EmDash vs WordPress: what changes for a small business site

The short answer

EmDash and WordPress do the same job for a site owner: you sign in to an admin panel and edit your pages and posts. What changes is everything behind that screen. WordPress runs your site on PHP, with plugins that run with the same access as WordPress itself, and someone has to keep patching them. EmDash, the open-source CMS its makers call "the spiritual successor to WordPress" (emdashcms.com), is built on Astro by Cloudflare: plugins from its registry run sandboxed and permission-gated, you sign in with a passkey, and the design is built for your site instead of installed as a theme.

For a small business site that is mostly pages, a blog and a contact form, that trade usually favors EmDash. For a store, a members area or a site built around one plugin, WordPress is still the better home.

• What stays the same: an admin panel, drafts, revisions, scheduled posts, a media library, menus and user roles. Your page addresses can stay too.
• What gets better: no plugin update screen to babysit, plugins that only get the access you approve, and passkey sign-in.
• What gets harder: a much younger plugin ecosystem, no drag-and-drop page builder, and a site that someone has to build and run.
• Who should stay on WordPress: stores, membership and course sites, sites whose main feature is a plugin, and sites that work, cost little and nobody touches.

What stays the same for you

Day to day, editing an EmDash site looks familiar. Editors work in an admin panel with forms for each kind of content, and "depending on their permissions, they can manage drafts, publishing, media, taxonomies, menus, and widget areas" (EmDash docs). There are five user roles, from Subscriber to Admin (EmDash docs), a publishing calendar, and a revisions list where you can see who changed what and restore an earlier version (EmDash docs).

Your content comes with you. EmDash imports WordPress posts, pages, categories, tags, authors and media (EmDash docs), and your page addresses can stay the same. The parts that do not move on their own, such as redirects and forms, are covered in our website migration SEO checklist.

EmDash vs WordPress, side by side

Two rows matter most to an owner. The plugin row is where most WordPress trouble starts: Patchstack's count puts 91% of last year's new WordPress vulnerabilities in plugins, and every plugin you install adds to the list someone has to keep patched. The editing row is where EmDash asks the most of you: the docs say plainly that "EmDash manages structured content; it is not a visual page builder" (EmDash docs).

What changes day to day

There is no plugin update screen to watch. On WordPress, keeping a site safe means applying plugin, theme and core updates, and hoping none of them conflict. On EmDash, plugins from the registry run in a sandbox, and the admin shows you what each one wants before you install it. When an update asks for more access, for example to make network requests, it needs "fresh approval before the new version takes effect" (EmDash docs).

You sign in with a passkey. "EmDash uses passkey authentication as its primary login method" (EmDash docs): your phone or laptop confirms it is you with a fingerprint, face or PIN. There is no EmDash password for anyone to guess or steal.

Design changes go through whoever builds the site. You edit words, images, posts and pages. Layout and design live in the site's code, so a new page layout is a request, not a drag-and-drop job.

Page builder layouts and forms are rebuilt, not copied. EmDash "does not run PHP, WordPress themes, or WordPress plugins," so "the site design and any custom plugin behavior still need to be implemented for Astro and EmDash" (EmDash docs). Your text and images move; an Elementor layout or a contact form plugin does not. Each form needs to be rebuilt and tested before launch.

What gets harder, honestly

The ecosystem is young. EmDash's own launch post says it best: "WordPress has the best ecosystem of any CMS, with thousands of free and paid plugins. With a registry that launches this week it will be a long time before EmDash is anywhere close" (EmDash blog). If your site depends on a specific WordPress plugin, check that its feature exists or can be built before anything else.

Someone has to build and run it. EmDash is aimed at sites built by developers. Its docs say it "adds operational work: the team is responsible for the database, media storage, backups, upgrades, and the application that serves the admin panel" (EmDash docs). With WordPress, many owners can click "install" on a shared host. With EmDash, you need someone to set it up and look after it.

It is new, and it moves fast. Version 1.0 shipped on September 28, 2026, followed by 1.1, 1.2 and 1.3 within three weeks (EmDash blog). Cloudflare runs its own blog on it, and the launch post says that site "served millions of real page views" (EmDash blog). Still, fast releases mean upgrades need checking, which is part of running the site.

The lock-in question. At the 1.0 launch, Search Engine Journal argued that EmDash's features "trap users into Cloudflare's infrastructure" (Search Engine Journal). Here is what the facts say:

• The license is MIT, one of the most permissive open-source licenses (EmDash blog).
• It runs off Cloudflare too. EmDash supports two setups: Cloudflare, or Node.js with an SQLite, libSQL or PostgreSQL database (EmDash docs). Cloudflare says "there is no lock-in, because all features work anywhere that you can deploy Node.js apps."
• One feature is easiest on Cloudflare. Plugin sandboxing needs a sandbox runner. One ships for Cloudflare and one for Node.js, but without a runner, the docs say to "treat every plugin as a native plugin for trust purposes" (EmDash docs).
• You can take the whole site with you. A site package copies your content, history, settings and media "to another EmDash deployment, including one that uses a different database" (EmDash docs).

Our read: you can leave Cloudflare, and the convenience is greatest on it.

Who should stay on WordPress

Who EmDash fits

EmDash suits the most common kind of small business site: a brochure, marketing or blog site of up to a few hundred pages, with a handful of plugins for SEO, forms, caching or a page builder, no store, and no logged-in members. It fits best when the site was built by someone else, nobody wants to watch plugin updates, and the owner just wants to edit their own content and stop worrying about the rest.

If that sounds like your site, start with the risks of the move itself. Rankings, redirects and forms are where a platform change goes wrong, and our website migration SEO checklist lists every check and the proof to ask for.

Where WotWP fits

We bring WordPress sites into the AI era on EmDash and Astro, and we do the parts that make EmDash harder for an owner. A free, read-only check of your public pages tells you whether your site is a good fit and shows the exact price before you ask. If it is a fit, we build a private preview, check every URL, redirect, form and search detail against your live site, and switch the domain only after you approve it, with the rollback written down. With Looked after hosting, which we recommend, we host the site after launch, handle the upgrades, and email you a monthly certificate listing the checks we ran and what changed. Prefer to host it yourself? Download your finished site instead and run it on your own Cloudflare account.

Want to know which side of the table your site is on? Check your site for free.

Frequently asked questions