Most small business websites that get hacked aren't singled out. Automated scanners sweep the web day and night looking for a known weakness: an out-of-date plugin, an exposed login page, a database that will run a cleverly crafted query. When they find one, they break in, whoever the site belongs to.
A static website removes most of those weaknesses at the root. This post explains why, what risks are left, and how an AI assistant can sit on a static site without bringing the old problems back.
Why database-driven sites get attacked
A WordPress site, like most content management systems, builds each page when someone asks for it. The server runs PHP code, queries a database and assembles the result. That's flexible, but it means every visitor is talking to live software, and every piece of that software is something an attacker can probe.
The weak points are well known. Plugins are the biggest, because a typical site runs dozens of them, written by different people and updated at different times. Then there's the login page at a predictable address, which invites password-guessing. And there's the database itself, which can be tricked into handing over or changing data if any code passes it unchecked input.
Keeping all of that patched is a job in its own right. Miss a few updates during a busy month and the site is exposed to attacks that are already automated and widely used.
What changes on a static site
A static site is built once, ahead of time. Every page is turned into a plain HTML file and the server simply sends those files out. There's no database behind the pages, no PHP running on each visit and no admin login on the public website.
That takes the most common attacks off the table. You can't inject commands into a database that isn't there. There are no plugins to exploit and no login page to hammer with guessed passwords. If someone did manage to change a file, the next build replaces it with the clean version from source control.
It also makes the server's job simpler. Serving files is about the least demanding thing a web server does, so the hosting can be locked down tightly and still cope with sudden spikes in traffic.
What still needs looking after
Static doesn't mean invulnerable. A few things still matter:
- The server and hosting account. The machine serving the files needs updates and strong access controls, and the hosting login needs two-factor authentication.
- Forms and anything interactive. A contact form has to send its data somewhere. That small piece of code needs input checking, spam protection and rate limits.
- Third-party scripts. Analytics, chat widgets and embeds all run in your visitors' browsers. Keep the list short and load them from sources you trust.
- Your domain and DNS. Whoever controls these controls where your visitors end up. Lock the domain and protect the registrar account.
- Security headers. A content security policy, HTTPS everywhere and the usual protective headers limit the damage if anything does slip through.
That's a much shorter list than for a typical WordPress site, and most of it is set up once rather than patched every week.
Where the AI assistant fits
An AI assistant is the interactive part of an AI-powered static site, so it is worth being clear about how it is kept separate. The assistant runs as its own service. The website talks to it through a narrow, rate-limited connection, and the assistant has no access to edit the live site directly.
When you ask the assistant to change a page, the change goes through the same build process as any other update: the new version is generated, checked and then published as static files. If something looks wrong, the previous version can be restored in moments.
The assistant also never needs your customers' payment details or passwords. It handles questions and enquiries, and anything sensitive goes to a person.
What it means for a small business
For most small businesses, the biggest security risk is simply not having time to keep a complicated website up to date. A static site takes most of that maintenance away. There are fewer things to patch, fewer ways in and a quick way back if anything goes wrong.
It's also cheaper. Hosting static files costs very little, and you don't need security plugins, firewall subscriptions or emergency developer call-outs to clean up after a hack.
A quick check for your current site: try visiting your-domain/wp-login.php or your-domain/wp-admin. If a login page appears, your site has a public admin login that automated tools will find, and it's worth making sure two-factor authentication is switched on.
Frequently asked questions
Can a static website be hacked?
It's much harder. With no database, no server-side code on the pages and no public login, the usual automated attacks have nothing to work on. The hosting account, the domain and any forms still need protecting, but there are far fewer ways in.
Is a static site less capable than WordPress?
For most small business sites, no. Contact forms, booking links, chat and an AI assistant all work alongside static pages. What you give up is editing through a WordPress dashboard, and on our sites the AI assistant takes over that job.
Do I still need hosting with security features?
Yes, but the requirements are simpler. You want HTTPS, up-to-date servers, backups and two-factor login on the account. All of that comes with Daedalus hosting.
Want a site with less to go wrong?
Every Daedalus AI website is static, hosted on hardened UK servers and comes with an AI assistant.
Compare the plans →