From WordPress to Gatsby: Why We Switched to a Static Website
Our website ran reliably on WordPress for many years. Nevertheless, we have now migrated it completely – to Gatsby, a so-called static site generator. In this article we briefly explain what that actually is and why this approach is the better choice for a great many websites.
What is a static site generator?
A classic content management system like WordPress assembles every page on every request: a web server starts PHP, PHP queries a database, and a theme renders HTML from the result. For this to work, an application stack and a database run permanently on the server – and both have to be maintained, updated and secured.
A static site generator turns this principle around: the entire website is built once, in advance. From content (Markdown files in our case), templates and images, Gatsby produces finished HTML, CSS and JavaScript files. In the end, the server only holds a folder of static files served by a lean web server. No database, no PHP, no admin login.
Why is that more secure?
The attack surface of a website essentially consists of the code that is executed on the server. With a CMS, that is quite a lot: the PHP interpreter, the CMS itself, themes, plugins, the database and the login backend. This is exactly why outdated WordPress installations and vulnerable plugins have been among the most common entry points for compromised websites for years.
With a static website, no application code at all is executed on the server. There is:
- no admin panel that can be brute-forced,
- no plugins that need security updates every week,
- no database that could be read out via SQL injection,
- no comment or upload features that can be abused.
What does not exist does not need to be secured – and cannot be hacked.
Less maintenance, more peace of mind
The second big win is maintenance. A CMS demands continuous care: core updates, plugin updates, PHP version upgrades, compatibility issues after updates. Neglect this for a few months and you are running a security risk.
A static website knows no such cycle. The generated files stay correct until the content changes. There is simply nothing on the server that could become outdated. On top of that come some pleasant side effects:
- Speed: Pre-built HTML files are delivered without any rendering overhead and can be cached perfectly – noticeable on every page view and good for search engine rankings.
- Reliability: No database outage, no "Error establishing a database connection" page. Very little can disrupt the delivery of static files.
- Privacy: Without a CMS, no cookies are needed. Our website works entirely without a cookie banner – all resources (fonts, images, scripts) are loaded from our own domain.
- Versioning: Content lives as text files in version control. Every change is traceable and can be reverted with a single command.
Who is this for?
To be clear: not every website should be static. An online shop or a portal with user accounts needs dynamic logic. But a very large share of all company websites are effectively business card websites: services, references, contact, legal pages – content that changes a few times a year.
That is exactly where a full-blown CMS is oversized. You pay for the flexibility of an editorial system with permanent maintenance and security effort – while hardly using it. A static website delivers the same result for your visitors: faster, more secure and cheaper to operate.
Our conclusion
Migrating from WordPress to Gatsby made our website noticeably faster, reduced the attack surface drastically and cut the maintenance effort to almost zero. From now on, we edit content in simple text files; the rest is an automated build.
Still running a CMS for a website that rarely changes? We are happy to advise you on the migration – from the analysis and content migration all the way to automated deployment.
Photo by Markus Winkler on Unsplash