How to set up an EmDash site on Cloudflare for a business

An EmDash site on Cloudflare costs from $5 a month (USD) for your Cloudflare account, plus your domain. A developer does the code steps, about an afternoon’s work. You do the rest in the admin: the setup wizard, your staff and the plugins. Words, pictures and pages are yours to change in the admin. The look and layout come from a template, and changing them is a code job.

Tested on 2 November 2026 with EmDash 1.4.0 on a local site; the Cloudflare steps follow the linked docs.

Coming from WordPress?

• There is no server to rent. The site runs on Cloudflare: Workers for the site, D1 for the database, R2 for pictures.
• People sign in with a passkey (a fingerprint, face or device PIN), not a password.
• Moving an existing WordPress site? Do this guide first, then follow How to move a WordPress site to EmDash.

What you need before you start

• A Cloudflare account on Workers Paid (costs below), and your domain name.
• A developer for about an afternoon.
• On their computer, Node.js 22 (22.23.4 or newer), 24 (24.15 or newer) or 26.

Who does what, in order

The order matters. A passkey only works on the address where it was made, so you finish setting up on your real domain. Each step gives a rough time.

1. Move your domain to Cloudflare: you, with your developer if your email uses the domain.
2. Create the site: developer.
3. Add the forms plugin and the sandbox line: developer.
4. Name the site, add your domain, deploy: developer.
5. Run the setup wizard on your domain: you, with your developer still there.
6. Turn on email: developer.
7. Add your editors and your developer: you.
8. Install and set up each plugin: you.

Start step 1 a few days early; a domain move is not instant. Steps 2 to 6 fit in one visit from your developer.

Does EmDash need Workers Paid? What it costs

The $5 a month (USD) covers the whole Cloudflare account, however many sites it has. The free plan can’t send email or install plugins from the Registry, so a business site needs Workers Paid. Your domain is extra; Cloudflare Registrar sells domains at the registry’s price, with no markup.

For your developer, from Cloudflare’s pricing pages on 2 November 2026:

• Workers Paid includes 10 million requests and 30 million CPU milliseconds a month, and 5 GB of D1 database storage (Workers pricing).
• R2 (pictures): 10 GB a month free; sending files out is free (R2 pricing).
• Email Sending: 3,000 emails a month, then $0.35 per 1,000 (email pricing).
• Workers Free: 100,000 requests a day, 10 ms of CPU each. Plugins can still go in the code under plugins, running inside the site (choosing a plugin format). We have not tried it.

1. Move your domain to Cloudflare

You, about 15 minutes, then a wait.

Your domain must be active in the same Cloudflare account as the site. If it already is, skip to step 2.

1. In Cloudflare, open Domains, then Onboard a domain (Cloudflare’s steps).
2. Check the records Cloudflare found. If your email uses this domain, do this with your developer. They compare the email records (MX, SPF, DKIM, DMARC) with your old domain company’s. A missing one stops your email.
3. Change the nameservers at the company where you bought the domain, as Cloudflare shows.

2. Create the EmDash site on Cloudflare

Developer, about 15 minutes.

Ask whoever looks after your site’s code to follow the getting started guide, with the answers we used:

npm create emdash@latest bakery-site -- --template cloudflare:marketing --pm npm --install --sandboxed-plugins --yes

Answering by hand, choose Cloudflare Workers and the Marketing template (the list starts on Blog). Answer Yes to “Enable sandboxed plugins?”; the default is No.

The install prints warnings (audit, deprecated packages, “Unsupported engine” on Node.js 24.14). None stopped our site. It ends with “Done! Your EmDash project is ready at bakery-site”. It writes a secret key to .env. Keep a copy somewhere safe; EmDash needs it to read plugin passwords.

To look around first, run npm run dev and open http://localhost:4321/_emdash/admin. What you make there stays on that computer. Locally, emails such as invites are printed in the terminal, not sent.

3. Add plugins, and turn on the sandbox

Developer, about 15 minutes.

Answering Yes to “Enable sandboxed plugins?” adds the Worker Loader binding to wrangler.jsonc. But it leaves sandboxRunner: sandbox() out of astro.config.mjs; we saw this twice with create-emdash 1.4.0. Without that line, there is no Registry.

Ask whoever looks after your site’s code to add the line, and EmDash’s forms plugin with it:

npm install @emdash-cms/plugin-forms

Then change two places in astro.config.mjs:

// astro.config.mjs (the rest of the file stays as it is)
import { d1, r2, sandbox } from "@emdash-cms/cloudflare"; // sandbox added
import { formsPlugin } from "@emdash-cms/plugin-forms"; // new line

// inside integrations: [ ... ]
emdash({
  database: d1({ binding: "DB", session: "auto", coalesce: true }),
  storage: r2({ binding: "MEDIA" }),
  sandboxRunner: sandbox(), // new line
  plugins: [formsPlugin()], // new line
}),

The Plugins page should now show a Registry button (plugin sandbox). If it still says “No plugins configured”, stop npm run dev (Ctrl+C) and start it again. The automatic restart was not always enough for us.

What EmDash already does, and what each plugin adds

EmDash on its own does sitemaps, robots.txt, an SEO panel on each page, redirects and a 404 log (SEO guide). It also writes one small piece of structured data on each page: WebSite, or BlogPosting on a post. EmDash’s official forms plugin can already email each enquiry to several addresses (or send a daily digest instead), send the visitor an automatic reply and post each enquiry to one web address. But its form editor has none of these settings: they are set through its API, and a failed email or post is only noted in the server log.

These plugins add more. All are free and need no account.

• Enquiries that always arrive. Lead Delivery adds the settings in the admin, a log your client can read, retries, an email when something fails, spam and repeat marks, HubSpot, and signed requests for Zapier, Make or n8n. You install it from the Registry.
• How you look on Google. SEO & Schema Markup replaces EmDash’s small piece of structured data with a fuller schema graph (such as a local business), and adds a Google preview, pages to fix and WordPress redirect import. You install it from the Registry.
• Broken links. Site Health & Broken Links checks links in pages, menus and to other sites, and emails you when one breaks. You install it from the Registry.
• Visitor numbers. Analytics & Cookies adds Google Analytics and other tools, behind a cookie banner that loads nothing until the visitor agrees. Your developer adds it in the code.

Later, if you need them: Popups adds a top bar or an offer (developer, in the code). Content Approval lets a second person OK pages first (you, from the Registry).

We make every plugin in this list, and Popups and Content Approval. Moorage makes free, open-source plugins for EmDash.

For your developer. Add the code ones to the same plugins: [...] list; each plugin’s page has its line. Keep each plugin on one route: in our test, a plugin moved from code to the Registry lost its settings. The “Forms” plugin in the Registry is another publisher’s, not EmDash’s. How to find and install EmDash plugins covers both routes.

4. Name the site and deploy it

Developer, about 30 minutes.

In wrangler.jsonc, change the names my-marketing-site (the site and the database) and my-marketing-media (the picture store) to your own. The first deploy creates them, and later deploys reuse them (Configure bindings).

On a new Cloudflare account, turn on R2 first. Cloudflare’s R2 steps say to open Storage & databases, R2, Overview and complete the checkout. It is free to start.

Add your domain before the first deploy. A new site shows its setup wizard to whoever visits first. We saw this locally, and EmDash’s docs warn about it on preview addresses. Add:

"routes": [{ "pattern": "www.yourdomain.com", "custom_domain": true }],

That is the line from Cloudflare’s Custom Domains page. With a route and no workers_dev setting, the deploy turns the workers.dev address off (workers.dev). The wizard then appears only on your domain. Cloudflare refuses the route while the name has a CNAME record, such as www pointing at your old site. Removing that record takes the old site off that name, so do it only when you are ready to switch. Still moving from WordPress? Leave this line out and add the domain in step 5 when the move is done.

Then deploy, as in Deploy to Cloudflare:

npx wrangler login
npm run deploy
npx wrangler secret put EMDASH_ENCRYPTION_KEY

npm run deploy builds, then runs wrangler deploy. The last line stores your key: when it asks, paste the part after EMDASH_ENCRYPTION_KEY= in .env (Worker secrets).

5. Add your domain and run the setup wizard

You, with your developer still there, about 5 minutes.

Do this yourself, with your own email, straight after the deploy. Whoever finishes the wizard becomes the Administrator.

1. Skip this if your developer added the route in step 4. Otherwise the site is on a workers.dev address; don’t run the wizard there. In Cloudflare, open Workers & Pages, your site, Settings, Domains & Routes, Add, Custom Domain (Cloudflare’s steps).
2. Open https://your-domain/_emdash/admin (EmDash’s setup steps).
3. On Set up your site, type your Site Title and a Tagline. Under How do you want to start?, choose Sample content (example pages to edit) or Empty site. Click Continue.
4. On Create your account, type Your Email and Your Name. Click Continue.
5. On Secure your account, click Create passkey and follow your device’s prompt. Then click Open the dashboard.

You should now see “Welcome to EmDash” and “Your Role: Administrator”. Click Get Started to close it.

6. Turn on email

Developer, about 30 minutes.

A live site has no email until you add it, so invites and plugin alerts don’t arrive. Ask whoever looks after your site’s code to follow Email. They verify your domain for sending (Cloudflare’s steps), add two things and deploy again.

// wrangler.jsonc
"send_email": [{ "name": "EMAIL" }],

// astro.config.mjs: add this import beside the others
import { cloudflareEmail } from "@emdash-cms/cloudflare/plugins";

// then extend the plugins line from step 3 (keep any other plugin in it)
plugins: [
  formsPlugin(),
  cloudflareEmail({ from: { email: "site@yourdomain.com", name: "Bakery" } }),
],

Keep one plugins list; with two, only the last counts. The From address must be one Cloudflare accepts. Settings, then Email, sends a test.

7. Add your editors

You, about 5 minutes.

Editors write and publish. They don’t see Users, the Plugins manager or Settings. Some plugins add a page for them, such as Submissions and Site Health. Make your staff Editor and your developer Admin (“Full access”).

1. Click Users, then Invite User.
2. Type their Email address.
3. Open Role. It starts on Author. Choose Editor (“Can manage all content”) or Admin.
4. Click Send Invite.

They get an email, “You’ve been invited to EmDash”, with a link that works for 7 days. It opens “You’ll be joining as EDITOR”. They click Create passkey, then Open the dashboard. Without email, the docs say you can copy the link and send it yourself (Invite users).

8. Install and set up each plugin

You, about 10 to 20 minutes for each plugin.

This is what we saw for Site Health (EmDash’s steps):

1. Click Plugins, then Registry.
2. Search for site-health. Click Site Health & Broken Links (@moorage.dev/site-health).
3. Click Install. A box called Review Verified Plugin lists what the plugin may do.
4. Read the list, then click Accept & Install. Site Health asks to reach any website, because it checks your links to other sites.

You should now see Installed, and Site Health in the sidebar. The others are @moorage.dev/seo, @moorage.dev/lead-delivery and @moorage.dev/approvals.

Then set each one up on its sidebar page, in this order.

1. SEO: answer “Tell Google who this site is for”, for example A local business customers visit (shop, cafe, clinic). Then fix the pages it lists (schema markup guide).
2. Lead delivery (its sidebar name): send your contact form’s enquiries to your inbox (enquiries guide).
3. Site Health: read its list once the site is on your domain (broken links guide).
4. Analytics & Cookies: paste your Google Analytics ID (it starts with G-) and choose who sees the cookie banner (Google Analytics guide).

Later, there are guides for Popups and Content Approval.

After launch

• EmDash updates are your developer’s: npx upgrade-emdash@latest, then build and deploy (Update EmDash). Plugins in the code, such as Analytics, are updated with npm on the same visit.
• Registry plugins are yours: Plugins, Check for updates, then Update on any that has one. Review the box before you confirm (Update a plugin).
• Your content can always leave. EmDash’s docs describe Settings, Transfer, Export site: one file with your content, settings and pictures (Export in the admin).
• Backups are your developer’s: EmDash’s Backups and recovery covers the database and pictures.

What this guide does not cover

Moving from WordPress; see the box at the top.

If something goes wrong

• A Registry install fails with `SANDBOX_NOT_AVAILABLE`. The docs say the LOADER binding is missing from wrangler.jsonc. It needs Workers Paid.
• You can’t sign in after changing the address. Passkeys belong to one address. Follow Move to a New Domain.
• “Email is not configured” when signing in by email. Step 6 isn’t finished.

New guides and plugin releases appear in our RSS feed.