Static websites: fast pages, simple editing, and fewer security worries

Most small business websites are fine until something on the server needs urgent attention. A plugin is abandoned. A password is guessed. A login page is left open to the world. Or, as happened in October 2026, the problem is in PHP itself, the software underneath WordPress and many other sites. Updating the website did not fix it. The server had to be patched.

That is the everyday pattern, not a one-off scare. A site that runs code on every visit has a list of things that must stay current: the CMS, the plugins, the theme, PHP, and the server. Miss one of them and you are waiting on the next announcement.

A static website sidesteps that list. Visitors receive ordinary files: pages, pictures and CSS. There is no PHP application answering requests, and no CMS login sitting on the live site. When PHP, or the next widely used component, has a bad week, a static site is simply not in that queue.

What we mean by a static website

The site is built in advance and published as files. It is a strong fit for a brochure site, a portfolio, a charity, or a content site that does not need a shop, memberships or a booking system on the server.

It is not a fit for every project. Online shops stay on Shopify or WooCommerce. Memberships, accounts and some bookings still belong on WordPress or a custom system. We say which is right before anyone builds the wrong thing.

You can still edit it

The usual worry is that a static site means emailing a developer for every full stop. It does not have to.

• Hugo or Astro, the two we use for this kind of build. You can edit in the browser through Tina or CloudCannon, which sit on top of the site's files. Or you send the change to us and we publish it.
• Publii, when one person looks after the content and wants a proper editing app. You work on your own computer, see the result, and publish when you are ready. A half-finished page never sits on the live server.

We pick the editing route around who will actually use it. A busy owner who sends two changes a month does not need a dashboard. Someone publishing every week does.

Speed, without the sales pitch

Because the pages are already built, they load quickly. That is kinder to visitors on a phone, and it helps search: a slow site is one more reason to leave. Speed is not a promise of rankings. It is one less disadvantage, and clients notice it.

Fewer things to worry about

On a typical WordPress site the risks stack up. Plugins and themes need updates. Some are abandoned. The login page is public. And underneath all of that is PHP, which in October 2026 needed a critical security update of its own. Sites on older PHP, or on hosts that were slow to act, were exposed even when WordPress itself was up to date.

Where a site does need PHP, including the WordPress sites we look after, we use managed servers that actively monitor threats. With this PHP issue, protection was already in place before the patch was available.

A static site removes that layer from the public website. There is no plugin to abandon and no CMS password to steal from the live server. Domain, email and any form or booking tool still need ordinary care. The surface left to watch is much smaller, which is the point for an owner who does not want to become a security person.

Examples

• Ed & Co Designs - Astro, with Etsy products listed on the site and bought on Etsy
• Green Garden Spaces - Hugo, edited in TinaCMS
• Britannia at the Beach - Hugo, edited in CloudCannon, with Ecwid for the few items they sell
• Kingsbridge Family Church - Hugo, edited in TinaCMS, with events from ChurchSuite

If you are deciding

If the site is there to explain the business, show the work and be easy to keep safe, a static build is often the calm choice. If you sell online or need accounts and memberships, we will say so and use the platform that fits.

The practical version of this sits on our website design page. If you want a straight recommendation for the site you have now, tell us what it needs to do.