What is EmDash? The "spiritual successor to WordPress", in plain English

The short answer

EmDash is a free, open-source content management system (the software behind the admin screen where you edit your website) made by Cloudflare and built on Astro, a framework for building fast websites. Its makers call it "the spiritual successor to WordPress": you still sign in and edit pages and posts, but plugins run contained, you sign in with a passkey, and the design is built for your site rather than installed as a theme.

• What it is: an admin panel and content database that live inside your website, released under the MIT license, one of the most permissive open-source licenses.
• Who makes it: Cloudflare, which acquired the team behind Astro in January 2026, announced EmDash on April 1, 2026 and shipped version 1.0 on September 28, 2026.
• How editing works: drafts, a block editor, previews, revisions and scheduling, with saving and publishing kept apart. AI assistants can draft for you, inside the permissions you give them.
• How plugins work: plugins from EmDash's registry run in their own sandbox and get only the permissions you approve, and updates that ask for more wait for you.
• What it is not good for yet: stores, members areas, sites built around one WordPress plugin, and anyone who wants to drag layouts around or run the site with no technical help.

What EmDash is

EmDash is the editing side of a website: an admin panel where you write and publish, and a database that holds your pages, posts and images. "EmDash is a content management system built for Astro. It adds an editor-facing admin panel to the same application as your website" (EmDash docs). The admin and the public site are one application, so a published edit can show on the next page view.

Three facts define it for an owner:

• It is open source and free to use. Cloudflare's launch post says "EmDash is fully open source, MIT licensed, and available on GitHub" (Cloudflare blog). The 1.0 post adds that it "can be deployed for free to Cloudflare" and runs anywhere Node.js apps run (EmDash blog).
• It is built on Astro. Astro is the framework that turns your content into web pages. Astro decides how your site looks; EmDash holds what it says. The docs put it plainly: "Astro components still control the site's HTML and design" (EmDash docs).
• It does not run WordPress code. "EmDash does not run PHP, WordPress themes, or WordPress plugins. It can import WordPress content" (EmDash docs). Your words and images can come across; your theme and plugins cannot.

EmDash's own homepage sums up the pitch in one line: "The CMS for you and your agent" (emdashcms.com). That second half matters, and the editing section below explains why.

Who makes it, and how new it is

Cloudflare, the internet infrastructure company, makes EmDash, and it is about seven months old. In January 2026, Cloudflare announced that "The Astro Technology Company, creators of the Astro web framework, is joining Cloudflare," and said Astro would stay open source under the MIT license (Cloudflare blog).

Being backed by Cloudflare means EmDash is not a weekend project that might vanish. Being seven months old means it changes quickly, and every upgrade is worth checking before it reaches a live site. This blog runs on EmDash, so we read every release with that in mind.

How editing works

You edit an EmDash site in a browser, in an admin panel that will feel familiar if you have used WordPress. You pick a collection, such as Posts or Pages, open an entry, and write. "The editor keeps draft changes separate from the version visitors can see, so saving and publishing are two distinct actions" (EmDash docs).

What a normal editing session looks like:

1. Open the admin and pick what to edit. Posts, Pages and any other kinds of content your site has appear in the sidebar, with search and filters.
2. Write in the block editor. It handles "headings, paragraphs, quotations, lists, links, images, videos, galleries, code blocks, tables" and more. Type / to add a block, or drag an image straight into the text (EmDash docs).
3. Save a draft and preview it. Saving stores your work without changing the live page. If your site has previews switched on, you see the page as visitors will.
4. Publish now or schedule it. A publishing calendar arrived in version 1.1 (EmDash blog).
5. Undo when you need to. Revisions show who changed what and let you restore an earlier version (EmDash docs), and deleted entries go to a trash you can restore from (EmDash docs).

There are five user roles, from Subscriber to Admin, so a helper can write drafts without being able to publish or change settings. If two people open the same page, EmDash refuses the older save "so the editor can reload the newer version instead of overwriting it" (EmDash docs).

AI assistants can work in the same admin. "Every site ships with an MCP server" (emdashcms.com): a standard connection that lets you "ask Claude, ChatGPT, or other tools to draft posts, update pages, manage media, search your content, and more" (EmDash docs). The assistant gets no more access than the role you give it. A Contributor-level assistant can write drafts but cannot publish, and the docs recommend you "create content as a draft, review it in the admin panel, then ask the AI to publish it – or publish it yourself." This is what "the AI era" means in practice for a small site: an assistant can do the typing, and you keep the publish button.

What you do not edit is the layout. "EmDash manages structured content; it is not a visual page builder" (EmDash docs). You change words, images, posts, menus and pages. A new page design is a change to the site's code, made by whoever builds the site.

How plugins work

Plugins from EmDash's registry run in a sandbox and can only do what you approve. "Plugins you install from the admin run in their own isolated sandbox" (emdashcms.com). Each plugin declares the permissions it needs, and EmDash shows them to you before anything is installed.

This is the biggest change from WordPress for an owner. On WordPress, a plugin runs with the same access as WordPress itself, which is why plugins are where most of the trouble starts: Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins (Patchstack, State of WordPress Security 2026).

Here is how installing a registry plugin works on EmDash:

1. Browse the registry in the admin, or at plugins.emdashcms.com.
2. Read the consent screen. It lists every permission the plugin asks for, in plain terms: "Read site content", "Change where visitors are sent", "Send requests to the plugin's allowed host list" (EmDash docs).
3. EmDash checks the download against the publisher's signed records before loading it, and stops if a check fails (EmDash docs).
4. Updates that want more access wait for you. "EmDash leaves the installed version in place until you approve the change" (EmDash docs).

Two honest limits. First, a permission you approve is still real: the docs warn that "an approved permission still authorizes the described operation." Second, not every plugin is sandboxed. "Native plugins" are added in the site's code and "have full access to the runtime" (EmDash docs), so they deserve the same trust you would give a WordPress plugin. Sandboxing also needs a sandbox runner, which on Cloudflare means a paid plan (EmDash docs). The accurate summary: registry plugins are sandboxed and permission-gated. That is a big step, not a guarantee.

What EmDash is not good for yet

EmDash is not yet the right home for every site, and its own makers say so. On plugins, the 1.0 post is blunt: "WordPress has the best ecosystem of any CMS, with thousands of free and paid plugins. With a registry that launches this week it will be a long time before EmDash is anywhere close" (EmDash blog).

Someone technical has to build and run it. The docs say self-hosting "adds operational work: the team is responsible for the database, media storage, backups, upgrades, and the application that serves the admin panel" (EmDash docs). WordPress has a one-click install on most hosts; EmDash does not have an equivalent for owners yet.

Early reviews said much the same. Search Engine Journal's review in April, written at version 0.1.0, concluded that "EmDash is not ready for general use," mainly because setup needed a command line and there was no point-and-click builder (Search Engine Journal). Since then, EmDash has reached 1.0 and added a plugin registry and a publishing calendar. The setup and layout points still hold: EmDash is ready for owners to edit, not for owners to set up alone.

What it means for your WordPress site

If your site is mostly pages, posts and a contact form, EmDash is a real option, and the question becomes who does the move and how it is checked. EmDash's importer brings over posts, pages, categories, tags, authors and media (EmDash docs). It does not rebuild your forms or your design, and its own checklist tells you to "crawl old public URLs and prepare redirects for every changed route" and to keep WordPress running "until the imported site has passed verification."

For the full trade, side by side, read EmDash vs WordPress: what changes for a small business site. For the checks that keep your Google rankings through any move, read our website migration SEO checklist.

Where WotWP fits

We bring WordPress sites into the AI era on EmDash and Astro, and we handle the part EmDash leaves to a technical team. A free, read-only check of your public pages tells you whether your site is a good fit and shows the exact price up front. If it fits, we build a private preview, check every URL, redirect, form and search detail against your live site, and switch only after you approve, with the rollback written down. With Looked after hosting, which we recommend, we host the site after launch, handle the upgrades, and email you a monthly certificate listing the checks we ran. Prefer to host it yourself? Download your finished site instead and run it on your own Cloudflare account.

Curious whether your site could run on EmDash? Check your site for free.

Frequently asked questions