Cloudflare released EmDash on April 1st, a new open-source CMS built on Astro and TypeScript, and immediately called it the "spiritual successor to WordPress." WordPress founder Matt Mullenweg responded within hours. He was polite about it, but the message was clear: you don't understand what you're succeeding.
EmDash is a v0.1.0 beta, built in roughly two months with heavy AI-assisted coding, MIT-licensed, and designed to run on Cloudflare's Workers infrastructure. It has a GitHub repo with around 5,000 stars already. WordPress powers about 43% of the web. The mismatch between ambition and current reality here is, to put it gently, significant.
Mullenweg fires back (politely)
Mullenweg's response post is worth reading in full, if only for the observation that everyone involved in reshaping the web seems to be named some variation of Matthew. (He's not wrong. The EmDash announcement was written by Matt Taylor and Matt Kane, and the call was set up by Matthew Prince.) But once he gets past the jokes, his argument boils down to two things: EmDash doesn't share WordPress's spirit, and its plugin security claims don't hold up.
On the spirit question, Mullenweg's pitch is about universality. WordPress runs on a Raspberry Pi, a $0.99/month Indonesian web host, and the White House. Same code everywhere. EmDash, he argues, was created to sell more Cloudflare services, and he says he's fine with that, but don't call it a spiritual successor without understanding the spirit.
It is a fair point, and also a slightly convenient one. WordPress's PHP+MySQL stack hasn't changed in 20-plus years. That same-code-everywhere portability comes partly from the fact that WordPress hasn't really evolved its underlying technology. EmDash runs on any Node.js server, technically, but yes, the Cloudflare integration (D1 for the database, R2 for storage) is clearly the polished path. Mullenweg calling that lock-in while WordPress itself requires a specific (and aging) technology stack is... well, it's a choice.
The plugin security argument
This is the part where Cloudflare has a real case to make, even if it's not quite as clean as the marketing suggests.
According to Patchstack's 2025 report, 96% of WordPress security vulnerabilities originate in plugins. In 2024, researchers found 7,966 new vulnerabilities in the WordPress ecosystem, a 34% increase over 2023. WordPress plugins get full access to the database and filesystem. There's no isolation. A plugin that handles contact forms can, architecturally, read every password hash in your database.
EmDash's answer is sandboxing. Each plugin runs in an isolated V8 worker with a declared capability manifest. A plugin that requests "read:content" and "email:send" can do exactly those two things and nothing else. It is a genuinely different architecture, closer to how mobile app permissions work than anything WordPress has ever attempted.
Mullenweg's counterargument? That WordPress plugins having full access to everything is a feature, not a bug. And that AI will fix plugin security within 18 months.
I'm skeptical of both halves of that. The full-access model clearly produces thousands of vulnerabilities per year. And "AI will fix it" is the kind of claim that sounds great in a blog post but doesn't come with a timeline anyone can hold you to. Eighteen months is long enough to forget you said it.
But here's the catch Mullenweg correctly identifies: EmDash's plugin sandboxing, the headline security feature, only works on Cloudflare's runtime. Self-hosted EmDash doesn't get sandboxed plugins. So the security story is really a Cloudflare Workers story. That's a meaningful asterisk.
The Yoast guy is on board
Joost de Valk, who created the Yoast SEO plugin (arguably the most widely used WordPress plugin in existence), published what amounts to an endorsement. He called EmDash "the most interesting thing to happen to content management in years" and said he's already building on it.
When the person who built WordPress's dominant SEO plugin starts migrating to a competitor, that gets your attention. De Valk was candid about the gaps, though. Zero plugin ecosystem. No community. Ghost, Craft, Statamic all had better architecture than WordPress too, and none of them cracked the adoption problem. "60,000 plugins and 43% market share don't evaporate because someone shipped better architecture," as one CMSWire analysis put it.
Two months and some AI
Cloudflare says EmDash took two months to build, with substantial AI agent assistance. Matt Kane, the lead engineer, pushed back on calling it a vibe-coded weekend project. He's been on the Astro core team for two years, and Cloudflare acquired Astro back in January. So this isn't some random side project. The Astro acquisition looks, in retrospect, like the first move in a longer play.
The timing of the launch, April 1st, was either bold or stupid. Multiple people on Hacker News and Reddit assumed it was an April Fools' joke. Cloudflare has a history of launching real products on that date (1.1.1.1 being the famous example), but still. You're asking people to take a WordPress challenger seriously on a day when every tech announcement is suspect.
What's actually there
I spent some time looking at the repo and the admin interface. It is recognizably CMS-shaped. There's a content editor using Portable Text (structured JSON rather than HTML blobs), an admin panel that looks like WordPress if you squint, content types defined in the database, passkey authentication by default, and built-in features like SEO controls, redirect management, and full-text search that WordPress handles through plugins.
Mullenweg actually called the engineering "very solid" and predicted tens of thousands of sites. But he also said the UI sits in an uncanny valley of sorta-WordPress, sorta-not.
The Hacker News crowd was divided. Some pointed out that the real security model only works on Cloudflare, making the multi-platform story hollow. Others noted that a CMS designed for AI agents to manage programmatically is probably where things are heading regardless. One commenter suggested CMSes should go in the opposite direction, toward static files, not more server-side code. Which, fair.
So does it matter?
Honestly? I don't know yet. EmDash is a beta with no ecosystem, built by a company that clearly wants to sell more Workers subscriptions. Mullenweg's response was measured but self-serving in its own way, defending a platform whose technical foundations predate the iPhone. Both sides have obvious incentives to frame this the way they're framing it.
What I do think is that the plugin security model is a genuine architectural improvement over WordPress. Whether that alone is enough to build a CMS community around, given the graveyard of technically superior WordPress alternatives, is a different question. De Valk's endorsement carries weight, but one prominent developer does not make an ecosystem.
Cloudflare says EmDash was supposed to launch later in April during Developer Week but got moved up. The repo is live, the bugs are already filing in (141 open issues and counting), and Mullenweg has extended an open offer to collaborate. Whether Cloudflare takes him up on that, or whether the "spiritual successor" framing has already burned that bridge, remains to be seen.
