On April 1, 2026, Cloudflare dropped one of the most ambitious open-source projects in recent memory: EmDash, a TypeScript-native CMS built from the ground up as a spiritual successor to WordPress. With WordPress powering roughly 43% of all websites but suffering from over 11,300 new plugin vulnerabilities discovered in 2025 alone, the timing couldn't be better.

EmDash isn't a fork. No WordPress code was used. It's a clean-room reimagining of what a CMS should look like in 2026: serverless by default, sandboxed plugins, Astro-powered theming, built-in MCP server for AI agents, and native x402 payment support. It's MIT-licensed, so you can use it however you want.

This guide covers everything you need to get started with EmDash: installation, plugin development, theming, WordPress migration, AI-native content management, and deployment options on both Cloudflare and Node.js.

1What Is EmDash and Why It Exists

EmDash is a fully open-source, MIT-licensed content management system built entirely in TypeScript. Cloudflare built it using AI coding agents over two months, and it launched as v0.1.0 preview on April 1, 2026.

The motivation is straightforward: WordPress is nearly 24 years old. When it was born, AWS EC2 didn't exist. Hosting meant renting VPS boxes. Today, you can deploy a globally distributed site by uploading a JavaScript bundle at virtually no cost. WordPress's architecture hasn't kept up with that shift.

The three core problems EmDash solves:

• Plugin security: 91% of WordPress vulnerabilities come from plugins that have unrestricted access to the database and filesystem. EmDash sandboxes every plugin in its own isolate.
• Serverless architecture: WordPress requires provisioned servers. EmDash scales to zero on Cloudflare Workers and bills only for CPU time.
• Modern developer experience: TypeScript end-to-end, Astro 6 for theming, and an AI-native design with built-in MCP server support.

2EmDash vs WordPress: Architecture Comparison

3Getting Started: Installation & First Site

Creating a new EmDash site takes one command:

npm create emdash@latest

This scaffolds a new EmDash project with the default Astro theme, admin interface, and local development server. You can also deploy directly from the Cloudflare dashboard if you prefer a GUI-based setup.

The project structure follows Astro conventions:

my-emdash-site/
├── src/
│   ├── pages/          # Astro routes (homepage, blog, archives)
│   ├── layouts/        # Shared HTML structure
│   ├── components/     # Reusable UI elements
│   └── styles/         # CSS or Tailwind config
├── plugins/            # EmDash plugins
├── seed.json           # Content types and fields definition
├── emdash.config.ts    # EmDash configuration
└── package.json

Run npm run dev to start the local development server. The admin interface is available at /admin by default, where you can create content, manage schemas, and configure plugins.

4The Plugin System: Capabilities & Sandboxing

This is where EmDash fundamentally diverges from WordPress. In WordPress, a plugin is a PHP script that hooks directly into the core with full access to the database and filesystem. In EmDash, each plugin runs in its own isolated sandbox via Dynamic Workers.

The security model works through a capability-based manifest system:

• Every plugin declares exactly what it needs in its manifest (e.g., read:content, email:send)
• The plugin can only perform actions explicitly declared in the manifest
• No external network access unless a specific hostname is declared
• No direct database access — only through provided capability bindings
• Administrators can define rules for what plugins are allowed based on requested permissions

This is similar to an OAuth flow: you know exactly what you're granting before installing a plugin. A plugin with 50,000 lines of code that only declares read:content and email:send can literally do nothing else.

5Building Your First EmDash Plugin

Here's a complete EmDash plugin that sends an email notification when content is published:

import { definePlugin } from "emdash";

export default () =>
  definePlugin({
    id: "notify-on-publish",
    version: "1.0.0",
    capabilities: ["read:content", "email:send"],
    hooks: {
      "content:afterSave": async (event, ctx) => {
        if (
          event.collection !== "posts" ||
          event.content.status !== "published"
        ) return;

        await ctx.email!.send({
          to: "editors@example.com",
          subject: `New post: ${event.content.title}`,
          text: `"${event.content.title}" is now live.`,
        });

        ctx.log.info(
          `Notified editors about ${event.content.id}`
        );
      },
    },
  });

Key things to notice:

• The capabilities array declares exactly what the plugin needs
• The hooks object defines which lifecycle events the plugin responds to
• Context (ctx) provides only the bindings matching declared capabilities
• The plugin has zero access to anything not in its manifest — no filesystem, no network, no database

Plugins can have any license you choose. Since they run independently of EmDash in their own isolate, there's no GPL-style copyleft requirement. You can publish to NPM, sell commercially, or keep them private.

6Theming with Astro 6

EmDash themes are standard Astro projects. If you've built anything with Astro, you already know how to theme EmDash. A theme includes:

• Pages: Astro routes for rendering content (homepage, blog posts, archives)
• Layouts: Shared HTML structure
• Components: Reusable UI elements (navigation, cards, footers)
• Styles: CSS or Tailwind configuration
• Seed file: JSON that tells the CMS what content types and fields to create

Cloudflare acquired the Astro Technology Company in January 2026, and Astro 6 shipped shortly after with a rebuilt dev server running on Cloudflare's workerd runtime. This tight integration means EmDash themes get the full benefit of Astro's islands architecture: zero JavaScript shipped to the browser by default, with interactive components hydrated only when needed.

Unlike WordPress themes that integrate through functions.php (which has the same security risks as plugins), EmDash themes can never perform database operations. They're purely presentational, which eliminates an entire class of security vulnerabilities.

// Example: src/pages/blog/[slug].astro
---
import Layout from "../layouts/Base.astro";
import { getEntry } from "emdash:content";

const { slug } = Astro.params;
const post = await getEntry("posts", slug);
---

<Layout title={post.title}>
  <article>
    <h1>{post.title}</h1>
    <time>{post.publishedAt}</time>
    <div set:html={post.body} />
  </article>
</Layout>

7The Admin Interface & Content Modeling

EmDash ships with a built-in admin panel where you can create and manage content, define schemas, and configure plugins. Unlike WordPress, where creating custom content types requires heavy plugins like Advanced Custom Fields, EmDash lets you define schemas directly in the admin panel.

Each schema creates an entirely new EmDash collection, separately ordered in the database. This is a clean break from WordPress's approach of squeezing everything into a single wp_posts table.

Authentication uses passkeys by default — no passwords to leak, no brute-force vectors. Role-based access control is built in with familiar roles: administrators, editors, authors, and contributors. Authentication is pluggable, so you can integrate with your SSO provider and automatically provision access based on IdP metadata.

You can try the admin interface right now in the EmDash Playground without deploying anything.

8AI-Native CMS: MCP Server, CLI & Agent Skills

EmDash is designed to be managed programmatically by AI agents. This is one of its most forward-thinking features. Every EmDash instance provides three AI integration surfaces:

🤖 Agent Skills

Each EmDash instance includes Agent Skills files that describe the CMS's capabilities to AI agents. When you give an agent an EmDash codebase, it gets structured documentation on plugin capabilities, hooks, theme structure, and even how to port WordPress themes. This is similar to how MCP servers provide tool descriptions to AI clients.

⌨️ EmDash CLI

The CLI enables programmatic interaction with local or remote EmDash instances. Upload media, search content, create schemas, and manage everything you can do in the admin UI — all from the command line or an AI agent's tool calls.

🔌 Built-in MCP Server

Every EmDash instance exposes a remote MCP server. Connect Claude Desktop, Cursor, Kiro, or any MCP-compatible client directly to your CMS. This means you can ask your AI assistant to "create a new blog post about X" or "migrate all draft posts to published" and it can execute those operations directly against your EmDash instance.

9x402 Payments: Monetizing Content for the AI Era

Every EmDash site has built-in support for x402, the open payment protocol created by Coinbase and Cloudflare in September 2025. x402 uses the HTTP 402 "Payment Required" status code to enable pay-per-request content access.

The flow is simple: a client (like an AI agent) requests content, receives a 402 response with pricing details, submits a stablecoin payment, and gets access. No subscriptions, no accounts, no credit card forms. Configuration requires just three things:

• Which content should require payment
• How much to charge per request
• A wallet address to receive payments

This gives every EmDash site a native business model for the AI era. As more web traffic comes from agents rather than humans, traditional ad-based monetization breaks down. x402 lets content creators charge agents directly for access.

10Deploying EmDash: Cloudflare vs Node.js

EmDash runs anywhere Node.js runs, but it's optimized for Cloudflare Workers. Here's how the two deployment models compare:

Cloudflare Workers (Recommended)

• Scale to zero: no requests = no cost
• V8 isolate architecture: near-zero cold starts
• Global distribution across 300+ data centers
• CPU-time billing: you only pay for actual compute, not idle time
• Free tier: 100,000 requests/day
• Dynamic Workers for plugin sandboxing

Node.js (Self-Hosted)

• Run on any VPS, EC2 instance, or container platform
• Full control over infrastructure and data
• Good for organizations with existing Node.js infrastructure
• Plugin sandboxing still works but without the V8 isolate benefits

For most use cases, Cloudflare Workers is the better choice. The scale-to-zero model means a low-traffic site costs essentially nothing, while a high-traffic site automatically scales without any capacity planning. If you need to run on AWS, you can deploy EmDash as a standard Node.js application on ECS, EC2, or Lambda.

11Migrating from WordPress to EmDash

EmDash provides two migration paths from WordPress:

Option 1: WXR File Export

Go to your WordPress admin, export a WXR (WordPress eXtended RSS) file, and import it into EmDash. This handles posts, pages, and attached media.

Option 2: EmDash Exporter Plugin

Install the EmDash Exporter plugin on your WordPress site. It creates a secure endpoint protected by a WordPress Application Password, allowing EmDash to pull content directly. This is the faster option for large sites.

Both methods automatically migrate attached media into EmDash's media library. For custom post types (which WordPress requires plugins like ACF to create), you can use EmDash's schema system to create matching content types and map the data during import.

For bespoke WordPress blocks, EmDash includes a Block Kit Agent Skill that lets you instruct an AI agent to rebuild them as native EmDash components.

12How Lushbinary Builds with EmDash

At Lushbinary, we're already integrating EmDash into our CMS and content platform offerings. Our team has deep experience with both WordPress migrations and modern serverless architectures, making us well-positioned to help businesses transition to EmDash.

What we offer:

• Full WordPress-to-EmDash migration services including custom post type mapping and media migration
• Custom EmDash plugin development with proper capability scoping and security review
• Astro 6 theme design and development tailored to your brand
• Deployment architecture on Cloudflare Workers or AWS (ECS/Lambda)
• x402 payment integration for content monetization
• MCP server configuration for AI-powered content workflows

❓ Frequently Asked Questions

📚 Sources

• Cloudflare Blog: Introducing EmDash
• Cloudflare Blog: x402 Foundation Launch
• Patchstack: State of WordPress Security 2026
• Astro 6.0 Release

Content was rephrased for compliance with licensing restrictions. Technical details sourced from official Cloudflare and Astro documentation as of April 2026. Features and availability may change — always verify on the official EmDash documentation.