EmDash vs WordPress

Runtime model

WordPress is PHP. It runs on a long-lived process, typically on shared hosting or a managed WordPress host, and its strengths come from that model: predictable behaviour, cheap hosting, a huge talent pool, and decades of ecosystem lock-in. Performance depends heavily on caching and plugin discipline, but a well-tuned WordPress site is fast.

EmDash runs on modern sandboxed workers — Cloudflare Workers-class runtimes, designed for edge execution with strict per-request CPU budgets. Cold starts are negligible; heavy work is pushed to queues. The tradeoff is that EmDash plugins must be written for this model — no background processes, no direct filesystem access, no long-running work inline.

Plugin model

This is the sharpest divergence. WordPress plugins are PHP code hooking into WordPress internals through actions and filters. They run with site-level privileges by default — a plugin can read the full database, make arbitrary outbound requests, and modify any piece of content. Trust is community-based and the plugin author’s responsibility.

EmDash plugins declare every capability they use in a manifest.json — network fetch, content reads, email sending, and eight other discrete capabilities. The runtime denies any operation whose capability was not declared, enforced at the call site, not just at install time. A plugin that tries to dynamically invoke a blocked API is refused the same way a static one is. There is no default-allow escape hatch.

See the capabilities reference for the full list.

Marketplace and audit

The WordPress.org plugin directory is the world’s largest open-source plugin marketplace — 60,000+ plugins, with an initial review process and community moderation. Ongoing audit is not enforced pre-publish; plugin updates deploy to users once accepted by the author.

emdashcms.org runs a fail-closed audit pipeline on every uploaded version: the bundle is unpacked in an isolated sandbox, scanned against a public ruleset (no eval, no Node internals, no obvious evasion), and reviewed by an AI against the manifest in context. If the audit cannot produce a clean verdict, the version is rejected — not auto-passed, not deferred. Both the marketplace code and every verdict log are public on GitHub.

Ecosystem maturity

WordPress wins this category plainly. The plugin ecosystem is orders of magnitude larger, the theme market is commercial and competitive, and hiring WordPress developers is trivial in most markets. Ten years of StackOverflow answers mean nearly every question has been asked.

EmDash is a newer platform. The plugin count is in the dozens, the theme count is smaller, and the contributor base is small enough that naming conventions and patterns are still crystallising. If your project depends on an obscure plugin existing today, WordPress is a safer bet. If you are willing to build what you need or wait for the ecosystem to fill in, EmDash offers much stronger default isolation.

When to pick EmDash

• Plugin isolation and audit matter to your stakeholders (regulated industries, handling sensitive data, multi-tenant installs).
• You prefer modern, edge-executed runtimes and serverless deployment models.
• You want every plugin release inspected before it ships, with a public verdict log.
• You are comfortable building the parts of the ecosystem that are not there yet — or you are an early adopter by disposition.

When to pick WordPress

• You need a specific plugin that exists in the WordPress ecosystem and nowhere else.
• You need to hire quickly from a large pool.
• Ecosystem maturity, documentation depth, and community size matter more than runtime isolation.
• Your team already runs WordPress well and switching platforms is not justified by the gains.

Honest verdict

For plugin-heavy sites where which plugins exist is the deciding factor, WordPress is still the right answer. For projects that value sandboxing, capability-gated extension, and auditable releases — and are willing to trade ecosystem breadth for that — EmDash has a meaningfully stronger default posture. Neither is magic; the choice depends on which tradeoff you value.