Cloudflare, the cloud provider that connects millions of sites to the internet, wants to “fix” another digital giant: WordPress. It announced a new open-source system, called EmDash, that’s supposed to address the “core problems that WordPress cannot solve” — and they want to do it by allowing AI agents to take control of your website.
Though it’s still in early access, EmDash is already causing a stir in the WordPress community, and not just because its interface looks like WordPress with a facelift. Cloudflare is calling EmDash the “spiritual successor” of WordPress — something WordPress founder Matt Mullenweg has already refuted in a blog post about the new platform. “Please don’t claim to be our spiritual successor without understanding our spirit,” Mullenweg writes. “I think EmDash was created to sell more Cloudflare services.”
Other members of the WordPress community have jumped online to pick apart EmDash as well, while also calling attention to ways that the WordPress project should be improved — especially when it comes to issues surrounding architecture, security, and AI adoption.
In its announcement, Cloudflare claims to have rebuilt the open-source WordPress project “from the ground up,” offering a built-in model context protocol (MCP) server, which allows large language models (LLMs) to connect and interact with the platform’s documentation. It runs on Astro, Cloudflare’s LLM-friendly web building framework, and uses TypeScript, a programming language that AI agents can better understand. EmDash even supports x402, a tool that web publishers can use to make AI crawlers pay to access their content.
Brian Coords, a developer advocate at WordPress.com owner Automattic, notes that one of EmDash’s strengths is in the speed at which you can set up a website, saying, “Getting from zero to a basic design is fast. I mean, really fast.”
But it “feels a bit vibe-coded,” Coords writes. Mullenweg echoes this, writing on his blog that the interface “is in the uncanny valley of being sorta-WordPress sorta-not,” adding that he knows “it wasn’t a weekend vibecode project, but it has some of that smell.” Mullenweg admits that EmDash’s AI-powered skills feature is a nice touch, but he doesn’t get into the deeper issues holding WordPress back — something that other members of the community have been vocal about in light of EmDash’s launch.
Joost de Valk, the creator of the popular Yoast WordPress plugin, calls EmDash “the most interesting thing to happen to content management in years,” as it’s built to work with support for AI agents and comes with structured content that “machines can parse and manipulate easily.” In his post about EmDash, de Valk brings up the structural issues with WordPress that the project continues to treat “as cosmetic.”
De Valk references a post from WordPress developer Hendrik Luehrsen, who writes that EmDash “exposes an old weakness” in WordPress’s current editor, Gutenberg, which stores data in an HTML format. Luehrsen argues that this structure becomes a problem when developers have to rework content, process it through different interfaces, or move it into other systems.
“The real lesson is that content on the web now has to be thought about differently,” Luehrsen says. “As long as content is understood mainly as output, HTML as a storage format can still seem good enough. But once content moves into new contexts through APIs, multiple frontends, personalization, and AI systems, that logic no longer holds.”
But not everyone agrees with Cloudflare’s claim that EmDash solves a “security crisis” surrounding WordPress plugins. Cloudflare cites data from Patchstack, which says “more high-severity vulnerabilities were discovered in the WordPress ecosystem in 2025 than in the previous two years combined.” As outlined by Cloudflare, WordPress plugins run PHP script that “hooks directly into WordPress to add or modify functionality,” meaning it theoretically has access to everything on your site. Instead, EmDash plugins use something called Dynamic Workers — a tool that allows AI agents to execute code in their own isolated environment, shielding the rest of your site in case things go wrong.
Longtime WordPress developer Rhys Wynne explains in a blog post that these issues may be exaggerated in order to sell EmDash. He writes, “I should point out that although vulnerabilities get discovered, with systems like Patchstack they are usually patched before they become a problem, and if you actually read the patched notes, the ‘security crisis’ often is something that requires a login, or means that a subscriber to a blog can tick a checkbox they shouldn’t,” Wynne writes. “Sure they are needing a fix, but it is using scary words to scare users.”
Meanwhile, Mullenweg says the fact that plugins “can change every aspect of your WordPress experience is a feature, not a bug.” De Valk pushes back on Mullenweg’s take, saying that it’s like “arguing that because some mobile apps need camera access, every app should get root access to the phone.” On his own blog, he says there’s an argument for a “granular permission system” within WordPress, not for “continuing to give every plugin the keys to the entire database.”
EmDash is already trying to draw users from WordPress by making it easy to import sites from the platform. But, as noted by Wynne, if things go south, it doesn’t look like there’s a way to export your site from EmDash and untangle a site from Cloudflare’s proprietary infrastructure. “There’s no intention that Cloudflare right now would abandon EmDash, but it could at a later date. What would happen then if it’s abandoned?” Wynne tells The Verge.
While some WordPress members, including de Valk, say they’re going to build on EmDash, concerns remain about whether EmDash actually has the community to support new users. WordPress is backed by thousands of volunteers, along with developers at Automattic, to create new features for the platform. “When something breaks, there are forums, documentation, tutorials, and developers everywhere who know how to fix it,” Miriam Schwab, the head of WordPress at Elementor, writes. “Thanks to all these decades of content, contribution and usage, LLMs have all the knowledge needed to design, build and troubleshoot WordPress sites.”
“If WordPress starts making the right architectural decisions now, it can still catch up.”
Still, Schwab acknowledges that EmDash “pushes the WordPress ecosystem to look honestly at how it does things” — and that’s exactly what it’s doing now. Just one day before the launch of EmDash, Automattic’s Matias Ventura announced that the project is pushing back the launch of WordPress 7.0 for a “few weeks to finalize key architectural details.” Along with support for real-time collaborative editing, this update will include an AI client and an API that will allow WordPress to communicate with AI models.
Even WordPress’s more skeptical members are hopeful about the prospect of change. “If WordPress starts making the right architectural decisions now, it can still catch up,” de Valk writes. That could make EmDash more like a catalyst for WordPress, rather than a true competitor.
