{"id":151783,"date":"2026-04-02T18:32:27","date_gmt":"2026-04-03T01:32:27","guid":{"rendered":"https:\/\/ma.tt\/?p=151783"},"modified":"2026-04-15T07:32:50","modified_gmt":"2026-04-15T14:32:50","slug":"emdash-feedback","status":"publish","type":"post","link":"https:\/\/ma.tt\/2026\/04\/emdash-feedback\/","title":{"rendered":"EmDash Feedback"},"content":{"rendered":"\n

So, two other Matts at Cloudflare<\/a> announced EmDash \u2014 the spiritual successor to WordPress that solves plugin security<\/a>.<\/p>\n\n\n\n

(Is it nominative determinism<\/a> or a simulation glitch that everyone trying to terraform the web has some variation of “Matthew” in their name? I was in a call set up by Matthew Prince, talking to Matt Taylor and Matt Kane, with my right hand there, Mat\u00edas<\/a>.)<\/p>\n\n\n\n

First, I’m going to tell you why this isn’t spiritually tied to WordPress at all, then why they haven’t solved plugin security, and finally offer some suggestions.<\/p>\n\n\n\n

The Spirit of WordPress<\/h2>\n\n\n\n

WordPress exists to democratize publishing. That means we put it everywhere<\/a>. You can run WordPress on a Raspberry Pi, on your phone, on your desktop, on a random web host in Indonesia charging 99 cents a month, and you can run it scaled up on AWS or across multiple datacenters. <\/p>\n\n\n\n

The same code. When you download WordPress Playground<\/a> you’re running the same code that’s being attacked a thousand times a second at WhiteHouse.gov<\/a>. That’s what we mean when we say democratization<\/em>.<\/p>\n\n\n\n

It’s all built on open source and web standards. You can run it anywhere; there’s no lock-in.<\/p>\n\n\n\n

That’s why we do what we do. It’s really hard. You can come after our users, but please don’t claim to be our spiritual successor without understanding our spirit.<\/p>\n\n\n\n

The Spirit of EmDash<\/h2>\n\n\n\n

I think EmDash was created to sell more Cloudflare services. And that’s okay! It can kinda run on Netlify or Vercel, but good stuff works best on Cloudflare. This is where I’m going to stop and say, I really like Cloudflare! I think they’re one of the top engineering organizations on the planet; they run incredible infrastructure, and their public stock is one of the few I own. And I love that this is open source! That’s more important than anything. I will never belittle a fellow open source CMS; I only hate the proprietary ones.<\/p>\n\n\n\n

If you want to adopt a CMS that will work seamlessly with Cloudflare and make it hard for you to ever switch vendors, EmDash is an incredible choice.<\/p>\n\n\n\n

Claimed Plugin Security<\/h2>\n\n\n\n

In another example of them not understanding the spirit of WordPress, the fact that plugins can change every aspect of your WordPress experience is a feature, not a bug! And their sandboxing breaks down as soon as you look at what most WordPress plugins do. <\/p>\n\n\n\n

I know we get a bad rep because there are 62k plugins with wildly variable engineering quality, and more every day, and when one installed on 0.01% of our user base has a vulnerability, a bunch of websites write breathless articles that get clicks saying “122,000 WordPress Sites Vulnerable!”<\/p>\n\n\n\n

That, by the way, I think we’ll be able to fix in the next 18 months with AI. The plugin security only<\/strong> works on Cloudflare.<\/p>\n\n\n\n

Critical Feedback<\/h2>\n\n\n\n

As I said, we had a call with Cloudflare on March 23rd, where they asked for feedback on this thing they built but didn’t tell us the name, said it would probably launch in their developer week towards the end of April, and some top colleagues and I offered to help. I wish I could say the things I’m saying in this blog post on that call, and if they had just shared the announcement post I could have, but in the spirit of open source here’s what I would have said:<\/p>\n\n\n\n

    \n
  1. If they had said the name I would have asked if they had any other options because I have an amazing colleague named Emdash<\/a> who is doing some of the most exciting stuff with WordPress and AI. (BTW I think our Em will have more impact on the web than this in five years.)<\/li>\n\n\n\n
  2. I actually think the product is very solid, there’s some excellent engineering, migration tools, it’s very fast, and the Astro integration is nice.<\/li>\n\n\n\n
  3. I’d be surprised if this doesn’t get tens of thousands of sites on it.<\/li>\n\n\n\n
  4. The UI is in the uncanny valley<\/a> of being sorta-WordPress sorta-not. I know it wasn’t a weekend vibecode project, but it has some of that smell. Stuff breaks at the edges.<\/li>\n\n\n\n
  5. I think using TinyMCE is a regression, and they should adopt Gutenberg<\/a>, which we licensed and created to be used by other CMSes. (Correction: They use Portable Text<\/a> not TinyMCE, but same UI criticism applies.)<\/li>\n\n\n\n
  6. The Skills are amazing<\/a>, a brilliant strategy, and we need to do the same as soon as possible. I’ve been working on something similar and got some good ideas from their implementation.<\/li>\n\n\n\n
  7. I’m not going to say which parts, but they copied a lot of things we’re planning to kill. Build from first principles. Make it better. Skate to where the puck is going.<\/li>\n<\/ol>\n\n\n\n

    There’s a new CMS every other day. And that’s great! I love building CMSes and I totally get why other people do, too.<\/p>\n\n\n\n

    In Conclusion<\/h2>\n\n\n\n

    Some day, there may be a spiritual successor to WordPress that is even more open. When that happens, I hope we learn from it and grow together. [removed “out of your mouth” sentence, too spicy for Western palates.] I’ve mostly focused on this post on just the software, but WordPress is also so much about the community \u2014 the meetups, the WordCamps, the art, the college programs, the tattoos, the books… The closest thing I’ve seen to a spiritual successor isn’t another CMS, it’s been OpenClaw<\/a>.<\/p>\n\n\n\n

    Thanks to colleague Batuhan \u0130\u00e7\u00f6z<\/a> for helping review this.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

    So, two other Matts at Cloudflare announced EmDash \u2014 the spiritual successor to WordPress that solves plugin security. (Is it nominative determinism or a simulation glitch that everyone trying to terraform the web has some variation of “Matthew” in their name? I was in a call set up by Matthew Prince, talking to Matt Taylor … Continue reading EmDash Feedback<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"fullscreen","default_image_id":54207,"font":"","enabled":true,"token":"eyJpbWciOiJodHRwczpcL1wvbWEudHRcL2ZpbGVzXC8yMDIxXC8wNVwvUGhvdG8tb24tMjAyMC0xMC0yOC1hdC0yLjA1LVBNLTEtMTAyNHg2ODIuanBnIiwidHh0IjoiRW1EYXNoIEZlZWRiYWNrIiwidGVtcGxhdGUiOiJmdWxsc2NyZWVuIiwiZm9udCI6IiIsImJsb2dfaWQiOjEwNDc4NjV9.HVLctx38IbN8a85SQpXZKZ8Eyl0CCY2Uz7F--TlE80wMQ"},"version":2},"_wpas_customize_per_network":false,"jetpack_post_was_ever_published":false},"categories":[2817,34],"tags":[],"class_list":["post-151783","post","type-post","status-publish","format-standard","hentry","category-ai","category-wordpress"],"parsely":{"version":"1.1.0","canonical_url":"http:\/\/ma.tt\/2026\/04\/emdash-feedback\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"EmDash Feedback","url":"http:\/\/ma.tt\/2026\/04\/emdash-feedback\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/ma.tt\/2026\/04\/emdash-feedback\/"},"thumbnailUrl":"","image":{"@type":"ImageObject","url":""},"articleSection":"AI","author":[{"@type":"Person","name":"Matt"}],"creator":["Matt"],"publisher":{"@type":"Organization","name":"Matt Mullenweg","logo":"http:\/\/ma.tt\/files\/2021\/05\/Photo-on-2020-10-28-at-2.05-PM-1.jpg"},"keywords":[],"dateCreated":"2026-04-03T01:32:27Z","datePublished":"2026-04-03T01:32:27Z","dateModified":"2026-04-15T14:32:50Z"},"rendered":"