EmDash 1.0 is stable: a WordPress alternative with plugin sandboxes

Cloudflare declared EmDash 1.0 stable on September 28. The pitch for this WordPress alternative fits in one line: a plugin cannot touch your content, your customers or the network until it asks and you say yes. We have written a lot of WordPress patch posts this year. Most of them start with a plugin that had the keys to the whole database. EmDash is the first serious CMS built to stop that by design.

What actually happened

Per Cloudflare's announcement:

• Stable and free. EmDash 1.0 is an MIT-licensed CMS built on Astro. Cloudflare calls it "ready to power a production website" after five months of work on migrations, editorial workflows, localization and plugin security. The Cloudflare Blog itself has run on EmDash since August.
• Sandboxed plugins. Each plugin runs in its own isolated runtime. By default it has no access to content, media, users or the network. It must declare the abilities it needs, and an admin approves them before install. Access to media does not grant access to user records.
• A signed registry. Plugins publish through the AT Protocol (the protocol behind Bluesky). Publishers keep ownership of their packages and release history. Cloudflare can hide a listing from its catalog but does not change the releases, and anyone can run a different catalog.
• Two hosting paths. EmDash runs on Cloudflare Workers, where plugins run as Dynamic Workers, or on Node.js, where they run in separate workerd processes.
• WordPress import. Cloudflare cites one agency that converted a WordPress site to EmDash "in less than a day."

Two details from outside the announcement. Dynamic Workers are only on the Workers Paid plan, which starts at $5 a month. And the plugin catalog is very small next to WordPress's tens of thousands.

Why it matters for your business

The WordPress plugin model is the real attack surface. A WordPress plugin runs in the same PHP process as your store, with direct database access. One abandoned contact-form plugin can expose every order. A permission prompt does not make a bad plugin good. It does cap what the bad plugin can reach.

Do not migrate a working store this quarter. You are weeks from Black Friday. EmDash has a young ecosystem: no WooCommerce equivalent, few plugins, few developers who know it. A content site, a brochure site or a new build is a better first test.

Check the exit before you commit. MIT license plus a Node.js path means you are not tied to Cloudflare. Confirm that the plugins you need run the same way on Node before you choose Workers-only features.

Sources: Cloudflare blog: EmDash 1.0, Cloudflare blog: Brought to you by EmDash, Cloudflare Dynamic Workers pricing.