Cloudflare on Wednesday rolled out EmDash, which it described as “the religious successor to WordPress.” The safety vendor positioned EmDash as a much more safe website constructing software that avoids the intensive cybersecurity issues with WordPress plugins.
However the Cloudflare claims go far past cybersecurity points. The seller is arguing that the very nature of internet sites in 2026 is sharply completely different to the form of web site that WordPress was designed to deal with.
“WordPress powers over 40% of the web. It’s a huge success that has enabled anybody to be a writer, and created a world group of WordPress builders. However the WordPress open supply mission will probably be 24 years outdated this 12 months,” the Cloudflare announcement mentioned. “Internet hosting a web site has modified dramatically throughout that point. When WordPress was born, AWS EC2 didn’t exist. Within the intervening years, that activity has gone from renting digital personal servers, to importing a JavaScript bundle to a globally distributed community at just about no price. It’s time to improve the most well-liked CMS on the web to make the most of this alteration.”
Extra versatile licensing
Cloudflare’s assertion additionally urged that it’s delivering open supply in a means that’s probably extra open and versatile than the WordPress method.
“EmDash is totally open supply, MIT licensed, and out there on GitHub. Whereas EmDash goals to be appropriate with WordPress performance, no WordPress code was used to create EmDash. That enables us to license the open supply mission beneath the extra permissive MIT license. We hope that enables extra builders to adapt, prolong, and take part in EmDash’s improvement,” the corporate mentioned. “EmDash is dedicated to constructing on what WordPress created: an open supply publishing stack that anybody can set up and use at little price, whereas fixing the core issues that WordPress can not resolve.”
The subsequent wave of net improvement
In an interview with Computerworld, Cloudflare senior product supervisor Matt Taylor mentioned his group sees the mission as the following wave of net improvement platforms.
“There’s a entire new technology of builders, and WordPress is outdated information to them. In case you are beginning immediately, there is no such thing as a means you’re choosing WordPress,” Taylor mentioned, including that AI brokers are additionally not going to go for WordPress platforms when creating new websites.
Even when including Cloudflare in entrance of a WordPress website to boost safety, he famous, “it’s a must to hack the system to work with the fashionable web.”
WordPress was unable to supply its suggestions on the announcement by deadline.
WordPress not for brand spanking new customers
Melody Brue, principal analyst for Moor Insights & Technique, mentioned she has not seen many builders who should not already skilled with WordPress selecting it to construct websites, and that she can be seeing that AI brokers by no means go for WordPress until they got specific directions to take action. Given how rampant autonomous AI brokers are immediately, the flexibility to be extra hospitable to agentic techniques might show a large benefit.
“For any person new, you have got this chance to skip all of those legacy CMS assumptions and have true least privilege by design, a first-class expertise for brokers. Not less than, that’s what [Cloudflare] is making an attempt to ship,” Brue mentioned. “They’re baking in agent abilities.”
Enterprise considerations
Relating to enterprise net improvement methods, nevertheless, issues get somewhat extra advanced, Brue mentioned. Given how deeply they’re already invested in WordPress code and plugins and the help surroundings, present WordPress enterprise customers should not prone to simply transfer.
However the intensive authorized outbursts from final 12 months involving Automattic CEO Matt Mullenweg, and the lawsuit with WP Engine, made some enterprise IT executives nervous, as soon as they realized how a lot management one individual had over WordPress platforms.
Brue mentioned, “I can perceive the considerations,” however added that the WordPress squabbles appear to have develop into extra subdued these days: “There may be now much less of the tantrum throwing occurring.”
Thomas Randall, a analysis director at Data-Tech Analysis Group, agreed with Brue that enterprise environments are unlikely to desert WordPress any time quickly.
“Is EmDash the religious successor to WordPress? Not from what Cloudflare has proven up to now. The issue Cloudflare highlights, safety vulnerabilities in WordPress plugins, is actual. However the remainder of the announcement deserves skepticism,” Randall mentioned. “For example, enterprise IT groups with advanced WordPress environments will encounter nontrivial obstacles for migration. EmDash makes use of Transportable Textual content reasonably than WordPress’s HTML content material mannequin, which might considerably complicate automated migration. Present PHP themes and plugins wouldn’t carry over instantly and would probably require substantial redevelopment.”
However that may nonetheless open the door to newcomers who haven’t already invested within the WordPress surroundings.
Competing in a unique layer
Noah Kenney, principal marketing consultant for Digital 520, mentioned the longer term is prone to look far more inviting for an EmDash-like method than for legacy WordPress.
“Cloudflare’s EmDash is much less about changing WordPress outright and extra about setting a brand new safety baseline, which is that CMS platforms ought to have remoted execution environments, least-privilege entry, and verifiable permission fashions,” Kenney mentioned. “That has implications for each content material administration and the way enterprises consider third-party extensibility danger extra broadly.”
Nonetheless, he famous, “viability is an ecosystem query simply as a lot as it’s a technical one. EmDash, even when superior from an architectural perspective, is successfully ranging from zero. Enterprise adoption will rely closely on migration tooling, developer adoption, and whether or not Cloudflare can construct a reputable plugin and integration ecosystem.”
Kenney added that he sees EmDash as “very prone to affect the following part of CMS structure, significantly in security-sensitive and enterprise environments the place plugin danger is already a prevalent situation.”
Sanchit Vir Gogia, chief analyst at Greyhound Analysis, noticed the EmDash transfer in a much wider context, probably signaling the near-term way forward for web site methods.
“EmDash is competing in a unique layer altogether,” Gogia mentioned. “It sits nearer to composable and headless CMS platforms like Contentful and Strapi, and even nearer to developer frameworks like Astro. It’s collapsing what was once separate considerations; content material administration, execution runtime, and safety enforcement are being fused into one programmable surroundings.”
This, he noticed, “is the place the actual friction emerges. Conventional CMS patrons should not essentially builders first. They prioritize usability, ecosystem depth, and velocity of execution for enterprise groups. EmDash is clearly optimized for builders and designers. So the competitors isn’t just product versus product. It’s working mannequin versus working mannequin. And in that contest, incumbents have inertia on their facet, whereas EmDash has architectural purity. Historical past reveals these two not often transfer on the similar velocity.”
This text initially appeared on Computerworld.
