Cloudflare’s new CMS isn’t a WordPress killer, it’s an alternative to WordPress
Cloudflare on Wednesday launched EmDash, which it describes as a “spiritual successor to WordPress.” The security vendor has positioned EmDash as the most secure site building tool that avoids the broader internet security issues with WordPress plugins.
But Cloudflare’s claims go beyond cybersecurity issues. The vendor argues that the nature of websites in 2026 is very different from the type of website WordPress was designed to handle.
“WordPress powers more than 40% of the Internet. It is a great success that has allowed anyone to become a publisher, and has created a global community of WordPress developers. But the open source project of WordPress will be 24 years old this year,” said the announcement of Cloudflare. “Website hosting has changed a lot in that time. When WordPress was born, AWS EC2 didn’t exist. Over the years, that job has gone from renting private servers, to uploading loads of JavaScript to a global distribution network at no cost. It’s time to develop the most popular CMS on the Internet to take advantage of this change.”
More flexible licensing
Cloudflare’s statement also suggested that it was bringing open source in a way that could be more open and flexible than the WordPress approach.
“EmDash is fully open source, MIT licensed, and available on GitHub. Although EmDash aims to be compatible with WordPress functionality, no WordPress code was used to create EmDash. That allows us to license the open source project under the more permissive MIT license. We hope that allows more developers to adapt, extend, and participate in the development of EmDash,” the company said. “EmDash is committed to building on what WordPress created: an open publishing stack that anyone can install and use at minimal cost, while solving the core problems that WordPress can’t solve.”
The next wave of web development
In an interview with Computerworld, Cloudflare CEO Matt Taylor said his team sees the project as the next wave of web development platforms.
“There is a new generation of developers, and WordPress is old news to them. If you start today, there is no way you choose WordPress,” said Taylor, adding that AI agents also will not choose WordPress platforms when creating new sites.
Even when he added Cloudflare in front of a WordPress site to improve security, he noted, “you have to hack the system to work with the modern Internet.”
WordPress could not provide a response to the announcement by deadline.
WordPress is not for new users
Melody Brue, principal analyst at Moor Insights & Strategy, said she has not seen many developers with no WordPress experience choose to build sites, and that she has seen AI agents not choose WordPress unless they are given clear instructions to do so. Given how autonomous AI agents are today, the hospitality capabilities of agent systems may prove to be a huge advantage.
“For a new person, you have this opportunity to skip all this legacy CMS thinking and have a little bit of real privilege with design, a first-class experience for agents. At least, that’s what CMS says.” [Cloudflare] he’s trying to bring help,” said Brue. “They’re baking in the agent’s skills.”
Business concerns
When it comes to business web development strategies, however, things get more complicated, says Brue. Given how deeply invested they are in the WordPress code and plugins and support environment, existing business WordPress users are unlikely to leave easily.
But the big legal explosion from last year involving the CEO of Automattic Matt Mullenweg, and the case of WP Engine, made business IT managers nervous, when they realized how much control one person has over WordPress platforms.
Brue said, “I understand the concern,” but added that the WordPress controversies seem to have been won over recently: “Now there’s less temper tantrums going on.”
Thomas Randall, director of research at Info-Tech Research Group, agreed with Brue that business environments are unlikely to abandon WordPress anytime soon.
“Is EmDash a spiritual follower of WordPress? Not from what Cloudflare has shown so far. The problem highlights Cloudflare, a security risk in WordPress plugins, it’s true. But the rest of what has been announced deserves to be doubted,” said Randall. “For example, enterprise IT teams with complex WordPress environments will encounter serious migration limitations. EmDash uses Plain Text rather than WordPress’ HTML content model, which can be very difficult to automate migration. Existing PHP themes and plugins will not migrate directly and may require significant redevelopment.”
But that will still open the door to newcomers who haven’t invested in the WordPress space.
Competing on a different level
Noah Kenney, senior consultant for Digital 520, said the future looks more inviting for an EmDash-like platform than legacy WordPress.
“Cloudflare’s EmDash is less about replacing WordPress directly and more about setting a new security baseline, namely that CMS platforms should have independent kill zones, less privileged access, and validated permission models,” Kenney said. “That impacts both content management and the way businesses assess third-party scalability risks more broadly.”
However, he noted, “performance is as much a question of the ecosystem as it is a question of technology. EmDash, although superior from an architectural point of view, starts with efficiency from zero. Business adoption will largely depend on migration tools, developer acceptance, and whether Cloudflare can build a reliable plugin and integration ecosystem.”
Kenney added that he sees EmDash as “potentially impacting the next phase of CMS architecture, especially in security-sensitive and enterprise environments where plugin vulnerability is already a common problem.”
Sanchit Vir Gogia, senior analyst at Greyhound Research, saw EmDash moving in a very broad direction, which may indicate the near future of website strategy.
“EmDash competes on a completely different level,” Gogia said. “It sits next to modular and headless CMS platforms like Contentful and Strapi, and even closer to developer frameworks like Astro. It breaks down what used to be separate concerns; content management, runtime, and security are integrated into one programmable environment.”
He saw this, “where the real conflict arises. The traditional buyers of CMS are not really the first developers. They prioritize the usability, the depth of the ecosystem, and the speed of execution of the business groups. EmDash is clearly prepared for developers and architects. So the competition is not just product against product. The operating model against the company model, and the operating model. EmDash has the purity of History shows that these two structures are not always moving fast the same.
This article first appeared on Computerworld.
