Why I Started This Blog (And Why EmDash Made It Happen)

I've been meaning to bring back a personal blog for a while. Not a polished content-marketing exercise — just a place to share what I'm building, what I'm learning, and the occasional thing I find on the internet that's worth talking about. Data, cloud, AI, agents, workflows. The stuff I spend my days thinking about anyway.

The trigger? Cloudflare launched EmDash this month — an open-source CMS they're positioning as the spiritual successor to WordPress. Written entirely in TypeScript, built on top of Astro , serverless by default, and with a plugin architecture that actually sandboxes extensions instead of giving them the keys to everything. It's still in beta (v0.1.0, developer preview), but the ambition is clear: take what made WordPress dominant and rebuild it for how we actually deploy software in 2026.

When I saw the announcement, I didn't want to just read about it. The best way to understand a new tool is to use it for something real. So I set up a site, started writing, and here we are.

What's EmDash, and why does it matter?

WordPress powers roughly 40% of the internet. It's also nearly 24 years old, and its age shows in ways that matter — particularly around security. According to data Cloudflare cited in their launch post, 96% of WordPress security issues originate in plugins. The reason is architectural: WordPress plugins run in the same PHP process as the core, with unrestricted access to the database and filesystem. One poorly written plugin can compromise an entire site.

EmDash takes a different approach. Plugins run in isolated sandboxes (Cloudflare calls them Dynamic Workers) and must declare their permissions upfront in a manifest. If a plugin doesn't ask for write access, it doesn't get write access. It's the same principle we apply in cloud infrastructure — least privilege — applied to a CMS.

Beyond security, EmDash is designed to be AI-native. Every instance ships with a built-in MCP server, CLI tools for programmatic management, and what they call Agent Skills — structured documentation that lets AI coding agents understand and modify an EmDash installation without hand-holding. Whether or not you think that's useful today, it's a bet on where content management is heading.

You can deploy it to Cloudflare Workers or run it on any Node.js server. The source code is MIT-licensed, which is a deliberate move away from WordPress's GPL — and a pragmatic one for enterprise adoption.

What I've built so far

Two weeks in, and I've already gone deeper than I expected.

A forms plugin with AWS SES integration. I needed a way to handle contact forms with email confirmations and newsletter delivery. EmDash's plugin system made this straightforward to build — define your permissions in the manifest, hook into the lifecycle, and wire up AWS SES for the email side. I also integrated Cloudflare Turnstile for bot protection on forms, which keeps spam out without subjecting visitors to CAPTCHAs. The whole thing came together faster than I expected, which says something about how well the plugin API is designed even at this early stage.

A contribution to the EmDash core. While building my plugin, I ran into a bug: the plugin:activate and plugin:deactivate lifecycle hooks weren't firing when you toggled a plugin's status through the admin UI. The hook pipeline was being rebuilt, but nobody was calling the actual hooks — so plugins relying on activation to schedule tasks or run setup logic would silently fail. I submitted a fix that aligns the behaviour with how PluginManager.activate/deactivate already works, and it was merged into main. Small fix, but exactly the kind of thing that surfaces when people start building real things on top of a new platform.

What's next

I plan to keep writing here — mostly about things I'm working on or thinking about across cloud architecture, AI agents and workflows, data platforms, and the tools that tie them together. No fixed schedule, no growth hacking, no engagement bait. Just notes from someone who builds this stuff for a living.

If EmDash is on your radar, I'd encourage you to try it. It's early, it's rough in places, and the plugin ecosystem is essentially nonexistent. But the foundations are sound, the architecture is modern, and the team behind it clearly understands where the gaps in WordPress actually are. I'll be contributing where I can — the potential is there.

Thanks for reading the first one.