Why EmDash Will Be the Next Web Standard

WordPress did not win because it was the best-engineered CMS.

It won because anyone could extend it. A plugin for every problem, a theme for every taste, and hosting on every corner. That openness made it the default way to publish on the web for two decades.

The same openness is also its biggest liability. A WordPress plugin runs in the same process as the core, with full access to the database and the filesystem. According to Patchstack, 96% of WordPress security issues originate in plugins. Installing one is an act of trust with no real boundary behind it.

EmDash is the first CMS I’ve seen that keeps the idea and replaces the foundation.

It’s an open source, MIT-licensed CMS written in TypeScript on top of Astro. Cloudflare announced it in April, and the stable 1.0 release landed at the end of September.

What sets it apart is the plugin model. Every plugin runs in its own isolated sandbox and declares up front what it needs, for example content:read and email:send, and it can do exactly that, nothing more. A plugin that sends a notification on publish cannot read your users table, because it was never given the capability to do so.

That one decision changes what a plugin ecosystem can be.

The rest follows the same thinking. Authentication is passkey-based by default. Every instance ships with a CLI and a built-in MCP server, so an AI agent can work with the site through a defined interface instead of fighting its way through an admin panel. It scales to zero on serverless platforms, and it also runs on a plain Node.js server with SQLite or PostgreSQL. The plugin registry is built on the AT Protocol: releases are signed by their publisher and stored in the publisher’s own account, not in a central directory someone else controls.

This is why I think it becomes the next standard.

Not a standard in the specification sense. A standard in the way WordPress was one: the tool people reach for without having to argue for it.

Defaults are decided by ecosystems, and ecosystems grow where extending something is both easy and safe. Until now, the web has had to pick one.

It’s still early. WordPress has twenty years of plugins, themes, and people who know it, and none of that moves overnight.

But the web has changed since 2003. Sites run at the edge, content is read by agents as well as by people, and “install it and hope” is no longer an acceptable security model.

The next default will be the one built for that web.

For the first time in a long while, there is a serious candidate.