Cloudflare published their April Fools announcement yesterday. The joke, if it is one, is that they’ve actually built the thing. EmDash is a real, open-source CMS, written in TypeScript, running on Cloudflare Workers, with sandboxed plugins and passkey authentication and built-in x402 payment support.
WordPress plugin security is a genuine crisis. The architecture is a product of its era - PHP scripts with unfettered database access, installed by millions of site owners who have no real framework for evaluating trust. The numbers bear it out: 96% of WordPress security issues trace back to plugins. EmDash’s approach, capability declarations, sandboxed isolates, no implicit trust, is architecturally sound and long overdue.
My scepticism comes from working with WordPress. Not by choice. I work with journalists, bloggers, and writers - people who learned WordPress the same way they learned to type: through necessity, over years, until it became muscle memory. They know where the Media Library is. They know how to use Yoast. They know what a slug is and why it matters, and they learned it without anyone ever really explaining what a slug is.
And it goes deeper than that. PHP and the whole old school WordPress setup serves a level of technical freedom that gets completely overlooked in these conversations. You don’t have to be a software engineer to self host a WordPress blog. Cheap shared hosting, cPanel, FTP - it’s not pretty but it works, and the person running it feels in control of their own thing. That’s not nothing. That’s actually quite a lot. EmDash running on Cloudflare Workers is a great story if you know what Cloudflare Workers is. Most WordPress users don’t, and shouldn’t have to.
EmDash is built for developers. Astro, TypeScript, isolates, serverless - these are words that mean something to me, and nothing to the editor filing a piece at 11pm. The CMS that replaces WordPress for that person needs to feel like WordPress. It needs to be familiar enough that the transition cost approaches zero, because any non-zero transition cost multiplied across a team of twelve journalists and their institutional knowledge becomes a budget line. A real one.
And that’s before we even touch WooCommerce - an ecosystem so entrenched that even Shopify, a vastly simpler and more polished product, struggles to justify the migration. The technology isn’t the barrier. The retraining is. The re-plumbing is. The three months of someones time is.
WordPress’s moat has never been it’s code. It’s the accumulated knowledge of millions of non-technical people who learned one tool, and whose employers, clients, and entire workflows are built around it. EmDash solves the engineering problem really well, and that is genuinely exciting. But the engineering problem was never really why WordPress is still here.
If you were serious about replacing WordPress, you’d have to pick a lane. E-commerce means rewriting WooCommerce and going head to head with Shopify. Blogging and writing is more open - nothing dominates it the way Woo dominates e-com - but you’re still competing with Ghost, Substack, and a dozen others carving it up. Page building means taking on Framer, Webflow, Wix. Write that list out and you realise the market isn’t waiting to be rescued. It’s already being served, by focused products that do one thing well.
Which is what makes the Cloudflare post a little frustrating. It uses WordPress’s very real security problems as a jumping off point, but the destination isn’t actually a WordPress replacement. It’s a showcase for Cloudflare’s infrastructure. Workers, isolates, Cloudflare for Platforms - EmDash is a compelling technical demo for all of that. And there’s nothing wrong with that. But dressing it up as the “spiritual successor to WordPress” is a bit of a gasligh, using legitimate grievances to sell something that isn’t really an answer to them.
I’ve battled with WordPress and the old school setup plenty but I do see the external factors clearly. Outside of the tech world it has a reputation and a familiarity that no amount of elegant TypeScript is going to dislodge. Maybe someone does eventually build a true WordPress replacement. It’ll probably look boring from the outside - familiar interface, gentle migration path, and years of thankless compatibility work.