Key Takeaways
- EmDash runs every plugin in its own sandboxed Worker, targeting the 96% of WordPress security issues that originate in plugins.
- Two weeks of production traffic — including a 28,000 RPS DDoS attack — gave Cloudflare’s WordPress rival its first receipts at scale.
- Version 1.0 is expected within weeks, but EmDash still lacks the plugin and theme long tail that built WordPress’s 40% share.
Ask any WordPress administrator what August was like, and you’re likely to hear some version of the same routine: read a CVE write-up, patch a plugin, and wait for the next incident. With more than 40% of the Internet powered by WordPress and thousands of third-party extensions sharing a single PHP process, that routine never really ends.
Cloudflare experienced August quite differently. On August 12, the company moved its highly read engineering blog to EmDash, the open-source content management system (CMS) it launched four months earlier as “the spiritual successor to WordPress that solves plugin security.”
Just 12 days later, it published the receipts.
The Argument Was Always Architectural
The timing wasn’t particularly subtle. Within one day of the receipts post, Search Engine Journal reported that EmDash version 1.0 is releasing soon, likely in time for Cloudflare’s Birthday Week in late September. For years, the alternative to WordPress has remained a hypothetical proposition. Now it’s considerably less so.
EmDash launched on April 1 as a v0.1.0 preview, representing a complete-stack content management system built entirely in TypeScript and based on the Astro framework. It’s freely available under an MIT license, implemented as an open-source project on GitHub, where it has nearly 12,000 “stars.” It’s compatible with both the Cloudflare Workers platform and with any server running the Node.js platform, meaning self-hosting isn’t restricted to Cloudflare’s platform.
From the outset, EmDash was designed with security in mind. Cloudflare’s security team estimates that 96% of security problems for WordPress-based websites arise from plugins that have shared a single PHP process and identical levels of access for the past 20 years.
EmDash eliminates those conditions by having each plugin operate in an isolated sandbox as a Dynamic Worker, with access only to capabilities specified in advance. As Matt “TK” Taylor, the Cloudflare engineer who announced the project, put it: “an EmDash plugin can only perform the actions explicitly declared in its manifest.”
This represented a completely new approach to security. It also made for an argument that would win design reviews but lose battles for market share. WordPress has 20 years of themes, plugins, and habits of use behind it; an elegant sandbox running nowhere in particular wasn’t going to move anyone. That was the state of play until August 12.
Two Weeks at Cloudflare-Blog Scale
The migration post detailed what the new infrastructure was able to absorb: The blog typically handles around 75 requests per second, with bursts exceeding 5,000 RPS.
During Agents Week, Cloudflare published 28 new posts in nine days for nearly 3 million page views. The fully operational blog Worker handled rates of up to 450 RPS without apparent difficulty and ultimately reached peak rates of 850 RPS.
The infrastructure also absorbed a 28,000 RPS DDoS attack on August 10, before the full rollout was even two days old.
Traffic the Cloudflare Blog Handled on EmDash
Most of the load was handled by caching, as you’d expect from a CMS developed by a CDN company. Ninety-nine point five percent of static content and 70% of all requests were satisfied directly from the cache, resulting in flatter 95th-percentile latencies than the previously deployed infrastructure.
“At Cloudflare, Cloudflare itself is Customer Zero. This means that we use our products,” the company wrote in the migration post.
This is conventional “dogfooding,” but it was particularly relevant here because EmDash’s entire case rested on an architecture nobody had seen under real-world traffic. Its most demanding potential customer had now put it to work in a public production environment with quantitative results to show for it.
It also showcased the expected limitations.
What Broke — Because Things Broke
Before the migration, Cloudflare had to eliminate significant gaps in media management at scale, content searching, author attribution, localization, implementation of search engine optimization features, and security policies. The quality of operation for scheduled posts also proved unacceptable during Agents Week, an issue that wasn’t corrected until the release of version 0.19.0. Limitations with the editing experience were still being corrected at the time of publication.
None of that disqualifies a pre-1.0 offering, but provides a useful reality check for anyone reading about “a spiritual successor to WordPress” and seeking a migration plan. A high-traffic engineering blog represents a substantial workload, but one of relatively modest complexity (mostly long-form posts managed by a company with on-call engineers to patch its own CMS mid-week). In contrast, the client list of a freelance Web developer using WooCommerce resides in an entirely different world, and the sheer sprawl of what WordPress plugins do can’t yet be matched by the manifest-based approach of EmDash.
In contrast, the client list of a freelance web developer using WooCommerce sites resides in an entirely different world, and the sheer sprawl of what WordPress plugins do can’t yet be matched by the manifest-based approach of EmDash.
This leaves the actual decision-makers with three possible options. The owner of a Web site that spent August applying patches for plugin security vulnerabilities now has confirmation that a sandboxed alternative can operate at scale. A Web developer choosing a CMS for the next project will have a complete version 1.0 product within weeks, backed by stress tests the company performed on itself. And for the solopreneur curious about Astro, EmDash offers an admin layer for a framework that has so far mostly demanded developers bring their own.
The 40% Question
What nobody gets yet is the long tail, and that’s ultimately what will prevent WordPress from being displaced by architecture alone. It will take years of accumulated plugins, themes, and relatively unexciting tools for migration that EmDash largely doesn’t yet have.
Still, the discussion of these issues has changed considerably this month. “If you’re in the market for a new CMS, try out EmDash today. It’s pretty amazing,” Cloudflare wrote about its own product, which is obviously exactly what one would expect from a vendor.
But in this case, the vendor actually hosted its own homepage with the new system and published data showing how it performed under real traffic before version 1.0 has even shipped. And WordPress should certainly pay attention.
