Built in advance, served from nearby
A static websiteA static website is made of ready-made page files that the server hands over as they are, with no PHP code or database working behind the scenes. consists of HTML, CSS and JavaScript files that are ready before any visitor arrives. A static site generatorA static site generator, such as Astro or Hugo, is a tool that builds all the pages of a website in advance, so visitors get ready-made files. such as Astro turns content and templates into those files during each deploymentA deployment is the step that puts a new version of your website live for visitors, ideally automated, tested and easy to undo.. The content itself can come from Markdown files or from a headless CMSA headless CMS is a system for editing content that has no website attached; a separate front end takes the content and builds the pages visitors see., so editors keep a familiar place to write. The files are then served from a CDNA CDN is a network of servers around the world that keeps copies of your website close to your visitors, so pages load fast wherever they are., a network of servers that keeps a cacheA cache is a store of ready-made copies, such as finished pages, so a website or browser can show something instantly instead of building it again. close to every visitor.
The dynamic parts
Static does not mean nothing moves. The JamstackJamstack is a way of building websites from pages that are made in advance and delivered from servers around the world, with small services for the live parts. approach adds JavaScript and APIs for the parts that need them. Small pieces of code can run as serverlessServerless is a way to run code without looking after your own server: the provider runs your small pieces of code when needed and keeps the machinery updated. functions or through edge computingEdge computing means running small bits of code on servers close to the visitor, instead of on one central server far away., close to the visitor, for example to process a contact form. TurnstileTurnstile is Cloudflare's privacy-friendly check that tells real people from bots on your forms, without making visitors solve puzzles. can tell people and bots apart on that form without making visitors solve puzzles.
What editors notice
For the people who update the site, the change can be small. They write pages in a headless CMS or in simple files, press publish, and a new version of the site is built and deployed within minutes. What disappears is the pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. update screen, the security warnings in the dashboard and the late-night worry about the next PHP releaseA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing..
Why it matters for PHP problems
A static site is not immune to every attack. What changes is the size of the target: with no PHP and no database running on each page view, the attack surfaceThe attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server. gets much smaller and there is no PHP version left to keep up with. For sites that mostly publish information, that can be the cure rather than another patchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem.. Our WordPress to static site service rebuilds your site this way, with the same content and URLs. If you would rather keep your current setup for now, we can update PHP in WordPress and move it to a supported version instead.