Thoughts on EmDash – Techbros latest attempt to stop me making mortgage payments

So on April Fools day (and also the day before a long weekend in the UK – thanks for giving me things to think about lads), EmDash was announced as the latest spiritual successor to WordPress and…yeah? It’s a thing. You can try it out here. Sure enough, within 20 minutes people were calling it a WordPress killer. To be fair, the blog had a bit of bravado. After playing around with it over the weekend, I think I know roughly where I stand.

The Things I like with EmDash

It’s nice enough. Has a very familiar interface, the default theme is quite pretty, and you can do some things that should be in WordPress core – simple SEO things that you need a plugin before. To write a post and put it online is quick. There is also custom post types – which are standard and much needed, although from my take I cannot see a way to expand them in the way that ACF does with WordPress.

The State of CMSs in my business

A couple of years ago I had a rough time – clients were leaving usually because their CTO would recommend another CMS, or use some AI vibe coded software that integrated with Vercel or Netlify.

Now? Those clients are coming back.

There are two reasons as to why they’re coming back. The first (and more common) reason is service lock-in caused businesses to haemorrhage money. Two years ago it seemed every client I had was switching to Webflow or exploring to switch. I’ve moved two back this year, and one back last year. Why? Webflow put their prices up, made it confusing, and those people were hit by unexpected bills. Could they move? Could they bollocks. They were locked in. Eventually the cost of a Webflow to WordPress migration was considerably more affordable than keeping the site on Webflow.

The other thing (which actually saw an agency shut down) was the AI approach became fastly unmaintainable. Go and read Ross Wintle’s article on personal apps. Stakeholders want features. Features need to be built. By having an AI approach with little to no oversight, the architecture of the AI driven code became a mess. What started as a system that was deployed quickly is now bloated again.

Both those things seem to be occurring with EmDash. It’s largely driven by one developer, and there does seem to be at least somewhat of a lock in to Cloudflare. Furthermore, I’m concerned that whilst EmDash has an import functions all built in, the export functions don’t exist. Doesn’t exactly scream portable.

Everything’s the next WordPress…until it isn’t

The blog post talks about the security risk – using “plugin security crisis”. I feel it may be a bit overegged to sell the product. As a bit of mafia esque “This is a nice site, I’d hate to see something happen to it”. Sure it takes a bit of time to navigate the WordPress.org repository, but it takes a bit of time to navigate a supermarket. I should point out that although vulnerabilities get discovered, with systems like Patchstack they are usually patched before they become a problem, and if you actually read the patched notes, the “security crisis” often is something that requires a login, or means that a subscriber to a blog can tick a checkbox they shouldn’t. Sure they are needing a fix, but it is using scary words to scare users.

I personally haven’t had a hacked site in about 10 years.

Eventually with these proprietary systems, you’ll hit a limit. Those limits just don’t seem to exist on WordPress. You can build a server to do exactly what you want with the technical know how. Can you do that on Cloudflare? And what happens when Cloudflare goes a bit off the rails? Sure, they’re the techies company du-jour, promoting content creators, but then, so were Google. And look where they are now.

Finally, I don’t think Emdash will succeed where WordPress can because the infrastructure isn’t there. There are few plugins. WordPress’ onboarding, whilst not great, was good enough – the documentation for it was fine to help you dig through things. Documentation like this – for creating EmDash plugins feels incredibly unwieldly and obtuse. Sure it’s something, and EmDash has been publicly available for a week, but it would need to improve.

And this is the thing, folks are touting how quick it is to scale, but not bringing anybody along for the ride. Take this block of text for example:-

Sandboxed Mode

Sandboxed plugins run in isolated V8 isolates on Cloudflare Workers via Dynamic Worker Loader. Each plugin gets its own isolate.

• Capabilities are enforced. If a plugin declares ["read:content"], it can only call ctx.content.get() and ctx.content.list(). Attempting ctx.content.create() throws a permission error.
• Network is blocked by default. Direct fetch() calls fail. Plugins must use ctx.http.fetch(), which validates against allowedHosts.
• Storage is scoped. A plugin can only access its own KV and storage collections.
• Admin UI uses Block Kit. Sandboxed plugins describe their UI as JSON blocks — no plugin JavaScript runs in the browser. See Block Kit reference.
• No Portable Text block types. PT blocks require Astro components for site-side rendering (componentsEntry), which are loaded at build time from npm. Sandboxed plugins are installed at runtime and can’t ship components. PT blocks are a native-plugin-only feature.
• Routes work. Standard plugin routes are available in both trusted and sandboxed modes via the sandbox runner’s invokeRoute() RPC.

Sandboxing is not available on Node.js. All plugins run in trusted mode on non-Cloudflare platforms.

I’ve been coding professionally for nigh on twenty years, and I struggle to understand exactly what’s being said here. Of course, people are saying “use AI Agents/MCP” and therein lies the problem. You baffle people. Nobody is really doing work to educate the lay-folk. It’s a similar problem that existed with Cryptocurrency and NFTs. Using baffling language. And look how those two things worked out?

My Conclusion

Don’t get me wrong, there is a lot wrong with the stewardship of WordPress. I believe Matt Mullenweg is actively harming the product, and I want FAIR to succeed, but I’m not sure that EmDash is a solution. The challenges people have with WordPress – plugin bloat, security issues, and slowness can be fixed with WordPress. This just feels like EmDash is making developers more JavaScript focussed, and lazy, and I feel like it’s is BSing folks with AI. Sure you can build things faster, but are they good, are you learning? Is it maintainable? Will see how it grows in the next two years, but I wouldn’t move any of my clients over to it just yet.

And, when EmDash gets there, thanks to the portability of WordPress, I’ll move over just fine.