Cloudflare now owns every layer needed to build a content website, and it is aiming the result squarely at WordPress users.
The US internet infrastructure company released version 1.0 of EmDash, its own content management system (CMS), on 28 September.
A CMS is the software people use to write, store and publish web pages without touching code.
Cloudflare openly markets EmDash as the "spiritual successor to WordPress", the free software behind roughly two in five websites.
WordPress management has cause for concern, but the biggest threats come from its own governance turmoil and from artificial intelligence (AI) changing how sites get built.
Cloudflare is a symptom of that shift rather than its main cause.
Buying the toolkit
In January Cloudflare bought The Astro Technology Company, maker of Astro, a free framework for building fast, content-heavy websites.
Terms were not disclosed, and all of Astro's full-time staff moved to Cloudflare.
Chief executive Fred Schott said the deal would let the team "accelerate Astro's development faster and on a much larger scale".
In June Cloudflare bought VoidZero, the company behind Vite, a widely used toolkit that turns developers' code into working websites.
Cloudflare's own Vite plugin was already drawing 13.9 million weekly downloads, according to SDxCentral.
Both frameworks are popular with developers, but neither had found a way to make serious money on its own.
EmDash, built on Astro, is different: Cloudflare developed it in-house rather than buying it.
It first appeared as a preview on 1 April, a launch date that left many developers suspecting a prank.
A gradual change of tack
The shift has been incremental. Since 2020 Cloudflare has sold Automatic Platform Optimization, a $5-a-month add-on that speeds up WordPress sites.
EmDash is its first attempt to replace WordPress rather than profit from it.
Cloudflare's network already sits in front of roughly a fifth of all websites, but until now it did not control the tools used to write them.
The prize is recurring revenue, because EmDash works best on Cloudflare's metered services for computing, databases and media storage.
Cloudflare said it had more than 7.4 million developers on its platform at the end of June, having added nearly 2 million in three months.
Chief executive Matthew Prince told analysts he "made the team triple-check the developer numbers".
Prince and co-founder Michelle Zatlyn also say automated traffic, from bots and AI agents, overtook human visitors in May.
EmDash is built for that world, shipping with tools that let AI agents operate a site directly.
Its other selling point is security. Cloudflare cites figures from Patchstack, a security firm, showing that 96% of WordPress security problems start in plugins, the add-ons that extend a site's features.
EmDash runs each plugin in a sealed-off sandbox so a faulty one cannot compromise the whole site.
Locked-in syndrome
Critics say the openness only goes so far. EmDash is free and can run on ordinary servers, but its headline features depend on Cloudflare's infrastructure.
Matt Mullenweg, the co-founder of WordPress, praised parts of the engineering but was blunt about the motive.
"I think EmDash was created to sell more Cloudflare services," he wrote in an April blog post.
Prince called it a "fair critique" on X, adding that he hoped EmDash would bring more developers into the WordPress ecosystem.
Roger Montti of Search Engine Journal argued after the 1.0 release that its new features tie users closely to Cloudflare.
The model mirrors Vercel, which steers the popular Next.js framework and makes its money hosting the sites built with it.
Joost de Valk, founder of the WordPress plugin maker Yoast, noted that EmDash's plugin ecosystem is still empty.
WordPress's own goals
WordPress's market share is falling steadily for the first time. W3Techs, which surveys the technology behind websites, put it at 40.2% of all sites on 21 September, down from a 2025 peak of 43.6%.
Most of that lost share has gone to hosted site builders such as Shopify and Wix, not to developer tools like EmDash.
The more serious damage is self-inflicted. On 9 September the board of Automattic, the company behind WordPress.com, put Mullenweg on paid leave and named its finance chief as interim chief executive.
Two days later Mullenweg told staff he was back in control, and Automattic confirmed his return as chief executive.
A new board was announced on 25 September.
A day earlier a US judge allowed WP Engine, a WordPress hosting company, to pursue monopolisation claims against Automattic.
Automattic had already cut its contributions to WordPress's core code in 2025.
Erosion, not collapse
WordPress still runs 58.8% of sites with an identifiable CMS, far ahead of Shopify on 5.4% and Wix on 4.2%.
A shrinking share of a growing web also does not prove the number of WordPress sites is falling.
EmDash is days past 1.0, its plugin registry is new, and its core customers are developers and hosting firms rather than small businesses.
Even so, a well-funded infrastructure company now offers a credible alternative built for AI and security, just as WordPress's leadership is in disarray.
The likelier outcome is slow erosion at the new-build end of the market rather than sudden collapse.
The things to watch are whether hosting companies adopt EmDash, how the WP Engine case progresses and whether Automattic's leadership settles.
