Cloudflare on Wednesday rolled out EmDash, which it described as “the religious successor to WordPress.” The security vendor positioned EmDash as a much more safe website constructing instrument that avoids the in depth cybersecurity issues with WordPress plugins.
However the Cloudflare claims go far past cybersecurity points. The seller is arguing that the very nature of internet sites in 2026 is sharply completely different to the sort of web site that WordPress was designed to deal with.
“WordPress powers over 40% of the web. It’s a huge success that has enabled anybody to be a writer, and created a world group of WordPress builders. However the WordPress open supply challenge will probably be 24 years previous this yr,” the Cloudflare announcement stated. “Internet hosting an internet site has modified dramatically throughout that point. When WordPress was born, AWS EC2 didn’t exist. Within the intervening years, that process has gone from renting digital personal servers, to importing a JavaScript bundle to a globally distributed community at just about no value. It’s time to improve the most well-liked CMS on the web to reap the benefits of this transformation.”
Extra versatile licensing
Cloudflare’s assertion additionally steered that it’s delivering open supply in a approach that’s probably extra open and versatile than the WordPress method.
“EmDash is absolutely open supply, MIT licensed, and accessible on GitHub. Whereas EmDash goals to be appropriate with WordPress performance, no WordPress code was used to create EmDash. That permits us to license the open supply challenge beneath the extra permissive MIT license. We hope that enables extra builders to adapt, prolong, and take part in EmDash’s growth,” the corporate stated. “EmDash is dedicated to constructing on what WordPress created: an open supply publishing stack that anybody can set up and use at little value, whereas fixing the core issues that WordPress can not remedy.”
The subsequent wave of internet growth
In an interview with Computerworld, Cloudflare senior product supervisor Matt Taylor stated his group sees the challenge as the subsequent wave of internet growth platforms.
“There’s a entire new technology of builders, and WordPress is previous information to them. In case you are beginning as we speak, there isn’t a approach you’re choosing WordPress,” Taylor stated, including that AI brokers are additionally not going to go for WordPress platforms when creating new websites.
Even when including Cloudflare in entrance of a WordPress website to reinforce security, he famous, “you need to hack the system to work with the fashionable web.”
WordPress was unable to supply its suggestions on the announcement by deadline.
WordPress not for brand spanking new customers
Melody Brue, principal analyst for Moor Insights & Technique, stated she has not seen many builders who usually are not already skilled with WordPress selecting it to construct websites, and that she can be seeing that AI brokers by no means go for WordPress except they got express directions to take action. Given how rampant autonomous AI brokers are as we speak, the flexibility to be extra hospitable to agentic programs might show an enormous benefit.
“For any individual new, you’ve gotten this chance to skip all of those legacy CMS assumptions and have true least privilege by design, a firstclass expertise for brokers. At the least, that’s what [Cloudflare] is attempting to ship,” Brue stated. “They’re baking in agent abilities.”
Enterprise issues
On the subject of enterprise internet growth methods, nevertheless, issues get just a little extra advanced, Brue stated. Given how deeply they’re already invested in WordPress code and plugins and the help surroundings, present WordPress enterprise customers usually are not more likely to simply transfer.
However the in depth authorized outbursts from final yr involving Automattic CEO Matt Mullenweg, and the lawsuit with WP Engine, made some enterprise IT executives nervous, as soon as they realized how a lot management one individual had over WordPress platforms.
Brue stated, “I can perceive the issues,” however added that the WordPress squabbles appear to have grow to be extra subdued recently: “There may be now much less of the tantrum throwing occurring.”
Thomas Randall, a analysis director at Data-Tech Analysis Group, agreed with Brue that enterprise environments are unlikely to desert WordPress any time quickly.
“Is EmDash the religious successor to WordPress? Not from what Cloudflare has proven to date. The issue Cloudflare highlights, security vulnerabilities in WordPress plugins, is actual. However the remainder of the announcement deserves skepticism,” Randall stated. “As an illustration, enterprise IT groups with advanced WordPress environments will encounter nontrivial boundaries for migration. EmDash makes use of Moveable Textual content relatively than WordPress’s HTML content material mannequin, which might considerably complicate automated migration. Present PHP themes and plugins wouldn’t carry over immediately and would possible require substantial redevelopment.”
However that may nonetheless open the door to newcomers who haven’t already invested within the WordPress surroundings.
Competing in a distinct layer
Noah Kenney, principal advisor for Digital 520, stated the longer term is more likely to look far more inviting for an EmDash-like method than for legacy WordPress.
“Cloudflare’s EmDash is much less about changing WordPress outright and extra about setting a brand new security baseline, which is that CMS platforms ought to have remoted execution environments, least-privilege entry, and verifiable permission fashions,” Kenney stated. “That has implications for each content material administration and the way enterprises consider third-party extensibility threat extra broadly.”
Nonetheless, he famous, “viability is an ecosystem query simply as a lot as it’s a technical one. EmDash, even when superior from an architectural perspective, is successfully ranging from zero. Enterprise adoption will rely closely on migration tooling, developer adoption, and whether or not Cloudflare can construct a reputable plugin and integration ecosystem.”
Kenney added that he sees EmDash as “very more likely to affect the subsequent part of CMS structure, notably in security-sensitive and enterprise environments the place plugin threat is already a prevalent subject.”
Sanchit Vir Gogia, chief analyst at Greyhound Analysis, noticed the EmDash transfer in a wider context, probably signaling the near-term way forward for web site methods.
“EmDash is competing in a distinct layer altogether,” Gogia stated. “It sits nearer to composable and headless CMS platforms like Contentful and Strapi, and even nearer to developer frameworks like Astro. It’s collapsing what was separate issues; content material administration, execution runtime, and security enforcement are being fused into one programmable surroundings.”
This, he noticed, “is the place the actual friction emerges. Conventional CMS consumers usually are not essentially builders first. They prioritize usability, ecosystem depth, and velocity of execution for enterprise groups. EmDash is clearly optimized for builders and designers. So the competitors is not only product versus product. It’s working mannequin versus working mannequin. And in that contest, incumbents have inertia on their facet, whereas EmDash has architectural purity. Historical past reveals these two hardly ever transfer on the identical velocity.”
This text initially appeared on Computerworld.
