Static sites: the most boring way to never get hacked

A decent chunk of our work is cleaning up hacked WordPress sites. We've written a calm checklist for that morning, but the better conversation happens earlier: a lot of those sites never needed to be hackable in the first place.

What "static" means, in plain English

Most websites are assembled on demand. When someone visits, a server runs code, asks a database for the content, and builds the page on the spot. That machinery (the code, the database, the admin login that manages it all) runs 24/7, and every piece of it is something that can be attacked, can break, or can fall out of date.

A static site skips all of that. The pages are built once, in advance, and visitors are handed ready-made files. No database. No admin login screen. No plugins quietly going out of date.

If your website is essentially "who we are, what we do, how to reach us", and for most small businesses it is, then none of the machinery was earning its keep anyway.

What you get for giving it up

Nothing to break into. No login page to brute-force, no plugin vulnerabilities to patch on a deadline, no database to inject. The attack surface isn't smaller; it's mostly gone.

Speed without trying. Ready-made files served from a network near the visitor. Static sites tend to pass Google's performance checks without the caching plugins and optimisation rounds dynamic sites need.

Pennies to run. No server doing constant work means hosting costs collapse, often to nearly nothing. We pass that on: looking after a static site costs a fraction of a dynamic one because, honestly, there's less to look after.

Nothing to babysit. A WordPress site you ignore for a year is a liability. A static site you ignore for a year is just... still there, still fast, still fine.

"But I need to edit my site"

The classic objection, and worth being honest about. Ask yourself how often you actually changed your last site. For many business owners the truthful answer is twice a year. And for that, a quick message to whoever looks after it beats remembering a CMS login and wrestling a page editor.

If you genuinely update weekly (news, a blog, a menu that changes), you want editing built in, and that's a real reason for a CMS. Same if you're selling online or running member accounts: those need the machinery, and the job becomes choosing it carefully and maintaining it properly.

And the middle ground is wider than people think: a static site can still have contact forms, booking buttons, maps, galleries and analytics. Static describes the engine, not the features.

How we use this

It's why the Starter tier in our website pricing is built static. It isn't the budget option because it's worse; it's cheaper because there's less to go wrong, and we'd rather charge you for things that earn their keep. This site you're reading is built exactly that way, for exactly these reasons.

Boring is underrated. In infrastructure, boring is the goal.