Why I Left WordPress for EmDash

I finally did it. After years of running my blogs on WordPress, I shut it down and rebuilt everything on EmDash, Cloudflare's new open-source CMS. And yes, I appreciate the irony of a guy who hates to see em dashes now running his blog on a platform called EmDash.

This wasn't a migration in the usual sense. I didn't import a single old post. I made a clean break: new platform, new design, fresh start. Here's why.

WordPress security wore me out

WordPress isn't insecure because its core team is careless. It's insecure because of how it's built. Every plugin is PHP code that hooks straight into the site with broad access to everything, and you're expected to trust it because it showed up in a marketplace. According to Cloudflare, 96% of WordPress security vulnerabilities come from plugins. Running a WordPress site meant a steady stream of plugin updates, security notices, and the nagging feeling that something I installed two years ago was a door I forgot to lock.

Then October happened. On October 21, the PHP project shipped emergency fixes for two critical flaws now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 and can let an attacker run code on a server without logging in. Researchers demonstrated working attacks against WordPress, Drupal, and Joomla. Amazon even found an exploitation attempt on October 17, four days before the bugs were public.

To be fair, PHP2Shell is a flaw in PHP itself, not in WordPress. A perfectly maintained WordPress site with every plugin updated was still exposed if the PHP underneath it wasn't patched. And that's exactly my point. With WordPress, I wasn't just responsible for WordPress. I was responsible for PHP, the web server, the database, the operating system, and every plugin on top. One weak layer anywhere in that stack and the whole thing is at risk.

I'm a one-person consulting shop. I don't want to spend my evenings patching a PHP runtime.

Why EmDash

Cloudflare launched EmDash in April and pitched it as the spiritual successor to WordPress. It's a full CMS, with an admin interface and a front end, written from scratch in TypeScript on the Astro framework. There's no PHP anywhere in it, so PHP2Shell simply doesn't apply to my blog.

What sold me:

• Plugins run in their own sandbox. A plugin can't reach into the rest of the site the way a WordPress plugin can. That fixes the root problem instead of patching around it.
• Serverless, so there's no server to babysit. EmDash runs on Cloudflare Workers, with D1 for the database and R2 for media. No droplet, no OS updates, no PHP version to track.
• It's built for how I actually work. EmDash ships with a built-in MCP server and CLI, so I can manage content and code with AI tools like Claude Code. As someone who happily vibe-codes, that's a big deal.
• MIT licensed and open source. I can build on it, template it, and reuse it for other sites.

Is it perfect? No. It's young, it's aimed at developers more than casual bloggers, and it ties you closely to Cloudflare. For a lot of people WordPress is still the right tool. For me, those tradeoffs are easy to accept.

I love Cloudflare (and I'm not shy about it)

The "tied to Cloudflare" part doesn't worry me, because I've been moving everything there anyway. My ULAP Services website now runs on Cloudflare Pages: I commit to GitHub, and it deploys. My contact form is a Cloudflare Worker that fans out to ClickUp and Telegram, which lets me retire n8n for that job. I even built a link shortener on Cloudflare. The DigitalOcean server that used to run all of this is about to be shut off for good.

What I love is simple. It's fast, cheap, and secure out of the box. During PHP2Shell, Cloudflare had WAF rules protecting customers before the bugs were even public, and kept updating them as attackers tried to slip past. That's the kind of partner I want watching the front door.

Workers, D1, R2, Pages, Tunnels: it's one platform, one dashboard, and it all just works together. EmDash is the piece that finally let my blog join the rest of my stack.

The bottom line

I left WordPress because I was tired of being the security team for a stack I didn't want to run. EmDash gives me a modern blog with no PHP, sandboxed plugins, and no server to patch, all on a platform I already trust. If you're running WordPress yourself, at minimum, make sure your PHP is updated for PHP2Shell. And if you're curious what life looks like on the other side, you're reading it.