tools.ceo

Static site vs WordPress: speed, security and cost compared

Why plain HTML served from a CDN has come back, and what you give up compared with a database-driven CMS.

Custom code vs WordPressUpdated October 28, 20264 min readBy tools.ceo editorial

Code editor open on a dark screen
Photo: Unsplash

The short answer

A static site is faster, cheaper to host and much harder to attack, because there is no database or login on the public server. It suits brochure sites, service businesses and documentation. WordPress suits sites with frequent publishing by many editors, comments, memberships or complex search across thousands of posts.

  • Static pages are built once and served as files, so there is no server code for attackers to target.
  • Hosting a static site can cost very little and scale to big traffic spikes.
  • Forms, search and editing need separate services or a small backend.
  • WordPress is more convenient for large volumes of daily content.

Static site vs WordPress at a glance

What mattersStatic siteWordPress
Attack surfaceFiles on a CDN; no public loginAdmin login, database, plugins
SpeedVery fast by defaultFast with caching and a light theme
HostingCDN or simple static hostPHP and MySQL hosting
FormsForm relay or serverless functionForm plugin
Best forService and brochure sitesPublishing-heavy sites

What static means

A static site is a folder of finished HTML, CSS, images and a little JavaScript. A build step or a developer creates the files, then a host serves them unchanged to every visitor. Nothing runs on the server when someone loads a page.

Why security improves

Most website compromises go through server-side code: a vulnerable plugin, an exposed admin, an injectable form. A static site removes the database and the public admin entirely. The remaining risk sits in your hosting account, your DNS and any third-party scripts, so protect those with strong passwords and two-factor sign-in. Sources: OWASP Top 10

Static files served from a CDN load quickly across the country and overseas. That gives you a head start on Core Web Vitals without caching plugins or tuning. Sources: Core Web Vitals on web.dev

What you trade away

Dynamic features need a service: a form relay for enquiries, a hosted search for big sites, a headless CMS or Git-based editor for content. For most service businesses that is three small pieces. For a newsroom it is a lot of plumbing.

Our verdict

If your site changes a few times a month and its job is to win enquiries, a static or mostly static custom site is the safest, fastest choice. Keep WordPress for content operations that genuinely need it.

Questions people ask

Can a static site have a contact form?

Yes. Forms post to a small relay or serverless function that emails you and can add spam protection.

Can a static site have a blog?

Yes. Posts are written in a CMS or Markdown and the site rebuilds when you publish.

Is a static site cheaper to run?

Usually. Hosting is minimal and there are no plugin licences or database backups to pay for.

No affiliate links on this page at publication. Product names link to official sites so you can check current pricing. How we work.

Keep reading.

New guides, about once a fortnight.

Websites, security and AI for people who pay for the software. One email when something is worth your time, nothing else.

Free. Unsubscribe from any email.