> EmDash – what is it, and is it right for business? > Source: https://developit.fi/en/articles/emdash-for-business-websites/ > Full site in machine-readable form: https://developit.fi/llms-full.txt Websites and graphic design # EmDash: what is it, and is it right for your company website? 28 October 2026 · 4 min read In short: EmDash is Cloudflare’s open-source content management system, and its stable 1.0 release came out in September 2026. Updating it is as easy as WordPress, but every plugin runs isolated with only the permissions the administrator approves. It already suits a company website that needs neither an online store nor a large range of add-ons. Many company websites run on WordPress, and for good reason: it’s easy to update, and there’s a plugin for almost anything. Cloudflare’s EmDash offers the same ease on new technology. This article covers what EmDash is, how it differs from WordPress and when each is the better choice. ## What is EmDash? Cloudflare announced EmDash in April 2026 and released the stable 1.0 version on 28 September 2026. It’s free and open source (MIT licence), so it can be used and modified freely. EmDash is built on the Astro framework, the same technology this site is built with. The site and its administration come as one package: admin panel, media library, users, drafts, scheduled publishing and plugins are all included. No PHP is needed, and the site runs on Cloudflare or on any Node.js server. ## How does EmDash differ from WordPress? Comparison WordPress EmDash Plugin permissions Access to the whole database and file system Only permissions the administrator approves, isolated Plugin range Very large Small, registry opened in September 2026 Technology PHP and a database TypeScript and Astro, Cloudflare or Node.js Content storage As HTML As structured content (Portable Text) Sign-in Password, other methods via plugins Primarily with a passkey Online store WooCommerce Built case by case Admin in Finnish Yes Not yet (October 2026) Structured content means the same text can be shown on a web page, in an app or in an email without being tied to the layout of a single page. ## Why does isolating plugins matter? In WordPress, every plugin effectively gets the same permissions as the whole site. According to Patchstack’s 2024 report, 96 per cent of WordPress vulnerabilities are found in plugins, not in WordPress itself. A single plugin left without updates can open access to the whole site and its data. In EmDash, each plugin declares up front what it needs, and the administrator approves the permissions. A plugin can only do what the administrator has allowed it to do. By default, a plugin has no access to content, media, users, secrets or the network. For example, a form plugin that is only allowed to send email cannot read customer data, even if it contains a bug. ## Who does EmDash suit already? - A company that updates its own website. News, references and pages are updated in the browser without code, and drafts and scheduled publishing work as in WordPress. - A site that has to be fast and secure. Without PHP and separate caching plugins, the site stays lightweight, and isolated plugins reduce the attack surface. Cloudflare moved its own blog to EmDash in August 2026. - A company that wants to update content with an AI assistant too. EmDash includes an MCP server through which, for example, Claude or ChatGPT can read and update the site’s content with the permissions it is given. ## When is WordPress still the better choice? - An online store. WooCommerce is a mature and widely supported solution. With EmDash, an online store is built case by case. - The site relies on many ready-made add-ons. Booking systems, member areas and special features are available ready-made for WordPress. EmDash’s plugin registry is still growing. - Administrators want the interface in Finnish. EmDash’s admin works in many languages, but there is no Finnish version yet. A well-maintained WordPress site is still a safe choice. What matters is that plugins are kept up to date and that there are only as many as needed. ## How does moving from WordPress work? EmDash’s admin includes a WordPress import tool that brings over pages, posts and images. The content is converted to the structured format at the same time. WordPress themes and plugins don’t work in EmDash as they are, because they are written in PHP. The design and the features you need are rebuilt, so the move is best timed with a site redesign. ## What does this mean for your company? When your website redesign is due, EmDash is now one option alongside WordPress and a custom-coded site. The choice depends on how often content is updated, whether you need an online store or special add-ons, and who looks after the site. We go through the options with you and tell you plainly which one suits your company best. ## Sources - Cloudflare blog.cloudflare.com Introducing EmDash, 1 April 2026 - Cloudflare blog.cloudflare.com EmDash 1.0, the stable CMS with a secure plugin registry, 28 September 2026 - github.com EmDash, GitHub project description (README) - Patchstack patchstack.com State of WordPress Security in 2024 - Cloudflare blog.cloudflare.com The Cloudflare Blog uses EmDash Facts checked against primary sources on 28 October 2026. Websites and graphic design Explore the service ## Read next Websites and graphic design Accessibility requirements for business websites: does the European Accessibility Act apply to you? Read the article Websites and graphic design Is your company found in AI search? The new visibility game for websites Read the article Information security and audits The Cyber Resilience Act is here: what does it mean for your company’s devices? Read the article