A static site usually gives attackers less to work with, because the public site is a set of prebuilt files with no login page, database or plugins running behind it. That is a smaller target, not an invulnerable one, and a well-maintained WordPress site can be run safely. The real difference is how much ongoing upkeep each approach needs to stay safe.
Security questions tend to arrive after a scare: a friend's business site defaced overnight, strange pages appearing under your own domain, or a hosting company's warning about an outdated plugin. The instinct is to pick the platform with the best reputation. A more useful approach is to ask what each one requires of the people who run it.
This page compares the two approaches for owners and marketing leads planning a build. It is not a security audit or advice about a specific site, so have someone qualified review the site you run today. For the build approach behind this, see how Hudson South builds websites.
What static means in practice
A static site is built ahead of time. Each page exists as a finished file, and the host sends that file to whoever asks for it. A WordPress page is assembled by software on the server when someone requests it, drawing on a database, with an administrator login sitting on the same site. Fewer moving parts is not the same as no risk. It does mean fewer places for something to go wrong between updates.
That design has a cost. There is no editing screen for staff, so changes go through whoever maintains the code. For a business that changes its site a few times a year, that is usually a fair exchange. For a team that publishes every week, it is not, and WordPress's editing tools start to earn their upkeep.
Hudson South's Netlify sites are hand-coded, and Netlify's documentation covers several pieces owners ask about. It offers free HTTPS on all sites, with certificates created and renewed automatically when Netlify manages them. Its publishing is atomic, so no changes reach the public address before all of them have uploaded. Forms can be handled "without extra API calls or additional JavaScript," with submissions sent to an email address through notifications.
Where WordPress risk usually comes from
WordPress's own hardening guide is frank about the subject. It says, "What security is though is risk reduction, not risk elimination," and it names old and outdated plugins and software among the common weak points. Its advice is ordinary and effective: keep WordPress current, keep plugins updated, delete any plugin you are not using, use strong passwords, turn on two-step authentication, and back up data regularly, including the database.
Access deserves the same discipline as updates. WordPress's roles documentation, in its section on custom roles for site editing, puts the principle in one line: "Only grant the capabilities required for the tasks the role is intended to perform." A site where every staff member, past agency and freelancer still holds an administrator account has more doors than it needs, whatever its plugins look like.
Updates do not have to be manual. Since WordPress 5.5, administrators can opt in to automatic updates theme by theme and plugin by plugin, from the Appearance and Plugins screens. That helps, but someone still has to decide which updates run automatically and check the site afterward. Hudson South builds WordPress sites on a custom theme for businesses that want to edit and use plugins, and that choice comes with an owner for updates. The plugin side of that upkeep is covered in how many WordPress plugins is too many.
A side-by-side view
| Area | Static site on Netlify | WordPress |
|---|---|---|
| Login on the public site | None | A login screen used by every WordPress user, from administrators to contributors |
| Software running on each request | None; prebuilt files are served | WordPress software and its database |
| Adding features | Coded in by the builder | Plugins, each updated separately |
| Regular upkeep | Content and code changes made by the builder | Core, theme and plugin updates, plus backups |
| HTTPS | Free, with automatic renewal for Netlify-managed certificates | Depends on the host |
| Accounts to protect | Hosting, domain registrar, email | Hosting, domain registrar, email, every WordPress user |
Read the table as a list of chores, not a verdict. A WordPress site with an attentive owner can be in better shape than a static site whose domain account uses a shared password from 2015.
The risks a static site does not remove
Plenty of website trouble has nothing to do with the platform. Domain registrar accounts, DNS settings, the email inbox that receives password resets, and third-party scripts added for chat or tracking all carry their own risk on any site. A useful question for the next team meeting is simple: "Who has the login to our domain registrar, and does that account use two-step verification?" If nobody knows, that gap matters more than the choice of platform.
Forms deserve the same attention. Every Hudson South build sends form submissions to the business by email, and someone should confirm where those messages land and who can read them. Account ownership is covered in who should own your domain and website accounts.
Third-party scripts are the other blind spot. Every chat widget, analytics tag or booking embed loads code from another company onto your pages. On a hand-coded site, those scripts may be the only code on the page your builder did not write, so each one deserves an owner and a reason. When a tool stops being used, remove its script rather than leaving it in place.
A fictional example: choosing by upkeep, not fear
Here is a fictional example. A dental practice in North Carolina runs an older WordPress site with dozens of plugins installed, a third of them inactive. Nobody on staff updates anything, and the developer who built it moved on years ago. The site changes about four times a year, usually for hours and insurance updates.
The practice has two honest options. It could keep WordPress, delete the unused plugins as the hardening guide advises, turn on automatic updates where appropriate, and name a person to check the site each month. Or it could move to a hand-coded static site and send its four yearly edits to the builder. It picks the second, because no one at the practice wants to own updates. When its pages are rewritten for the new site, they come from what the dentists and office manager approve, so the writer does not have to invent what the practice knows about its own emergency hours or accepted insurance.
The same order applies on either platform. Hudson South runs every build in the same order. Authority Asset gathers approved business knowledge and evidence. Hudson Twenty-One records how the business communicates across 21 dimensions, so the pages sound like the people who answer the phone. Market Intelligence researches the questions buyers ask and how the market answers them. AEO Creation turns those inputs into answer-first pages. Security decides how the site is kept. Those four steps decide what it says.
Compare the sites your buyers are comparing
On a free 30-minute call, we walk through how your site and your competitors' sites answer the questions buyers ask, and what that suggests for your rebuild.
Get your free competitor analysisSources
- HTTPS (SSL). Netlify Docs. Read 2026-10-17.
- Deploy overview. Netlify Docs. Read 2026-10-17.
- Forms setup. Netlify Docs. Read 2026-10-17.
- Hardening WordPress. WordPress Advanced Administration Handbook. Read 2026-10-17.
- Roles and Capabilities. WordPress.org Documentation. Read 2026-10-17.
- Plugin and themes auto-updates. WordPress.org Documentation. Read 2026-10-17.