Cloudflare built a better CMS. Small businesses still don't need one

A better version of the same bill

Picture the owner of a small landscaping company. It is March, the phones are about to get busy, and the spring prices on the website are still last year's. The web person says they will get to it next week. Meanwhile a renewal email arrives for a security add-on the owner never chose and doesn't understand.

For many owners, that is what running a website has meant for twenty years. You pay for software with an admin screen, the back end you log into to make changes. The industry calls it a CMS, short for content management system. WordPress is the name most people have heard. Then you pay someone to keep it working.

In September, the internet company Cloudflare released version 1.0 of EmDash, a free website system it pitches as a fresh start for WordPress users ^[1]. Respected voices in the website world have praised the EmDash CMS ^[2], and some of that praise is earned.

My view, up front: EmDash is a better CMS. But a better CMS is still a CMS. It still comes with an admin screen, add-ons, upgrades, hosting and upkeep, and that upkeep costs either money or your own time. For most small businesses, the smarter move in 2026 is to stop paying for that layer, not to swap it for a newer one.

What Cloudflare got right

Credit where it is due. EmDash goes after the single worst thing about WordPress: add-ons, which WordPress calls plugins. Cloudflare's launch post says 96% of security problems on WordPress sites start in plugins ^[3].

The numbers behind that are ugly. Patchstack, a company that tracks WordPress security holes, counted 11,334 new ones in 2025, up 42% from the year before ^[4]. Of those, 91% were in plugins and 9% in themes, the add-ons that control a site's look. The core WordPress software itself had only six, all low priority ^[4]. Almost half, 46%, had no fix from the developer by the time the hole was made public ^[4]. And about half of the high-impact ones were being used by attackers within 24 hours ^[4].

Here is why that matters to your business. On WordPress, an add-on runs inside the website itself, with the same reach into its stored data and files as the rest of the site ^[1]. So a simple contact form add-on could, in principle, read whatever customer details your site keeps.

EmDash changes the rules. A plugin installed through its safe system runs in its own sealed box, and it can only do what it asked for and what the site's administrator approved ^[1]. Plugins built straight into the site the old way still get full access, so the protection depends on how things are set up ^[5]. That is a real fix for a real problem. Joost de Valk, who founded Yoast, one of the most popular WordPress plugins, says the way EmDash locks down plugins is the real story of the launch ^[2]. He is right.

Look at Cloudflare's own example

Now read the EmDash 1.0 announcement closely. To show what the system can do, Cloudflare uses a bakery. A bakery owner, it says, "could update opening hours by asking for the change in plain language" ^[1]. An AI agent then reads, updates and saves the content ^[1].

The launch post goes further. It says EmDash is designed to be run by AI agents, working through code rather than through the admin screen ^[3].

Stop and think about what that means. The best feature of the newest CMS is that you don't have to use the CMS. You ask for a change, an AI makes it, and you check the result.

Joost de Valk put it more bluntly in an essay earlier this year: "People never wanted a CMS. They want a website." ^[6] His point is that the admin screen only existed because most people can't edit a website's code, and AI is removing that limit ^[6]. I agree. Once a plain-English request does the job, the admin screen is no longer the product. It is the thing you are still paying to keep alive.

A better CMS is still a CMS

Here is what a small business takes on if it moves to EmDash, even with the AI features switched on.

A system to run

EmDash keeps your pages and posts in a database, a kind of digital filing system ^[5]. Like any filing system holding your business content, it should be backed up and looked after. Cloudflare says many early users waited for 1.0 because they wanted to be sure it was stable and secure, and that upgrades would not damage their content ^[1]. Those are fair worries, and they are your worries too. My experience with every CMS is that upgrades land on someone's desk, either yours or your web person's.

A hosting choice that is not the cheap kind

On Cloudflare, the sealed plugin boxes need the paid plan ^[5], which has a minimum charge of $5 US a month per account ^[7]. That is small, but it is a bill paid to Cloudflare on top of whatever your web person charges. Away from Cloudflare, EmDash needs a private server or similar setup that runs all the time, not the cheap shared hosting plans many small business sites use ^[5]. Matt Mullenweg, the co-founder of WordPress, argues EmDash was built to sell more Cloudflare services, and that the good parts work best on Cloudflare ^[8]. He is hardly a neutral judge, but the point about being tied to one provider is worth weighing.

Add-ons that don't exist yet

WordPress has more than 60,000 plugins ^[5]. On the day after 1.0 shipped, one reviewer counted about a dozen packages in EmDash's plugin store ^[5]. De Valk, a fan, still warns that a system built in a couple of months with AI help has not yet been tested hard on real, busy sites ^[2]. If your business depends on a booking tool or a payment form, check whether a version exists for EmDash before anyone talks about moving.

Someone to look after it

None of this removes the care plan. A Canadian WordPress shop, Ambrite, says most Canadian small businesses spend $50 to $200 a month on WordPress upkeep ^[9]. EmDash may lower the risk of a hack, but it does not remove the need for a person who understands the system.

What you are really paying for

Let's put real prices on it. Ambrite publishes its plans in Canadian dollars, per site, which makes the arithmetic easy ^[10].

• Care plan: $49 a month, with 30 minutes of edits and small fixes each month ^[10]. That is $49 times 12, or $588 a year, for six hours of changes.
• Complete plan: $199 a month, with one hour of edits each month ^[10]. That is $2,388 a year for twelve hours of changes.
• Extra work: $50 an hour ^[10].

Now divide the full yearly fee by the editing time. On the Care plan, $588 for six hours works out to about $98 for every hour of changes you can see. On the Complete plan it is about $199 an hour. The plans also cover updates, backups and watching for trouble ^[10]. Those are fair services for a WordPress site, but most of the bill keeps the system alive rather than improving your website.

Then there is the bad day. If a site does get hacked, Ambrite's general cost guide puts emergency cleanup at $500 to $2,000 ^[9]. If you do the upkeep yourself, it estimates 10 to 15 hours a month ^[9]. For a salon owner or a plumber, that is one or two working days a month spent on a website instead of on customers.

EmDash could shrink the hack risk. It does nothing about the main problem, which is that a dental clinic or a café is paying every month for a system it never wanted, so that it can make a handful of changes a year.

The fair case for a CMS

To be fair, some businesses really do need one. De Valk lists the cases: teams of writers who need roles and sign-offs, content that changes for each visitor, online stores, membership sites and course platforms ^[6]. A regional chain with a marketing team and a catalogue of products may be well served by EmDash, and agencies that build many sites will like its safety.

Dries Buytaert, the founder of Drupal, another of the big website systems, makes the same split. He argues AI makes the CMS more important for big organisations ^[11]. But he also writes that "when one person creates and publishes content, and no other systems depend on it, you may not need a CMS" ^[11].

That second sentence describes a lot of the small business sites I see: one owner, maybe one helper, and a few pages about services, hours, prices and contact details that nothing else depends on. For that kind of site, my view is that a newer CMS solves a problem you no longer need to have. At Bildz, that is how we run client sites: the owner describes the change, looks at a preview and approves it, with no admin screen to secure or upgrade.

What to do this month

You don't need to understand any of the technology to make a smart call. You need to look at your own bills and ask a few direct questions.

• Add up the year. Take your monthly hosting and care fees, times 12, plus any add-on renewals. Then count how many changes you actually asked for last year.
• Divide one by the other. If you are paying hundreds of dollars per change, you are paying for the system, not the work.
• Ask your web person how long a small change takes. A good answer is "same day, and you see it before it goes live." A worrying answer is "put it in a ticket and I'll get to it next week."
• Ask what happens if they disappear. Can you get your pages, photos and domain back without them? Get that in writing.
• Be wary of a "move to EmDash" pitch. If someone offers to switch you, ask what it costs to move, who runs it after, and what it saves you each year compared with having no admin screen at all.

Cloudflare deserves credit for building a safer CMS. Just don't let a better version of the old setup talk you into keeping the old bill.

Frequently asked questions

Sources

1. Cloudflare Blog, EmDash 1.0: the stable CMS with a secure plugin registry (September 28, 2026)
2. Joost de Valk, EmDash: a CMS built for 2026 (April 1, 2026)
3. Cloudflare Blog, Introducing EmDash — the spiritual successor to WordPress that solves plugin security (April 1, 2026)
4. Patchstack, State of WordPress Security in 2026 (February 2026)
5. webhosting.today, EmDash 1.0 Is Stable. Its Sandboxed Plugins Cannot Touch the Database, and That Is the Whole Pitch (September 29, 2026)
6. Joost de Valk, Do you need a CMS? (March 21, 2026)
7. Cloudflare Docs, Workers pricing
8. Search Engine Journal, Mullenweg To Cloudflare: Keep WordPress Out Of Your Mouth (April 3, 2026)
9. Ambrite, How Much Does WordPress Maintenance Really Cost (May 26, 2026)
10. Ambrite, WordPress Maintenance & Security Plans Canada
11. Dries Buytaert, AI and the great CMS unbundling (June 16, 2026)

Opinions and predictions in this article are the author's. Facts and figures are linked to their sources, checked when the article was published.

More from the series