Cloudflare has introduced EmDash, a new open-source content management system designed as a modern alternative to WordPress, with a focus on plugin security and serverless architecture.

The company said WordPress plugins are fundamentally insecure because they have direct access to a site’s database and filesystem. According to Cloudflare, 96% of security issues in WordPress sites come from plugins. Cloudflare says that EmDash solves this problem by running each plugin in its own isolated sandbox, called a Dynamic Worker. Plugins must declare exactly what permissions they need, such as reading content or sending emails, and cannot access anything else.

EmDash is written entirely in TypeScript and licensed under the permissive MIT license, allowing anyone to use, modify, and distribute it freely. No WordPress code was used to build it, says Cloudflare. The CMS can run on Cloudflare’s serverless platform, where it scales down to zero when not in use, reducing costs. It can also be deployed on any Node.js server.

The system is powered by Astro, a web framework designed for content-driven websites. Themes are built as Astro projects and cannot perform database operations, improving security further.

EmDash includes built-in support for x402, an open standard for pay-per-use content payments. Site owners can charge for access to specific content without setting up subscriptions or writing code.

Cloudflare says the CMS is designed to be managed by AI agents. It includes agent skills, a command-line interface, and a built-in Model Context Protocol server. Authentication uses passkeys by default, eliminating passwords.

Users can import existing WordPress sites via a WXR file or a dedicated exporter plugin. EmDash is available now as a v0.1.0 preview on GitHub. Developers can try it locally using `npm create emdash@latest` or through a Cloudflare deployment. An online playground is also available.