Static WordPress site: when it speeds up and secures your website

A static WordPress site speeds up your website and makes it more secure, but only on one condition: the content changes rarely, and the server doesn’t have to handle logins, a cart or orders. In that setup WordPress is used only for editing. Visitors get ready-made HTML files. Below I explain who benefits from this, when it’s better to stay with a classic installation, and what the setup itself looks like.

What is a static WordPress site and how does HTML export work?

It’s a copy of your website saved as ready-made HTML, CSS and JS files. The server simply sends them out: no PHP execution and no database queries. A dynamic page is rebuilt from scratch on every request. A static one is generated once, after the content changes, and then the server just delivers it.

Exporting WordPress to HTML works like this: the admin panel runs at a separate, non-public address, and the generated files go to the target domain or server. There is also a second option, headless WordPress. Here the system exposes content through an API, and a separate frontend application displays it. What’s the difference in practice? A simple export gives you ready-made files with no server-side part. Headless means a new frontend that someone has to build and then maintain.

Why does a static site load faster?

Because the server delivers a ready-made file. It doesn’t run PHP every time, doesn’t load plugins and doesn’t hammer the database with queries. When traffic suddenly spikes (say, after an ad campaign), the machine uses far fewer resources and chokes less often.

A simpler architecture also means cheaper hosting. A regular web server is enough to serve files, or even plain file hosting. Such files are easy to put on a CDN, which serves them from a server located close to the user. Shorter load times are more convenient for visitors, and page speed is one of the signals search engines take into account. Looking for a way to speed up your WordPress site without changing the theme? A static version is often the simplest answer.

How does a static version reduce the risk of a break-in?

The public site has no login panel, no PHP and no database. Most of the typical attack paths against WordPress simply disappear. So is a static site more secure? Usually, yes. An attacker has nothing to execute on the server side.

Vulnerable plugins, the wp-login form and the API stay on the editing instance, behind a closed address that can’t be reached from the internet. But be careful, going static doesn’t free you from your duties. That instance and the server itself still need updates (including to a newer PHP version), password protection and restricted access, for example by IP address or through a VPN.

When does a static WordPress site make sense, and when doesn’t it?

It works well for business card sites, company websites, landing pages and blogs updated every now and then. In general, anywhere the website mainly presents content. It’s a good fit for cases like these:

• a company business card site or a page with your service offer,
• a website you change once a week or less often,
• a campaign or event page,
• product documentation,
• a company blog without extensive comments.

Static or dynamic site? The scales tip in favour of dynamic when you need:

• a WooCommerce or PrestaShop store with a cart and payments,
• customer accounts and logins,
• forms without an external service handling them,
• server-side search and filters,
• content that changes many times a day.

Forms and comments can be handed over to external services. But that’s another dependency: an extra provider, its terms of service and the processing of personal data. In my view, you should think this through before you decide, not after.

How to set up a static site generator step by step

It all comes down to three things: prepare the editing instance, generate the files, publish them on the target domain. In practice it looks like this:

1. Review the dynamic features: forms, search, comments, elements that depend on a logged-in user.
2. Move the admin panel to a separate address and block access to it from the internet.
3. Configure the export: file format, excluded URLs, target domain.
4. Generate the files.
5. Check links, images, forms and redirects.
6. Publish the files on the target server.
7. Regenerate the site after every content change.

For this job you can use the Static Site Generator from K4.pl plugin. It lets you choose the format of the generated files, specify links to skip and set the new domain where the site will be hosted. It also supports WP CLI, the WordPress command line. That comes in handy when content changes regularly: regenerating from the command line creates new files automatically, with no manual clicking in the admin panel.

Is a static WordPress site right for your business?

If your website mainly shows your offer and rarely changes, a static version will usually give you faster loading and a smaller attack surface. Before you decide, answer three questions:

• How often does the content change, and will someone remember to regenerate the files?
• Which features need a server, and can they be moved to external services?
• Who publishes updates, and can they handle the export or its automation?

A static WordPress site combines the convenience of editing in a familiar admin panel with the simplicity of ready-made files. Provided, of course, that your feature set fits this model. A store with a cart will stay dynamic, and there’s no point fighting that. But a company business card site or a blog? They often gain a lot from the switch.

Frequently asked questions