
43.3%
Of all websites still run WordPress in 2026
5 hrs
Median time to first exploit after vulnerability disclosure
You can. With caveats. EmDash is version 0.1. It works, Cloudflare is serious about it, but the plugin library is tiny compared to WordPress's 59,000+ options. That will change. A $30 billion company doesn't acquire a framework team and launch a CMS as a hobby.
Here's how we're handling it. If you don't need a CMS, nothing changes. Static Astro site, $550, same as always. If you do need a CMS, we're building new projects on EmDash starting now. And if you're stuck on WordPress and want off, we'll look at your specific setup and plan the move.
WordPress was designed in 2003. PHP on shared hosting, password logins, plugins with root access to everything. That made sense 23 years ago. EmDash was built for how things work now. Serverless infrastructure, passkey auth, plugins that can't blow up your whole site. We'd rather learn it first than scramble later.
If you're in Tucson or Southern Arizona and thinking about your next site, here's what Internet Crafters builds. We'll tell you straight up what makes sense for your business. No pitch.
We're building EmDash sites.
Want one?
Internet Crafters already knows the Astro stack EmDash runs on. Static sites start at $550. CMS sites on EmDash are available now. WordPress migrations too.
Same team. New platform. No WordPress headaches.
Steve Bullis is the founder of Internet Crafters, a Tucson web studio building flat-rate websites for local businesses. He's been helping Arizona small business owners get online since 2005.
Sources
Patchstack - State of WordPress Security in 2026
patchstack.com
Cloudflare Blog - Introducing EmDash: The Spiritual Successor to WordPress
blog.cloudflare.com
W3Techs - Usage Statistics of WordPress, April 2026
w3techs.com
Cloudflare Press Release - Cloudflare Acquires Astro, January 2026
cloudflare.com
External links open in a new tab. Internet Crafters has no affiliation with these publications.