On 1 April 2026, Cloudflare announced EmDash, a brand-new CMS they’re calling the “spiritual successor to WordPress.” Yes, April Fools’ Day. Yes, it’s real. And yes, it’s already got people asking the obvious question: should I be worried about my WordPress site?
Short answer: not yet. But it’s a conversation worth having.
One thing that genuinely piqued the interest of Simon Bailey Design was the approach to plugin isolation and security. It’s a real and persistent problem in the WordPress world, and any serious attempt to solve it is worth examining closely.
What Is EmDash?
EmDash is Cloudflare’s attempt to rebuild WordPress from the ground up, using modern technology. It’s written in TypeScript, runs on serverless infrastructure, and is powered by a web framework called Astro. It’s open source, MIT licensed, and currently in early preview, version 0.1.0.
The headline claim is security. Around 96% of WordPress vulnerabilities originate in plugins, a long-standing and well-documented problem. EmDash tackles this by running each plugin in its own sandboxed environment, with only the permissions it explicitly declares upfront. Think of it as a strict bouncer who checks the list before anyone gets in.
It also promises AI-native features, built-in payment support, passkey authentication, and a migration tool to import existing WordPress sites.
So Is WordPress Finished?
Not remotely.
WordPress powers over 40% of the internet. It has a global ecosystem of developers, themes, plugins, and community support built across more than two decades. That kind of infrastructure doesn’t evaporate overnight.
EmDash is still in early beta, aimed squarely at developers comfortable with TypeScript and serverless platforms. There’s no established marketplace, no proven track record, and no ready-made ecosystem for non-technical business owners to plug into. The gap between “compelling new technology” and “ready to run your business website” is a wide one.
What EmDash does signal, though, is that the conversation around WordPress security is getting louder. And that’s worth paying attention to.
What About Headless WordPress?
It’s worth a mention, because Headless WordPress was being talked about in similar terms not so long ago. The idea, using WordPress purely as a content backend while serving the front end through a separate framework, has genuine technical appeal. But for most small-to-mid-sized businesses, the complexity and cost rarely justified the benefits. EmDash is essentially attempting to solve the same underlying frustrations, performance, security, and modern development workflows, but from the ground up rather than bolted onto an existing architecture. Whether it succeeds where Headless stalled remains to be seen.
What This Means for Your Website
If your website runs on WordPress, the practical takeaway is straightforward: keep plugins updated, use reputable sources, and work with someone who actually understands the platform.
That last point matters more than ever. A well-built, well-maintained WordPress site remains one of the most reliable and flexible web solutions available. Peace of mind comes from knowing the person looking after your site understands both its strengths and its limitations, and keeps on top of both.
The Verdict
Watch this space, but don’t lose any sleep over it. WordPress isn’t going anywhere, and the principles behind a good website remain the same regardless of what’s running under the hood.
EmDash is interesting technology with genuine promise. It just isn’t ready to power your business website yet.
Ready to talk about your website, WordPress or otherwise? Get in touch with Simon Bailey Design.