How to find and install EmDash plugins

EmDash plugins add jobs your site does not do on its own, such as forms, SEO or broken link checks. We installed, updated and removed plugins this way on EmDash 1.4.0 on 2 November 2026. We make some of the plugins used as examples here.

No Registry in your admin? It needs a sandbox runner. Here is the fix.

Coming from WordPress?

This replaces Plugins > Add New Plugin and the wordpress.org directory. In EmDash the page is called Registry.

• A Registry plugin runs in a sandbox: a fenced-off space where it can only do what it asked permission for. You see that list before you install.
• Other plugins are added to the site’s code by a developer. They appear in the admin after the next deploy.
• The Registry only shows if your site has a sandbox runner. On Cloudflare that needs the Workers Paid plan and two changes to the site’s code. Without it, plugins come from npm instead.

Where EmDash plugins come from

The EmDash registry. This is EmDash’s plugin directory. Browse it at plugins.emdashcms.com, and install from the Registry page in your admin. Each plugin has a public name, such as @moorage.dev/seo.

npm. npm is the public library of code packages. A developer adds one to the site’s code. The name can differ: our SEO plugin is @moorage/plugin-seo on npm.

EmDash’s official plugins are on npm, with names starting @emdash-cms/. They include the forms plugin, Audit Log, Webhook Notifier, Embeds, Field Kit and Color. We searched the Registry for “forms” and the official one was not there.

EmDash’s page on installing plugins covers both ways.

Is there an EmDash plugin marketplace?

Not any more. The Registry replaced EmDash’s Marketplace. On EmDash 1.4.0 the old Marketplace address in the admin says “Marketplace browsing is no longer available.” Plugins installed from the Marketplace keep running. EmDash’s guide to migrating from the Marketplace explains how to move them.

Why is there no Registry in my EmDash admin?

Your site has no sandbox runner: the part of EmDash that starts each Registry plugin in its own fenced-off space. On Cloudflare it uses the Worker Loader, which needs the Workers Paid plan. Ask whoever looks after your site’s code to make two changes.

When you made the site, create-emdash asked “Enable sandboxed plugins?”. What to do depends on the answer.

• You answered Yes. Yes adds only the wrangler.jsonc line. Add the astro.config.mjs lines below.
• You answered No (the default). The wrangler.jsonc line is there, but commented out. Remove the // at its start, then add the astro.config.mjs lines.

// wrangler.jsonc: already live if you answered Yes; otherwise remove the //
"worker_loaders": [{ "binding": "LOADER" }],

// astro.config.mjs: add sandbox to the import you already have
import { d1, r2, sandbox } from "@emdash-cms/cloudflare";

// ...and add sandboxRunner inside your existing emdash({ ... })
emdash({
  database: d1({ binding: "DB", session: "auto", coalesce: true }),
  storage: r2({ binding: "MEDIA" }),
  sandboxRunner: sandbox(),
}),

Keep your own database and storage lines.

Then redeploy the site, or restart npm run dev locally. Reloading the page is not enough; Registry appeared only after a full restart.

What you see when something is missing:

• Either change missing. There is no Registry in the sidebar, and its address says “Plugin registry is not configured.” We saw this both ways. With sandboxRunner but no LOADER, the terminal also says “Sandboxed plugins are disabled because wrangler.jsonc has no LOADER Worker Loader binding.”
• Install shows “Sandbox runner is required for registry plugins: the worker entrypoint does not export PluginBridge”. The Registry shows, but Install opens no dialog. Behind the message is the error code SANDBOX_NOT_AVAILABLE. We saw it when src/worker.ts lacked export { PluginBridge };. EmDash’s Cloudflare templates already have that line. EmDash’s docs say a live Worker without the LOADER binding fails with the same error code. Fix it and redeploy.

How to set up an EmDash site on Cloudflare for a business shows where the lines go. EmDash’s plugin sandbox page covers Cloudflare and Node.

On the Workers free plan, install plugins from npm instead. Local npm run dev shows the Registry on any plan; the live site needs Workers Paid.

In-process or sandboxed: what is the difference?

A plugin runs in one of two ways.

• In-process. The plugin runs inside your site, listed under plugins: [...] in the code. This works on any EmDash site. The plugin can reach everything the site can, so its permission list is a promise, not a fence.
• Sandboxed. The plugin runs in a separate space and can only use the permissions it declared. Registry plugins always run this way, and so do npm plugins listed under sandboxed: [...]. Either way, the site needs the sandbox runner above.

What to check before you install any plugin

Open the plugin’s page in Registry, or its README on npm. Look for five things.

1. Permissions, under “Declared permissions”. Does the plugin need each one for its job? “Change where visitors are sent” makes sense for an SEO plugin, not for a colour picker. EmDash explains them under Review permissions.
2. EmDash version. The README says which version it needs. The Registry refuses a release your site is too old for.
3. Licence, under the description, for example MIT.
4. Last release. Look at Updated. A plugin nobody has touched in months may fall behind EmDash.
5. Source. View source opens the code.

What the Registry does not do

A listing is approved before it appears, but you will find no reviews or ratings there. “Signed release verified” tells you who published the package, not whether the plugin is good. EmDash’s own advice is to install code only from publishers you trust.

Install a plugin from the Registry

You need an Admin account and a site with a sandbox runner.

1. Open Registry in the admin sidebar, under Admin.
2. Type what you need, or a plugin’s public name, in the search box. For example, search for “seo”. Several SEO plugins are listed, and ours is one of them (we make it). Search for its public name, @moorage.dev/seo, and only that plugin shows.
3. Open the plugin and read its page, as in the checklist above.
4. Press Install. A dialog, “Review Verified Plugin”, opens. It says “Signed release verified” and lists every permission in plain words.
5. Press Accept & Install.

The button now says Installed. The plugin’s own page appears in the sidebar. For SEO & Schema Markup that is Marketing > SEO, which asks “Tell Google who this site is for”. Our broken link checker, @moorage.dev/site-health, needs no settings: Tools > Site Health says “Checking your site for the first time”.

Install a plugin from npm

Already installed it from the Registry? Uninstall that copy first. The two copies run side by side, and settings do not carry over in either direction.

Ask whoever looks after your site’s code to install the package and add it to astro.config.mjs. Each plugin’s README gives the exact line. This adds EmDash’s forms plugin and our SEO plugin, in-process:

npm install @emdash-cms/plugin-forms @moorage/plugin-seo

// astro.config.mjs: add the two imports
import { formsPlugin } from "@emdash-cms/plugin-forms";
import seo from "@moorage/plugin-seo";

// ...and this line inside your existing emdash({ ... })
plugins: [formsPlugin(), seo],

To run it sandboxed instead, list it as sandboxed: [seo], next to the sandboxRunner line.

After the deploy (or a restart of npm run dev locally), open Plugins under Admin. You should see each plugin by its ID and version, such as “seo v0.1.11”.

Plugins we make

We make these, so read this part with that in mind. They are free, MIT-licensed and need no account. All six are on npm; the first four are on the Registry too. Our plugins page has the details.

• SEO & Schema Markup: schema markup, pages to fix, WordPress redirects import. Registry: @moorage.dev/seo.
• Site Health & Broken Links: finds broken links and emails you. Registry: @moorage.dev/site-health.
• Lead Delivery: sends form enquiries to email, HubSpot or Zapier. Needs EmDash’s forms plugin. Registry: @moorage.dev/lead-delivery.
• Content Approval: pages wait for an OK before they go live. Registry: @moorage.dev/approvals.
• Analytics & Cookies: Google Analytics and more, behind a cookie banner. npm only, in-process: @moorage/plugin-analytics.
• Popups: top bars, slide-ins and popups. npm only, in-process: @moorage/plugin-popups.

Update a plugin

From the Registry.

1. Open Plugins under Admin.
2. Press Check for updates.
3. Press Update to v… on the plugin.

You should see “Plugin updated”. If a new release asks for more permissions, EmDash asks you again first.

To go back to an older release, uninstall the plugin and leave “Also delete plugin storage data” unticked. On its Registry page, pick the older version in the dropdown next to Install, then install it. Your settings come back.

From npm. Ask your developer to update the package and deploy (or restart npm run dev locally):

npm install @moorage/plugin-seo@latest

The new version number shows on the Plugins page.

To see what changed, each of our plugin pages shows its latest release and links to the full changelog. New releases and guides also appear in our RSS feed.

Turn off or remove a plugin

Turn it off for a while. On Plugins, use the switch on the plugin’s row. Its pages leave the sidebar until you switch it back on.

Remove a Registry plugin.

1. On Plugins, open the plugin’s row with Expand details.
2. Press Uninstall.
3. Tick “Also delete plugin storage data” only if you will never want its data back.
4. Press Uninstall.

Remove an npm plugin. These have no Uninstall button. Your developer deletes the line from astro.config.mjs, removes the package and deploys. The settings stay in the database: when we added SEO back, they were still there.

If something goes wrong

There is no Registry, or Install says “Sandbox runner is required” (`SANDBOX_NOT_AVAILABLE`). See Why is there no Registry in my EmDash admin? above.

A plugin shows twice, or its settings vanished, after switching between npm and the Registry. Each install is a separate copy with its own storage. We saw two SEO entries in the sidebar, and the new copy asked “Tell Google who this site is for” again. Remove one copy, and pick one way for each plugin.

A plugin page says “Plugin route not found.” The plugin is turned off, or the code changed and the site has not restarted yet. Turn it on, or restart and redeploy.

A Registry plugin cannot send email on Cloudflare. On EmDash 1.3 it fails with “Email is not configured”. Update to EmDash 1.4.0 or later.

Setting up a new site? Start with How to set up an EmDash site on Cloudflare for a business. Moving from WordPress? See How to move a WordPress site to EmDash.