EmDash is what we offer clients who ask for WordPress

Clients still ask us for WordPress, and I get why. Their team has used it before, editors already know the admin, and there’s a plugin for almost everything. The trouble starts after launch. Someone has to keep updating WordPress and every plugin on the site, and the plugins are where most of the security holes come from.

EmDash 1.0 came out on 28 September. It’s a free, open-source content management system from Cloudflare, pitched as what WordPress would look like if someone built it today. I spent the last month testing it for our EmDash review, and it’s close enough to change what we recommend.

Your editors don’t start over

Editors get what they’re used to: posts, pages, a media library, menus, drafts, scheduled publishing and the option to roll back to an earlier version. Editors log in on the site itself, like in WordPress, and the user roles have the same names.

Existing content can come across too. EmDash has a WordPress importer that brings over posts, pages and images, and it can carry SEO titles and descriptions from plugins like Yoast. I ran a test site through it and the counts matched. It didn’t set up redirects from the old addresses, links inside articles still pointed at the old URLs, and a set of nested categories came out flat. So a move still needs some cleanup, and we do that part by hand.

Editors will feel at home, but the design doesn’t come with them. A WordPress theme can’t be reused, so we rebuild the look of the site, and WordPress plugins don’t work in EmDash either.

Fewer security problems from plugins

This is the part I care about most. Patchstack, a WordPress security company, traces 96% of WordPress vulnerabilities to plugins. In WordPress every plugin can reach the whole site, so a contact form plugin can read your unpublished posts.

EmDash limits what each plugin can touch. Each one has to declare what it needs, like reading content or sending data to one outside service. The site owner approves that when installing it, and EmDash blocks everything else. How strong that protection is depends on the hosting. It’s strongest on Cloudflare’s paid plan and looser on other servers. Plugins built into the site’s own code still get full access. We check that setup site by site.

Less upkeep, and it copes with traffic spikes

A typical WordPress site needs regular updates to WordPress, its plugins and the server underneath, plus caching add-ons to keep it fast. An EmDash site is a single application, and on Cloudflare there’s no server for anyone to patch. Upkeep doesn’t disappear. Someone still sets up backups, email for password resets and timed publishing. It’s a shorter list than WordPress gives you.

The Cloudflare Blog now runs on EmDash. In one launch week it served close to 3 million pageviews, and it absorbed an attack that hit it with 28,000 requests a second without noticeable issues. That’s on Cloudflare’s own hosting. On an ordinary server EmDash scales like any other website, which means more setup as traffic grows.

When we’d still pick something else

It’s a 1.0, and its plugin directory opened the same week. For most things WordPress has a plugin for, EmDash has a short list or nothing yet, so some features mean custom work from us.

It also doesn’t cover what our larger clients need yet. There’s no approval step before a page goes live, the five user roles apply to the whole site, and I found no way to run several brands from one setup. For organizations with several brands, approval workflows or strict rules about who can edit what, Payload stays our default. If your WordPress site has grown into that kind of system, start with our WordPress to Payload guide.

So when a client asks for WordPress, my first question now is what the site depends on. If it runs memberships or an online shop on WordPress plugins, it stays on WordPress for now. For everything else I’d go with EmDash. The client gets the editing experience they asked for, with less to maintain and less exposure to risky plugins.