Just put some HTML on the web

As security vulnerabilities become easier to discover and exploit, keeping less software exposed online is increasingly important. Recent critical vulnerability reports have surged, and the author doubts that AI-driven security improvements will soon make large-scale flaws disappear. Drawing on years of building content-management-system websites, the author argues that clients rarely updated their own sites despite requesting editing tools; changes usually came by email. For content-focused websites that are updated infrequently, complex server-side frameworks can therefore add maintenance and security obligations without much practical benefit. Teams should consider how often content really changes and who will pay to keep the software patched.

Static site generators shift the work to build time, producing ordinary HTML that is fast, inexpensive to host, and has a small attack surface. The author’s own Jekyll site runs free on GitHub Pages and has handled traffic spikes without requiring security patches. Static approaches can also suit dashboards with data refreshed every few hours and data visualizations built into ETL pipelines. Examples include documentation and organizational sites, while tools such as Publii and hosted services like Bear Blog offer simpler options for nontechnical users. Static sites are not immune to hosting compromises, and dynamic systems remain appropriate for complex applications. The central point is to avoid unnecessary infrastructure: where a site is mostly static, plain generated pages can reduce both costs and future maintenance headaches.