Cloudflare's Open-Source CMS: EmDash challenges WordPress
EmDash is a new content management system based on TypeScript and Astro. Plug-ins are intended to run securely within a sandbox there.
(Image: Stokkete / Shutterstock.com)
Cloudflare has released EmDash as a preview, an open-source CMS with a focus on security. The company is positioning it as the "spiritual successor" to WordPress, which has been around for over 20 years. EmDash is characterized by running plug-ins in their sandbox to enhance security. Integrated AI functions are also included.
EmDash is serverless, but can be run on your own hardware or a platform of your choice. The full-stack content management system (CMS) is written in TypeScript and uses the open-source web framework Astro under the hood, whose manufacturer Astro Technology Company was acquired by Cloudflare at the beginning of the year. The CMS is named after the em dash (—), which is used, among other things, as a dash in English typography.
(Image:Â jaboy/123rf.com)
Tools and trends in the JavaScript world: The enterJS 2026 will take place on June 16 and 17 in Mannheim. The program revolves around JavaScript and TypeScript, frameworks, tools and libraries, security, UX, and more. Early bird tickets are available in the online ticket shop.
Plug-ins in their own sandbox
As Cloudflare describes in its blog, 96 percent of all security problems in WordPress originate from plug-ins. In EmDash, therefore, each plug-in runs within its own isolated sandbox. Cloudflare's Dynamic Workers technology is used for this. A plug-in receives its capabilities in EmDash via bindings and can only perform actions explicitly declared in the plug-in's manifest. This should give developers certainty before installation about the permissions an extension will have.
Plug-ins for EmDash can also have any license, as they are independent of EmDash. This is intended to prevent marketplace lock-in. In contrast, WordPress extensions undergo manual review for security reasons and are closely intertwined with WordPress code. Therefore, it is sometimes argued that the WordPress GPL license must be used, according to Cloudflare.
Videos by heise
Integrated AI Features
Marketed as an "AI Native CMS", EmDash offers several features for using artificial intelligence. EmDash instances contain Agent Skills and offer an integrated Remote MCP (Model Context Protocol) server. The EmDash CLI also enables AI agents to interact with local or remote EmDash instances. This allows, for example, uploading media, searching content, or creating and managing schemas.
Developers can import their WordPress sites into EmDash in various ways. To get started with EmDash, three starter templates are included: Blog, Marketing, and Portfolio. Interested parties can try out the EmDash admin interface in a playground.
(Image:Â EmDash-Repository auf GitHub (Screenshot))
The source code of the MIT-licensed project can be found in the GitHub repository, which is currently in beta preview version 0.1.0. Further information about EmDash is provided by the manufacturer, Cloudflare, in its blog.
(mai)
