Is a static website the right choice?

Most small organisations need a website at some point, and many of them get a quote for one. Some quotes offer a site made of pages that are built in advance and sent out the same to every visitor. People call this a static website. It suits some sites well, and for others it is the wrong choice.

What a static site is

Developers at MDN, the web reference run by Mozilla, describe a static site as one that returns the same content every time someone asks for a page. The server sends the files as they are.

A dynamic site builds its pages when they are asked for. Usually the software fills a template with content from a database. MDN calls static sites the easiest kind to set up.

When it is the wrong choice

Code running on a server lets a site show each visitor something different. MDN gives the example of a shop remembering a customer's card details for the next payment. A site made only of ready-built pages has no way to do that by itself.

So the jobs to look out for are logins and member areas, bookings against a live calendar, a shop with real stock, and anything that changes from one visitor to the next. MDN adds that a separate ready-built page for every product in a very large catalogue would be impractical. Some sites keep most pages simple and run separate code for one job, such as a booking form. Then someone has to look after that code too.

Who changes it after launch

On most static sites, changing a sentence means someone edits a text file and rebuilds the site. Most people without technical help will not do that. If a volunteer or an office manager needs to change opening hours every week, ask who will do it and how.

A content management system gives people an admin screen for editing pages. Someone then has to keep that software and its add-ons up to date against security problems.

What it does for security, and what it leaves

A static site has no database and no admin login for someone to leave open. The risk moves to the accounts that control the site.

The National Cyber Security Centre (NCSC) advises turning on 2-step verification with the company that holds your domain name. It advises setting the domain to renew automatically, because once a domain expires another organisation could register it. It also says the domain should be managed by your organisation, not by the web hosting company.

A page can also load a script from another company's server. MDN warns that if an attacker gains control of that server, they can change what your page runs.

Rules that apply however it is built

The Information Commissioner's Office (ICO) says website owners must tell people about any cookies they set and get their consent. There is an exemption for cookies that are strictly necessary for a service the visitor asked for.

The Web Content Accessibility Guidelines (WCAG) explain how to make web content accessible to people with disabilities. The W3C published WCAG 2.2 on 5 October 2023, with an update on 12 December 2024.

Questions to ask before you choose

Will anyone need to log in?
Will the site take bookings or payments?
Who will change the words, and how often?
Whose name is the domain registered in, and is 2-step verification switched on?
If you part company with whoever built it, what do you take with you?

For a side-by-side look at five ways of building a small site, minisitemaker.co.uk compares them on who ends up maintaining each one.