There's a default assumption that building a website means installing WordPress (or similar): a content management system with a database behind it. For a lot of sites, that's exactly right. For a lot of others, it's using a truck to deliver an envelope. Understanding the difference between a static and a dynamic site is the key to not over-building, and it's worth knowing before you (or whoever builds your site) reaches for the default.
The actual difference
A static website
The pages are pre-built files (HTML, CSS, images) that sit on a server and are sent to visitors exactly as they are. When someone visits, the server just hands over the file. Nothing is assembled on the fly, there's no database, and no code runs to build the page. Every visitor gets the same pre-made page, instantly.
A dynamic website
Pages are built on demand when someone visits. The server runs code, usually queries a database, assembles the page from pieces, and then sends the result. A content management system like WordPress works this way: your content lives in a database, and each page view triggers code that pulls it together. This is what makes things like user logins, live content, search, and "anyone can edit via a dashboard" possible.
The distinction in one line: a static site serves pages that already exist; a dynamic site builds pages when they're asked for. Everything else (the speed difference, the security difference, the cost difference) flows from that one fact.
Why it matters: the three real consequences
Speed
A static page is about as fast as the web gets: the server does no work beyond handing over a file. A dynamic page has to run code and hit a database on every visit, which is slower and gets slower under load. Caching helps dynamic sites a lot, but "serve a file that already exists" will always beat "build the page again."
Security
This is the big one, and it's where the mismatch really bites. A static site has almost no attack surface: there's no database to breach, no login to brute-force, no plugins with vulnerabilities, no code executing on input. A dynamic CMS is the opposite: the database, the admin login, and especially the ecosystem of third-party plugins are all things that have to be kept patched and are routinely targeted. A large share of hacked small-business sites are out-of-date CMS installations with a vulnerable plugin. A static brochure site simply doesn't have that class of problem.
The scale of the targeting is hard to overstate until you've watched it. Popular CMS platforms, and the PHP they typically run on, are among the most attacked software on the internet, precisely because they're everywhere. Spend any time reading the access logs of a web server and you'll see it: a near-constant stream of automated probes hammering away at well-known CMS admin paths, login endpoints, and PHP weaknesses, from bots that never stop scanning the entire internet looking for a version that hasn't been patched yet. After decades of running PHP and CMS platforms, I can tell you that noise has always been there, and it only grows. Run one of these platforms and you're in the crosshairs of all of it, forever, relying on staying perfectly up to date to stay safe. Run a static site and that entire category of attack has nothing to hit: there's no admin path, no login, no PHP, nothing those bots are looking for.
The uncomfortable question that follows is simple: if your site doesn't actually need any of that machinery, why carry the permanent risk of running it?
Cost and maintenance
Static sites are cheap to host (they're just files, servable almost anywhere) and have little to maintain: there's no CMS core, no plugins, and no database to keep updated and secure. A dynamic site needs ongoing patching and carries more that can break. For a site that changes rarely, that's ongoing cost and risk for capability you're not using.
The upgrade treadmill nobody warns you about
There's a maintenance problem that's worse than the routine patching, and it catches people out badly. A CMS doesn't exist in isolation: it sits on top of a specific version of PHP and a specific database version, and over time all of those move. Eventually your hosting provider has to retire an old PHP version for their own security, or your CMS drops support for the version you're on, and suddenly the comfortable "it just works" arrangement needs attention you didn't plan for.
On shared hosting especially, you often don't control the timing of any of this. That can leave you with a genuinely bad choice: attempt the upgrade yourself and risk breaking a working site, or sit on a known-vulnerable version waiting for the hosting provider to action a support ticket on their schedule, not yours. Neither is comfortable, and both are entirely avoidable if the site never needed PHP and a database in the first place.
And the upgrades themselves aren't guaranteed to go cleanly. A CMS update touches a lot of moving parts, the core software, plugins, and the database all at once. One wrong character written to the database, or one file that didn't update properly, and the whole site can simply stop, sometimes loading as nothing but a blank white page with no obvious cause. The honest questions to ask yourself before relying on a CMS are: if that happens, do you know how to diagnose and fix it? Will your hosting provider fix it for free, and if so, how long will their queue take? If the answer is that you'd be paying a professional to untangle a broken update, that's potentially hours of billable time to recover from something that was supposed to be routine, on a site that may be down the whole while it waits.
None of this is an argument that CMS platforms are bad. It's an argument that they carry real, ongoing operational risk that you only feel when something goes wrong, and that risk is worth paying only when the site genuinely needs what a CMS provides. A static site has none of these failure modes, because there's nothing to upgrade and nothing to break.
So which does your site actually need?
The honest decision comes down to what your site genuinely does:
| A static site is likely right if… | A dynamic site (CMS) is justified if… |
|---|---|
| It's mostly a brochure: who you are, what you do, how to contact you | Content changes often and non-technical people need to edit it themselves |
| Content changes occasionally, not daily | You run a blog with frequent posts, or a genuine news feed |
| You don't need user logins or accounts | You need user accounts, logins, or member areas |
| You want maximum speed, security, and minimal upkeep | You run an online store with live inventory and checkout |
| There's no shopping cart or live data | You need interactive, personalised, or real-time features |
Notice that a great many small-business sites fall squarely in the left column, a handful of pages describing the business, updated a few times a year, yet are built in the right column's tooling out of habit. That's the over-build this piece is about.
The "but I want to edit it myself" question is the one that usually pushes people to a CMS, and it's fair, but worth examining. If you genuinely update content weekly, a CMS earns its keep. If you edit a few times a year, the convenience of a dashboard is being paid for with permanent speed, security, and maintenance costs. Modern static-site approaches have also narrowed this gap considerably, offering friendlier editing without a database behind every page view.
The middle ground worth knowing about
It's not strictly either/or any more. Modern tooling can take CMS-style content and pre-build it into static files: you get a comfortable editing experience, but visitors are served fast, secure static pages rather than database-built ones. The point isn't that dynamic sites are bad; it's that the choice should be deliberate, matched to what the site actually does, rather than defaulting to a database-backed CMS for a site that's really just a few pages.
The takeaway: before building (or rebuilding) a site on a CMS, ask honestly how often the content really changes and whether you need logins, a store, or live data. If the answer is "rarely" and "no," a static site will be faster, cheaper, and dramatically more secure, and you'll spend your time running your business instead of patching plugins.
Frequently asked questions
What's the difference between a static and a dynamic website?
A static website serves pre-built files exactly as they are, with no database or code running per visit. A dynamic website builds each page on demand by running code and usually querying a database. CMS platforms like WordPress are dynamic.
Is a static website more secure than WordPress?
Generally yes, and substantially so. A static site has no database, no admin login, and no plugins, so the most commonly exploited weaknesses of a CMS simply don't exist. WordPress and the PHP it runs on are among the most heavily targeted software on the internet: automated bots constantly scan for outdated installs and known weaknesses, and staying safe depends on staying perfectly up to date. A static site isn't running any of what those bots are looking for, so that entire category of attack has nothing to hit. Most hacked small-business sites are outdated CMS installations with a vulnerable plugin.
Can a CMS update break my website?
Yes, and it's a real risk, not a rare one. A CMS update touches the core software, plugins, and the database together, and a single file or database error can leave the whole site down, sometimes as nothing but a blank white page. Recovery can require technical digging, and if you can't do it yourself and your host won't fix it free, you may be paying a professional for hours of work. Forced PHP or database version changes on shared hosting can trigger the same problem. A static site has no updates of this kind to break.
Do I need a CMS to update my own website?
Not necessarily. A CMS makes self-editing convenient, which is worth it if you update content often. If you only change content occasionally, modern static-site tooling can offer friendly editing without the ongoing speed, security, and maintenance cost of a database-backed CMS.
When is a dynamic website actually necessary?
When you need user logins or accounts, an online store with live inventory, frequently changing content edited by non-technical staff, search, or interactive and personalised features. For a mostly-unchanging brochure site, a dynamic CMS is usually overkill.
Not sure whether your site is over-built, or weighing up a rebuild? Get in touch for a straight opinion on what your site actually needs.
Get in touch →