Is EmDash a Real WordPress Replacement?

EmDash can replace WordPress today for content-focused sites with modest plugin needs and a team comfortable building in Astro, but it is not yet a drop-in replacement for sites that depend on PHP themes, specific WordPress plugins or paid extensions.

Every client who has had a WordPress site compromised through a plugin has asked whether a safer option exists. When EmDash reached 1.0 with “spiritual successor to WordPress” in its tagline, many agencies started asking that question again.

This article sets EmDash beside WordPress on four points: the plugin security model, hosting requirements, migration, and the things you give up.

What Is the EmDash CMS?

EmDash is an open source, TypeScript CMS built on Astro. It is MIT-licensed and runs on Cloudflare or on a Node.js server. Cloudflare’s EmDash 1.0 announcement calls it a stable, free and open source CMS “ready to power a production website”.

Each role gets its own way in. Developers write the site in Astro. Editors work in the EmDash admin panel. AI agents can read and change content through the API, the CLI or the built-in Model Context Protocol (MCP) server. You scaffold a new site with:

npm create emdash@latest

Cloudflare says it moved its own blog to EmDash in August, before the 1.0 release.

How Does EmDash’s Plugin Model Differ from WordPress?

The plugin model is the biggest difference between the two systems. In WordPress, every plugin runs in the same PHP process as the site and can reach the database, the filesystem and the network. A sandboxed EmDash plugin starts isolated and has to ask for each capability it needs.

Cloudflare’s EmDash 1.0 post says a sandboxed plugin gets its own private storage and nothing more. The site’s content, media, users, secrets, environment variables, filesystem and network are all closed to it by default. A plugin gets anything beyond that only after it declares the need and the site administrator approves it, much like permissions on a mobile app. Cloudflare’s example is an image optimiser: it asks to read and manage media, but it cannot read user content.

The EmDash plugin registry is decentralised. It is built on AT Protocol, and publishers sign and store their own package and release records in their own Atmosphere account. If the EmDash catalog hides a listing through moderation, the publisher still owns the plugin and its release history.

There is one exception to the sandbox. The configuration reference says the plugins array is for plugins that share the Astro site’s process, and that is where native plugins go. Those plugins run without isolation. Plugins installed from the registry always go through the sandbox.

Should You Host EmDash on Cloudflare or Node.js?

You can host EmDash on Cloudflare or on Node.js, but the sandbox works differently on each. Cloudflare costs money and enforces more limits. The Node.js runner costs nothing extra but enforces fewer.

The plugin sandbox docs set out these requirements. Without a runner, EmDash skips every plugin listed under sandboxed: []. You can still browse a registry you configured yourself, but installing or updating a sandboxed plugin stops with a SANDBOX_NOT_AVAILABLE error. The rest of the site keeps working.

On Node.js, you install the Node adapter and the sandbox runner, then point the config at the runner:

npm install @astrojs/node @emdash-cms/sandbox-workerd workerd

// astro.config.mjs
import { defineConfig } from "astro/config";
import node from "@astrojs/node";
import emdash from "emdash/astro";
import { sqlite } from "emdash/db";

export default defineConfig({
  output: "server",
  adapter: node({ mode: "standalone" }),
  integrations: [
    emdash({
      database: sqlite({ url: "file:./data/emdash.db" }),
      sandboxRunner: "@emdash-cms/sandbox-workerd/sandbox",
    }),
  ],
});

The capabilities docs confirm that the Node.js runner enforces only the 30-second wall-time limit. If a site sets CPU, memory or subrequest limits, the runner logs a warning, because standalone workerd cannot apply them. On Node.js, a plugin that uses too much CPU is cut off only when it hits the wall-time limit.

How Do You Migrate from WordPress to EmDash?

EmDash migrates content, not code. The content import docs list two ways to import content: a WordPress eXtended RSS (WXR) file or a connection to a site running the EmDash Exporter plugin. WordPress.com has no import source of its own, so those sites also use a WXR export or the EmDash Exporter.

The WordPress migration guide warns that an exporter older than 1.2.0 drops comments, menus, the logo and the favicon without telling you. The import still finishes and lists nothing as missing. Check the exporter version before you start. For themes and plugins, the EmDash README says agent skills help port plugins and themes. Even with that help, expect a rebuild.

Where Does WordPress Still Win?

WordPress keeps four practical advantages. It has a far larger theme and plugin ecosystem, almost every host supports it, editors already know it, and it has a mature market for paid plugins. At the 1.0 launch, Cloudflare said the EmDash registry supported free plugins only, with paid plugins planned for later.

Hosting is the second gap. WordPress runs on almost any PHP host. EmDash’s full plugin sandbox needs either a paid Cloudflare plan or a Node.js server you run yourself.

Editors bring the third cost. EmDash’s admin is new to them, so moving a client means retraining staff, not just moving content. If you are weighing several WordPress alternatives, comparing 11ty and WordPress shows how these trade-offs play out for a static-first option.

Who Should Try EmDash Now, and Who Should Wait

Try it now if:

• You build content sites, such as blogs, docs or marketing pages, and your team already works in Astro.
• Plugin supply-chain risk is a real concern for you or your clients.
• You want agents to work with content through the API, CLI or MCP server.

Wait if:

• The site depends on a specific WordPress plugin, a commercial theme or WooCommerce-style functionality.
• You need paid plugins from the registry.
• Your hosting has to be cheap shared PHP hosting.

If you are deploying on Cloudflare, look at cf, the new Cloudflare CLI that entered open beta on 28 September 2026. It manages Workers configuration and bindings through a cloudflare.config.ts file, while Wrangler still handles projects configured with wrangler.jsonc.

EmDash is a real WordPress replacement for a specific kind of site: content-led, light on plugins, and built by an Astro-capable team that values sandboxed plugins over ecosystem size. For everything else, it is worth piloting but not ready to switch to. A good next step is to run a WXR export of one real client site through the importer and list what is missing.

FAQs

Can EmDash import a WordPress site just from its URL?

No. Without the EmDash Exporter plugin, a site URL only lets EmDash check the public WordPress REST API. That check can confirm the site runs WordPress and count its public posts, pages and media, but it cannot import anything. To import, upload a WXR export file or install the EmDash Exporter on the WordPress site and connect with a WordPress application password, which can also reach content the public REST API does not expose.

What happens to Gutenberg blocks and plugin blocks when importing into EmDash?

EmDash turns Gutenberg markup into Portable Text and runs Classic editor HTML through the same converter. Blocks that WordPress builds on the server, such as Latest Posts or many plugin blocks, store no markup in the post. The importer keeps each one as an HTML block holding only the original block comment, which displays nothing on the site, so you need to rebuild or delete them. Reusable blocks become EmDash sections.

Do WordPress draft, scheduled and private posts keep their status in EmDash?

Only published posts stay published. The EmDash importer maps the WordPress publish status to published, while draft, pending, private, future, trash and unknown statuses all become drafts. Scheduled and private posts therefore need manual review after import. The EmDash migration guide also says to count entries by status and confirm drafts stay hidden from logged-out visitors before you switch DNS or retire the WordPress site.

Which databases and storage backends does EmDash support?

EmDash uses Kysely for SQL and the S3 API for storage, so it works with SQLite, Cloudflare D1, Turso or libSQL, and PostgreSQL for data, and with Cloudflare R2, AWS S3, any S3-compatible service or the local filesystem for media. On Cloudflare, sandboxed plugins still read and write through a D1 binding named DB, whatever database adapter the site itself uses.