Cloudflare's EmDash 1.0 goes stable with decentralized AT Protocol plugin registry

EmDash 1.0 is stable and production-ready

Cloudflare has released EmDash 1.0, a stable, free and open-source content management system the company first unveiled on April 1 as the "spiritual successor to WordPress". The launch date invited suspicion of an April Fools' joke, which Cloudflare acknowledges in its announcement, but the release is real: the company describes it as ready to power production websites, agency site-building platforms and hosting products.

EmDash is built on Astro. Developers build sites with the framework, editors manage content through the EmDash admin, and AI agents can work through the API, the CLI or a built-in MCP server. Version 1.0 pulls together editorial, media, localization, migration and deployment workflows that Cloudflare says have been tested in production.

Five months of hardening

According to the Cloudflare blog, the five months since the first beta were spent with contributors and production users on the parts every site depends on: data safety, database migrations, editorial workflows, localization, plugin security, performance and the reliability of the admin, API, MCP and media experiences. Real deployments, the company says, uncovered edge cases that only appear when a site serves live traffic to real teams of editors.

The clearest test came in August, when Cloudflare migrated its own blog to EmDash as "Customer Zero". Serving that site means handling millions of pageviews per week, traffic spikes of up to 5,000 requests per second and sporadic DDoS attacks. Features that grew out of that migration, including optional KV object caching, a Hyperdrive database adapter and Workers Cache compatibility, are now available to all users.

Early adopter Avulux converted a custom microsite to EmDash in under a day using EmDash Agent Skills. "The site had to be fast to use and simple for our team to update," Greg Barbosa, Avulux's Director of Innovation and Systems, said in the post. "WordPress had become the opposite of that."

A plugin registry without a gatekeeper

The headline feature of the 1.0 launch is a decentralized plugin registry. Cloudflare argues that traditional registries combine three roles, publisher accounts, the authoritative package record and the discovery catalog, which makes a single company the gatekeeper for both identity and distribution. If an account is suspended, a listing is removed or the service shuts down, publishers cannot take their identity and release history elsewhere.

EmDash separates the plugin from the catalog. Developers publish sandboxed plugins while retaining control of their packages and release history, site owners can discover, inspect and install plugins from inside EmDash, and other services can index the same publications and build their own catalogs with their own policies. The registry is built on AT Protocol, the decentralized network protocol behind Bluesky: authors publish with an Atmosphere account, and package and release records are signed by the publisher and stored in the publisher's own account.

The default catalog applies content moderation to the names, descriptions, links and images it displays. Moderation can hide material from the catalog, but it cannot rewrite a release, take ownership of a plugin or erase the underlying publication. Cloudflare hosts the default registry services so publishers and site owners do not have to run their own infrastructure.

Built in public

EmDash is MIT-licensed. Cloudflare says more than 175 people have contributed over 1,800 commits, and the project has been translated into 25 languages. Noah Pham, who joined Cloudflare as an intern and became the project's second maintainer, contributed more than 80 changes across the media library, content editor and admin interface.

A commercial ecosystem is forming around it as well. Lexington Themes offers 44 Astro themes with EmDash variants, Urumi is applying its WooCommerce background to build EmDash's first eCommerce plugin, and Empress is launching a multi-brand platform on top of the CMS. "EmDash unlocks powerful control over a website, and Empress builds on it to give you complete control over as many sites as you want," said Empress founder Raj Makker.

Why it matters

The recurring disputes in the WordPress ecosystem over plugin ownership, marketplace control and marketplace takedowns stem partly from centralized registries where identity and distribution belong to one company. EmDash 1.0 treats that as a design flaw and offers a model in which publishers keep their identity and release history no matter what any catalog does. With Cloudflare running its own high-traffic blog on the software, an MIT license removing lock-in concerns and a 1.0 commitment that skeptical developers said they were waiting for, the project now has the stability evidence and governance model to be taken seriously as a WordPress alternative. Its built-in MCP server is also a bet that the next generation of CMS users includes AI agents, not just human editors.