# Cloudflare Birthday Week 2026: EmDash 1.0, Vinext and What Website Owners Gain By [Eoin Villarin](https://amvprosox.com/about). Published 2026-10-29. Canonical: https://amvprosox.com/blog/cloudflare-birthday-week-2026-announcements > Cloudflare Birthday Week 2026 brought 46 launches, including EmDash 1.0, Vinext 1.0, a certificate authority plan and AI Search. Here is what matters for your website. ## What did Cloudflare announce during Birthday Week 2026? Cloudflare Birthday Week 2026 ran from September 28 to October 2 with 46 announcements. Highlights include EmDash 1.0, an open-source CMS with sandboxed plugins, Vinext 1.0 for running Next.js on Vite, plans to become a public certificate authority, AI Search general availability with billing from November 1, and Workers KV Instant in beta. **Key takeaways** - Cloudflare Birthday Week 2026 ran from September 28 to October 2, 2026, with 46 announcements marking the company's 16th birthday. - EmDash 1.0, Cloudflare's free MIT-licensed CMS built on Astro, became a stable release on September 28, 2026, with plugins isolated in sandboxed runtimes. - Vinext 1.0 runs Next.js apps on Vite and deploys to Cloudflare Workers, Netlify and AWS Lambda, with Cloudflare reporting over 99% test compatibility excluding cache components. - Cloudflare plans to become a public certificate authority and expects its first post-quantum Merkle Tree Certificates in the first quarter of 2027. - Cloudflare AI Search became generally available on October 1, 2026, with billing from November 1 and a free monthly allowance of 1,000 semantic queries. Cloudflare Birthday Week 2026 delivered 46 announcements in five days, and several of them change how ordinary business websites are built, hosted and secured. The biggest for site owners: EmDash 1.0, an open-source CMS that Cloudflare pitches as an alternative to WordPress with sandboxed plugins, Vinext 1.0 for running Next.js apps on Vite and on more hosts, plans for Cloudflare to become its own certificate authority, and AI Search reaching general availability. This roundup is for business owners, marketers and developers anywhere in the world whose sites sit behind Cloudflare or run on WordPress or Next.js. Instead of all 46 items, you get the dozen that affect site speed, hosting costs, security and AI features, with a plain-English action list at the end. Every fact links to Cloudflare's own blog, starting with the [official Birthday Week 2026 wrap-up](https://blog.cloudflare.com/birthday-week-2026-wrap-up/). Performance figures are Cloudflare's own measurements, and prices are in US dollars as Cloudflare lists them. ## Cloudflare Birthday Week 2026 at a Glance Cloudflare marked its 16th birthday with announcements from Monday, September 28 to Friday, October 2, 2026, one theme per day. | Day | Theme | Launches that matter for websites | | --- | --- | --- | | Mon, Sep 28 | Open source | EmDash 1.0 CMS, Vinext 1.0, the cf CLI | | Tue, Sep 29 | Securing the agentic internet | Cloudflare certificate authority plan, post-quantum visibility, free Threat Signals | | Wed, Sep 30 | The agent economy | Pay Per Use beta, Monetization Gateway beta, AI Gateway Auto Router | | Thu, Oct 1 | The developer stack | AI Search generally available, Workers KV Instant beta, Basin data platform | | Fri, Oct 2 | A faster, simpler internet | Logpush for all plans, Cloudflare Traces, network speed update | ## What Is EmDash, Cloudflare's WordPress Alternative? EmDash is an open-source content management system built on the Astro web framework. Cloudflare first introduced it on April 1, 2026, calling it the "spiritual successor to WordPress", and the [EmDash 1.0 announcement](https://blog.cloudflare.com/emdash-cms-plugin-registry) on September 28 marks its first stable release. It is free and MIT licensed. ![EmDash CMS editor from Cloudflare Birthday Week 2026 showing a blog post with title, featured image and publish settings](https://amvprosox.com/api/img/1793276907670-1it1en) *The EmDash admin will look familiar to WordPress users. Image: Cloudflare* ### Why EmDash plugins are different Plugins are a frequent source of WordPress security problems, because a WordPress plugin runs with access to the whole site. EmDash takes the opposite approach. Each plugin runs in its own isolated runtime with private storage, and it cannot touch site content, media, users, secrets, files or the network unless it declares that ability and an administrator approves it. On Cloudflare, each plugin runs as its own Worker. On a regular Node.js server, EmDash uses the open-source workerd runtime to isolate plugins. ![Diagram comparing a WordPress installation where a malicious plugin reaches everything with an EmDash installation where plugins are sandboxed](https://amvprosox.com/api/img/1793276908258-n8gldv) *Cloudflare's comparison of WordPress and EmDash plugin access. Image: Cloudflare* ### What else ships with EmDash 1.0 - A plugin registry built on AT Protocol, where publishers sign their releases and EmDash verifies signatures and requested permissions. Free plugins work now, and paid plugins are planned. - An API, a CLI and a built-in MCP server, so AI agents can manage content. - Hosting on Cloudflare Workers or Node.js, with Cloudflare looking for more hosting partners. - A real-world test: Cloudflare says its own blog now runs on EmDash, serving millions of pageviews a week with spikes up to 5,000 requests per second. Cloudflare does not describe a one-click WordPress importer. It points to migration workflows and EmDash Agent Skills instead, so moving a large site is still a project. ## What Is Vinext 1.0? [Vinext 1.0](https://blog.cloudflare.com/vinext-nextjs-on-vite/) lets you run an existing Next.js application on Vite, the popular JavaScript build tool. Cloudflare calls it production-ready and says customers already run high-traffic apps on it. ![Cloudflare blog graphic announcing Vinext 1.0 for Next.js applications powered by Vite](https://amvprosox.com/api/img/1793276908783-q7uc5d) *Vinext 1.0 launched on day one of Birthday Week. Image: Cloudflare* - **Supported:** App Router, Pages Router, React Server Components, Server Actions, middleware, server rendering, static export and page-level ISR. - **Hosts:** Cloudflare Workers, including the free plan, plus Netlify and AWS Lambda. - **Compatibility:** Cloudflare reports more than 99% test compatibility for the features customers asked for most, excluding cache components. The `use cache` directive has only limited support. - **Migration:** run `npx vinext check` to test compatibility, then `npx vinext init` to set it up while keeping your project structure. The business value is portability. A Next.js app that can move between hosts gives you leverage on hosting costs. ## Security: A New Certificate Authority and Post-Quantum Tools On September 29 Cloudflare said it plans to [become a public certificate authority](https://blog.cloudflare.com/cloudflare-certificate-authority/), the kind of organization that issues the TLS certificates behind the padlock in the browser. Cloudflare has applied to the Chrome, Apple, Microsoft and Mozilla root programs and agreed to acquire an established root from GlobalSign. It is not issuing certificates yet, and it expects its first post-quantum Merkle Tree Certificates in the first quarter of 2027. Two details matter for any site. First, Cloudflare will only issue to ACME clients that support ACME Renewal Information, a standard that tells your server when to renew. Second, Cloudflare notes that maximum certificate lifetimes will keep shrinking over the next few years, so manual renewals will not keep up. Other security launches include analytics that show whether visitors connected with [post-quantum encryption](https://blog.cloudflare.com/post-quantum-visibility/), and [Threat Signals](https://blog.cloudflare.com/threat-signals/), which turns open-source threat reports into indicators linked to firewall rules, free for every Cloudflare account. ## AI Features: AI Search, Auto Router and Paid Crawling ### AI Search is generally available [AI Search](https://blog.cloudflare.com/ai-search-ga/) is Cloudflare's managed service for indexing content and answering questions about it. You can use it for smart site search or for a chatbot that answers from your own pages and PDFs. It now handles image search, OCR for scanned PDFs and files up to 10 MiB. Billing starts on November 1, 2026. | AI Search item | Price | Free each month | | --- | --- | --- | | Ingestion | $0.75 per 1M tokens | 5M tokens | | Storage | $2.00 per GB-month | 10 GB | | Semantic queries | $0.75 per 1,000 | 1,000 | | Full-text queries | $0.10 per 1,000 | 1,000 | ### Cheaper AI calls and paid access for publishers The [AI Gateway Auto Router](https://blog.cloudflare.com/auto-router/) picks a suitable model for each request at the edge to reduce AI spend. For publishers, [Pay Per Use](https://blog.cloudflare.com/pay-per-use/) entered beta: AI companies offer a price for a specific use of your content, you accept or decline, and Cloudflare bills them and pays you monthly. It sits next to Pay Per Crawl, which Cloudflare launched in 2025. ## Speed and Platform Upgrades Cloudflare's [network performance update](https://blog.cloudflare.com/network-performance-birthday-week-2026/) says it was the fastest provider in 74% of the 1,000 largest networks in August 2026, up from 60% in April, measured by connection time against CloudFront, Google, Fastly and Akamai. Cloudflare notes the gap between top providers is often only a millisecond or two. ![Cloudflare Birthday Week 2026 network performance update graphic with a stopwatch and browser windows](https://amvprosox.com/api/img/1793276909434-r3pcxs) *Cloudflare published its latest network speed comparison on October 2. Image: Cloudflare* - **Workers KV Instant** (private beta) is a new mode that Cloudflare says cuts p99 read latency to 1.62 ms, against 287 ms in classic mode, with near-instant global replication. - **Enterprise features for everyone:** Logpush is now self-serve on Free, Pro and Business plans, Security Insights scans run every 7 days on Free and every 3 days on Pro and Business, and budget alerts are on by default, according to the [plan update](https://blog.cloudflare.com/enterprise-for-all-update/). - **Cloudflare Basin**, a serverless data platform built on Apache Iceberg and R2, is generally available. ## What Cloudflare Birthday Week 2026 Means for Your Website Whether you run a small business site in Sydney, an online store in Texas or a SaaS app in Berlin, these are the actions I would take. - **WordPress site owners: watch EmDash, do not rush.** For a new blog or brochure site where plugin security worries you, EmDash 1.0 is worth a pilot. For a large WooCommerce store with years of plugins, stay put and harden what you have. My guide to [WordPress plugin security in 2026](https://amvprosox.com/blog/wordpress-security-plugin-vulnerabilities-2026) covers that. - **Next.js app owners: test portability.** Ask your developer to run `npx vinext check`. If your app is compatible, you have a credible option to move hosts and compare costs. My [Next.js and React 2026 update](https://amvprosox.com/blog/nextjs-react-whats-new-2026) covers what else is worth upgrading. - **Automate every certificate.** Find any certificate installed by hand on a server, load balancer or mail system. Move it to ACME automation with renewal information support before shorter lifetimes cause an outage. - **Switch on the free security tools.** Security Insights, Threat Signals and default budget alerts cost nothing on most plans. Review the results once a month. - **Pilot AI search with the free allowance.** A small site can index its pages and PDFs and test smarter search within the free monthly allotment before deciding to pay. - **Decide your AI crawler policy.** Choose whether AI companies may crawl your content for free, must pay, or are blocked. Publishers with original content should look at Pay Per Use. - **Measure speed yourself.** Cloudflare's network gains help, but heavy images, scripts and themes still decide your Core Web Vitals. Start with my [Core Web Vitals guide](https://amvprosox.com/blog/core-web-vitals-perfect-score-2025). ## Frequently asked questions ### When was Cloudflare Birthday Week 2026? Cloudflare Birthday Week 2026 ran from Monday, September 28 to Friday, October 2, 2026, marking the company's 16th birthday. Cloudflare published 46 announcements across five themes: open source, security for the agentic internet, the agent economy, the developer stack, and a faster, simpler internet. Its official wrap-up post followed on October 5. ### Is EmDash a replacement for WordPress? EmDash is an open-source CMS that Cloudflare positions as a successor to WordPress, with sandboxed plugins as its main advantage. Version 1.0 is a stable release, but it is a different system built on Astro, not a WordPress fork. WordPress PHP themes and plugins do not run on it, so moving a site is a migration project. ### Is Vinext a replacement for Next.js? No. Vinext runs your existing Next.js application on the Vite build tool so it can deploy to more platforms, including Cloudflare Workers, Netlify and AWS Lambda. Cloudflare reports more than 99% compatibility on the features customers requested most, excluding cache components. You keep writing Next.js code and project structure stays the same. ### Is Cloudflare issuing SSL certificates now? Not yet. On September 29, 2026, Cloudflare announced plans to become a public certificate authority and applied to the major browser root programs. It expects to issue its first post-quantum Merkle Tree Certificates in the first quarter of 2027, and it will only issue to ACME clients that support ACME Renewal Information. ### How much does Cloudflare AI Search cost? Cloudflare AI Search billing starts on November 1, 2026. Each month includes 5 million ingestion tokens, 10 GB of storage, 1,000 semantic queries and 1,000 full-text queries free. Beyond that, ingestion costs $0.75 per million tokens, semantic queries $0.75 per 1,000 and full-text queries $0.10 per 1,000. ## A Faster, Safer Web Is Being Built Around You Birthday Week 2026 shows where web hosting is heading: sandboxed plugins, portable frameworks, automated certificates and AI features priced for small sites. You do not need to adopt everything, but each change is a chance to make your website faster, safer or cheaper to run. If you want help deciding whether EmDash, Vinext or Cloudflare's AI tools fit your site, or you need a WordPress or Next.js site secured and sped up, [get in touch here](https://amvprosox.com/#contact-form). I work with clients in the US, Europe, Australia and beyond, and you can read my [case studies](https://amvprosox.com/case-studies) first. I will reply within 24 hours.