EmDash is a next-generation CMS that Cloudflare released as open source on April 1, 2026. "INA Media," operated by INA&Associates, completed its migration to EmDash at the same time as the public launch. The choice of publishing platform sits at the foundation of media strategy, and we have long sought a design that lets us cleanly separate "what humans should do" from "what should be delegated to AI." We judged EmDash to be the first CMS that can serve as that answer. In this article, we share why we chose Cloudflare's new CMS on day one, including the background and the criteria behind that judgment.
Key takeaways
-
EmDash is an open-source CMS released by Cloudflare in April 2026 under the MIT license, built with TypeScript and Astro 6.0.
-
Its biggest features are "plugin sandboxing" and "a design that AI agents can operate directly," addressing the structural security issues of WordPress.
-
INA&Associates adopted EmDash from day one as the foundation of media.ina-gr.com and is already running it in production.
-
Our reason for choosing it was not technical specifications, but a management decision to "create an environment in which our human capital can focus on more essential decision-making."
-
What executives should ask about their publishing infrastructure right now is not a question of technology selection, but of resource allocation: "Who spends time on what, and where?"
What Is EmDash? The True Identity of Cloudflare's "Spiritual Successor to WordPress"
EmDash is a full-stack TypeScript headless CMS released by Cloudflare on April 1, 2026. It is published on GitHub under the MIT license and, as of this writing, has earned approximately 9,700 stars. Cloudflare itself positions EmDash as the "spiritual successor" to WordPress.
Why "spiritual successor"? Since its appearance in 2003, WordPress has embodied the democratic ideal that "anyone can publish a website at low cost." EmDash inherits that ideal while applying a redesign optimized for modern serverless environments and operations that assume AI agents.
The technology stack consists of Astro 6.0, Cloudflare Workers, SQLite (D1), and R2. Because it also runs on SQLite on Node.js, the design does not force lock-in to Cloudflare. This is an important selection criterion for corporate media that assume long-term operation.
Why Is EmDash Called "AI-Native"?
The biggest reason EmDash is drawing attention in the industry is that it is designed on the premise that AI agents will operate it. Specifically, the following three capabilities are built in by default.
First, an MCP server (Model Context Protocol) is bundled with every instance. This allows AI agents such as Claude and ChatGPT to directly create, update, and search content under an authenticated context.
Second, the EmDash CLI covers content management, media uploads, type generation, and schema operations. It can be fully automated from shell scripts, with embedding into CI/CD pipelines also assumed by design.
Third, there is a mechanism called Agent Skills. Instructions for creating plugins and procedures for migrating from WordPress themes are bundled as structured documents that AI agents can understand. At INA Media, our editorial team's agent fleet posts content directly through these Agent Skills.
Honestly, the term "AI-native" tends to be consumed as a temporary buzzword. In EmDash's case, however, the design philosophy consistently puts AI first. There are signs throughout the product that the admin interface was rebuilt under the assumption that it would be operated by AI, rather than being bolted on after the fact for human administrators.
An Old-and-New Problem Solved by Plugin Sandboxing
According to Cloudflare's official announcement, 96% of security issues on WordPress sites originate from plugins. Furthermore, in 2025, the number of high-severity vulnerabilities discovered in the WordPress ecosystem reportedly exceeded the combined total of the previous two years.
The official Cloudflare blog presents a plugin isolation mechanism called "Dynamic Workers" as a response to this structural problem. Each plugin runs inside an independent isolate and can execute nothing beyond the permissions explicitly declared in its manifest (for example, read:content or email:send).
In WordPress, once a plugin is installed its code has unrestricted access to the entire site's filesystem, database, and network. This "all-permissions model" has been a hotbed of vulnerabilities for many years. EmDash's permission-declaration model fundamentally overturns that premise.
For media like INA Media, whose readers include high-net-worth owners and investors, site defacement and personal information leaks are not merely technical incidents — they are damage to trust itself. For us, who view transparency and honesty as the source of long-term trust, being able to make plugin permissions visible through advance declaration carries enormous value in terms of operational peace of mind.
Why INA&Associates Adopted EmDash on Day One
On the surface, choosing a CMS looks like a question of technology selection. From a management standpoint, however, it is a question of resource allocation: "On what do we direct our organization's limited time and attention?" We evaluated EmDash from the following three perspectives.
Connection to Investment in Human Capital
INA&Associates positions itself as a "human capital investment company." Since we allocate our greatest resource to our people, a key management challenge becomes how much of the work that humans should not have to do can be handed off to machines. EmDash's MCP, CLI, and Agent Skills provide an environment in which writers and editors are freed from simple CMS operations and can concentrate on essential work — planning, reporting, and building relationships with readers.
Long-Term Perspective
Because we prioritize sustainable growth over short-term profits, lock-in to proprietary SaaS is a choice we want to avoid. With MIT-licensed open source, we are not at the mercy of vendor-driven price increases, feature deprecations, or service shutdowns.
We ourselves have experienced the burden of content migration in the past. That is precisely why, with a long-term perspective, we give the highest priority to a structure that lets us keep ownership of our data and operational initiative in our own hands.
The Fusion of Technology and Human Capability
EmDash's design philosophy is not one of leaving everything to AI. Human editors retain ultimate quality and accountability, and AI is positioned as a tool that increases the speed and precision of their decisions. This aligns with the idea of "the fusion of technology and human capability" that we have repeatedly discussed internally.
As I touched on in The Frontier of AI Use in the Real Estate Industry, I believe AI should be used not to replace judgment, but to broaden the field of view of the person making the judgment. EmDash embodies that philosophy at the foundational layer of the CMS.
Three Questions Executives Should Ask About Their Publishing Infrastructure Right Now
Whether or not to adopt EmDash depends on each company's circumstances. What is more important, I believe, is to use this moment as an opportunity to rethink the foundation of the CMS, and for executives to revisit the following three questions.
First, "Are our people able to spend their time on essential work?" If editors' time is being consumed by CMS operations, plugin updates, and vulnerability response, that time is a resource that should originally be directed toward building relationships with readers.
Second, "Do we own our data?" SaaS-based CMSs are convenient, but have you ever estimated the cost of migrating your data when the contract ends? From the standpoint of long-term business continuity, I believe a structure in which you can hold operational sovereignty in-house is preferable.
Third, "Is the design something AI agents can directly operate?" Over the next three to five years, the center of gravity of content operations will shift from humans to AI agents. CMSs that are not designed to be operated by AI may, in the near future, be positioned as "old-generation tools for humans only." Re-examining your publishing infrastructure is a topic I would strongly encourage executives who are also rethinking their human capital strategy to address in parallel.
Summary: Technology Exists to Increase the Decision-Making Speed of Human Capital
EmDash is technically an advanced CMS, but the reason INA&Associates adopted it is not the technical specifications themselves. EmDash was, at this point in time, the most consistent choice as the conclusion of a management decision: "to create an environment in which our human capital can focus on more essential decision-making, and to maintain operational sovereignty in-house over the long term."
Technology is not the goal; it is a means to increase the decision-making speed of human capital. Each time a new technology appears, we keep asking ourselves, "Does this direct our people's time toward what is essential, or does it add to their busywork?" In the case of EmDash, we judged it to be the former. We will continue to share our operational learnings on this media as well.
Frequently Asked Questions (FAQ)
Q1. What is the biggest difference between EmDash and WordPress?
A. The plugin security model is fundamentally different. WordPress uses an all-permissions model, while EmDash uses a permission-declaration model (sandboxing). According to Cloudflare's statistics, 96% of vulnerabilities on WordPress sites originate from plugins, and EmDash is designed to solve this structural issue.
Q2. Is it possible to migrate from an existing WordPress site to EmDash?
A. Yes. EmDash supports migration via WordPress's WXR export file or via a dedicated Exporter plugin. Media attached to content is also designed to be automatically imported into EmDash's media library.
Related reading
References
-
Cloudflare Official Blog, "Introducing EmDash — the spiritual successor to WordPress that solves plugin security" (April 1, 2026): https://blog.cloudflare.com/emdash-wordpress/
-
emdash-cms/emdash GitHub repository (MIT License): https://github.com/emdash-cms/emdash
