What is EmDash?

Cloudflare quietly dropped something interesting: EmDash is a full-stack TypeScript CMS built on Astro that runs natively on Cloudflare's infrastructure – D1 (SQLite), R2 (Object Storage), and Workers (Serverless Compute).

The core idea: take what made WordPress dominant – extensibility, admin UX, plugin ecosystem – and rebuild it on serverless, type-safe foundations.

Repository on GitHub

Why This Matters

WordPress powers over 40% of the web. But its architecture dates back to 2003. Anyone who has run a WordPress project in production knows the pain:

• Plugin security: One vulnerable plugin compromises the entire site. 96% of WordPress vulnerabilities come from plugins.
• Performance: PHP rendering on every request, caching as a band-aid.
• Content structure: Rich text stored as HTML with embedded block comments – a nightmare for multichannel.

EmDash addresses all three problems fundamentally.

The Architecture Decisions

Plugin Sandboxing: The End of "Full Database Access"

This is the real game-changer. WordPress plugins have full database access. One vulnerable plugin = game over.

EmDash plugins run in isolated V8 Worker sandboxes with a declared capability manifest:

export default definePlugin({
  id: "notify-on-publish",
  capabilities: ["read:content", "email:send"],
  hooks: {
    "content:afterSave": async (event, ctx) => {
      if (event.content.status !== "published") return;
      await ctx.email.send({
        to: "editors@example.com",
        subject: `New post: ${event.content.title}`,
      });
    },
  },
});

A plugin that declares read:content and email:send can do exactly that – and nothing else. 11 capability types, 20 lifecycle hooks. Each plugin gets its own admin pages, dashboard widgets, API routes, KV storage, and cron scheduling.

The marketplace audits plugins automatically using Workers AI. This is the security model WordPress has been missing for 20 years.

Structured Content Instead of HTML Soup

WordPress stores content as HTML with embedded block comments (<!-- wp:paragraph -->). That works for web rendering but fails at multichannel.

EmDash uses Portable Text – structured JSON. The same content renders as web, mobile, email, or API without parsing HTML. The editor is built on TipTap with automatic Portable Text conversion.

For WordPress migrations, there's a built-in import wizard with a Gutenberg-to-Portable-Text converter that understands 30+ block types.

Schema in the Database, Not in Code

Non-developers create and modify content types through the admin UI. Each collection gets a real SQL table with typed columns. Developers generate TypeScript types from the live schema:

npx emdash types

A smart compromise: schema definition stays accessible to content teams while developers get type-safe queries.

Built for Agents

EmDash ships with:

• 7 agent skills for programmatic content management
• CLI for batch operations
• Built-in MCP server so AI tools can interact with your site directly

This is forward-looking. A CMS that treats agents as first-class citizens will have a massive advantage in 12 months.

Tech Stack Details

Component	Technology
Framework	Astro
SQL	Kysely (SQLite, D1, Turso, PostgreSQL)
Storage	S3-compatible (R2, AWS S3, local filesystem)
Editor	TipTap with Portable Text
Auth	Passkey-first (WebAuthn), OAuth, Magic Links
Search	FTS5 Full-Text Search
Pagination	Cursor-based Keyset Pagination
License	MIT

What's Missing

Let's be honest: The ecosystem is empty.

• Zero third-party plugins
• Zero themes
• Zero community content
• No page builder
• No visual theme customizer
• No one-click hosting

That's both the opportunity and the risk. The architecture is solid. But a CMS without an ecosystem is like an app store without apps.

The Strategic Move Behind It

Here's where it's worth zooming out. Cloudflare sits on one of the largest DNS and traffic datasets in the world. They see which technologies are growing and which are declining – in real time, across millions of domains.

Cloudflare sees the WordPress decline before it shows up in market research reports.

And that's exactly what explains EmDash. This isn't about building a better CMS. It's about establishing D1, R2, and Workers as the default backend of the post-WordPress era.

EmDash is a Trojan horse.

The CMS isn't the product. The infrastructure behind it is the product. Every EmDash project that goes live means:

• A D1 database that Cloudflare hosts
• R2 storage for assets that Cloudflare bills
• Workers compute for every interaction that runs through Cloudflare

Now think further: AI-native builders like Lovable, Bolt, or v0 generate frontends in seconds. What all these tools need is a backend. Database, storage, auth, serverless functions.

If Cloudflare positions itself as the natural backend layer for this new generation of AI builders, EmDash is just the beginning. It's the proof of concept that says: "Look, a complete CMS runs on our stack – your AI-generated app can too."

Cloudflare's real bet isn't "EmDash vs. WordPress." The bet is: "Cloudflare infrastructure vs. AWS/Vercel as the default backend for AI-generated software."

And that's a much bigger bet.

How We Do It at Till Freitag

For context: at Till Freitag, we currently work entirely without a traditional CMS. This website – including the blog – is maintained directly in Lovable as our editing interface. Content lives as Markdown in the repository, changes are made via AI chat. No WordPress, no Strapi, no Contentful.

This works because our team is technically proficient enough to operate with an AI-native workflow. For teams without that prerequisite, a tool like EmDash would be an interesting middle ground: the security and structure of a modern CMS, without WordPress's legacy baggage.

The Real Question

Is the WordPress developer world ready to switch from PHP to TypeScript?

EmDash is developer-first in a market that has historically been everyone-first. WordPress became dominant because non-developers could build websites with it. EmDash requires TypeScript proficiency, Cloudflare knowledge, and CLI comfort.

The architecture decisions are consistently smart:

• Plugin isolation solves WordPress's biggest security problem
• Portable Text solves the content portability problem
• Agent integration positions the CMS for the next era

But architecture alone doesn't win market share. WordPress has 40%+ market share not because of superior technology, but because of the ecosystem.

Conclusion

EmDash is the CMS developers have always wanted – but not yet the CMS they can recommend. If Cloudflare solves the ecosystem problem (themes, plugins, one-click deploy), EmDash could become a serious WordPress alternative in 2-3 years.

Until then: watch, experiment, don't migrate.

Status: Beta preview, MIT-licensed, runs on Cloudflare or any Node.js server with SQLite.

---

Also read: Cloudflare's Real Play – Why EmDash Is an Infrastructure Trojan Horse