Websites and graphic design
EmDash: what is it, and is it right for your company website?
· 4 min read
In short: EmDash is Cloudflare’s open-source content management system, and its stable 1.0 release came out in September 2026. Updating it is as easy as WordPress, but every plugin runs isolated with only the permissions the administrator approves. It already suits a company website that needs neither an online store nor a large range of add-ons.
Many company websites run on WordPress, and for good reason: it’s easy to update, and there’s a plugin for almost anything. Cloudflare’s EmDash offers the same ease on new technology. This article covers what EmDash is, how it differs from WordPress and when each is the better choice.
What is EmDash?
Link to section: What is EmDash?Cloudflare announced EmDash in April 2026 and released the stable 1.0 version on 28 September 2026. It’s free and open source (MIT licence), so it can be used and modified freely.
EmDash is built on the Astro framework, the same technology this site is built with. The site and its administration come as one package: admin panel, media library, users, drafts, scheduled publishing and plugins are all included. No PHP is needed, and the site runs on Cloudflare or on any Node.js server.
How does EmDash differ from WordPress?
Link to section: How does EmDash differ from WordPress?| Comparison | WordPress | EmDash |
|---|---|---|
| Plugin permissions | Access to the whole database and file system | Only permissions the administrator approves, isolated |
| Plugin range | Very large | Small, registry opened in September 2026 |
| Technology | PHP and a database | TypeScript and Astro, Cloudflare or Node.js |
| Content storage | As HTML | As structured content (Portable Text) |
| Sign-in | Password, other methods via plugins | Primarily with a |
| Online store | WooCommerce | Built case by case |
| Admin in Finnish | Yes | Not yet (October 2026) |
Structured content means the same text can be shown on a web page, in an app or in an email without being tied to the layout of a single page.
Passkey
A passwordless sign-in method that verifies identity with the device’s fingerprint, face or PIN. Unlike a password, a passkey cannot be phished.
Why does isolating plugins matter?
Link to section: Why does isolating plugins matter?In WordPress, every plugin effectively gets the same permissions as the whole site. According to Patchstack’s 2024 report, 96 per cent of WordPress vulnerabilities are found in plugins, not in WordPress itself. A single plugin left without updates can open access to the whole site and its data.
In EmDash, each plugin declares up front what it needs, and the administrator approves the permissions.
A plugin can only do what the administrator has allowed it to do.
By default, a plugin has no access to content, media, users, secrets or the network. For example, a form plugin that is only allowed to send email cannot read customer data, even if it contains a bug.
Who does EmDash suit already?
Link to section: Who does EmDash suit already?- A company that updates its own website. News, references and pages are updated in the browser without code, and drafts and scheduled publishing work as in WordPress.
- A site that has to be fast and secure. Without PHP and separate caching plugins, the site stays lightweight, and isolated plugins reduce the attack surface. Cloudflare moved its own blog to EmDash in August 2026.
- A company that wants to update content with an AI assistant too. EmDash includes an MCP server through which, for example, Claude or ChatGPT can read and update the site’s content with the permissions it is given.
When is WordPress still the better choice?
Link to section: When is WordPress still the better choice?- An online store. WooCommerce is a mature and widely supported solution. With EmDash, an online store is built case by case.
- The site relies on many ready-made add-ons. Booking systems, member areas and special features are available ready-made for WordPress. EmDash’s plugin registry is still growing.
- Administrators want the interface in Finnish. EmDash’s admin works in many languages, but there is no Finnish version yet.
A well-maintained WordPress site is still a safe choice. What matters is that plugins are kept up to date and that there are only as many as needed.
How does moving from WordPress work?
Link to section: How does moving from WordPress work?EmDash’s admin includes a WordPress import tool that brings over pages, posts and images. The content is converted to the structured format at the same time.
WordPress themes and plugins don’t work in EmDash as they are, because they are written in PHP. The design and the features you need are rebuilt, so the move is best timed with a site redesign.
What does this mean for your company?
Link to section: What does this mean for your company?When your website redesign is due, EmDash is now one option alongside WordPress and a custom-coded site. The choice depends on how often content is updated, whether you need an online store or special add-ons, and who looks after the site. We go through the options with you and tell you plainly which one suits your company best.
