Static site or WordPress? A comparison with real measurements

A static site generator (SSG) is a program that turns text, written in a format such as Markdown, into finished HTML, CSS and JavaScript files. A site built this way has no server-side logic: everyone who requests a given URL gets the same content (MDN glossary). On a dynamic site, code on the server inserts data from a database into templates only when it’s needed (MDN, introduction to the server side). To do this, WordPress needs a server with PHP and a MariaDB or MySQL database (WordPress.org, requirements).

The term Jamstack for this approach originated at Netlify. Pages are prebuilt and served from a content delivery network (CDN), a group of servers spread across many locations (MDN glossary, CDN). Other features connect through APIs to backend services (Jamstack.org).

WordPress is by far the most widely used content management system (CMS). It’s used by 39.4% of all websites, or 58.1% of the websites whose CMS W3Techs can identify. Astro accounts for 0.2% of all websites and Hugo for 0.1% (W3Techs, Nov 8, 2026).

The line between the two isn’t clear-cut. With a caching plugin, WordPress can serve stored pages as static files (WordPress handbook, caching). Astro prebuilds pages by default but can also render individual pages on the server when they’re requested (Astro Docs, on-demand rendering). Our guide to technical SEO explains how search engines fetch pages and what else matters on the technical side.

The numbers in the “Sources” column refer to the source list at the end of this article. Datafalke builds static websites, so this comparison relies on public data from third parties. Our own website appears only in the “From our work” section.

Strengths: The block editor has been the default since WordPress 5.0, released in December 2018. You use it to build pages and posts from blocks (WordPress documentation, block editor). Six predefined roles control who can write, publish or manage the site (WordPress documentation, roles). Every saved version stays in the revision history and can be restored (WordPress documentation, revisions). Many features come as extensions: the official directory lists more than 78,000 free plugins (WordPress plugin directory). According to W3Techs, 19.7% of WordPress sites use the WooCommerce online store extension (W3Techs, WordPress). On most sites, WordPress installs minor core updates automatically (WordPress handbook, updates).

Limits: According to the Web Almanac, a WordPress site’s speed and the effort it takes to run depend heavily on how it’s built. The report notes that page builders, which let you put together layouts without code, often produce more complex HTML and larger CSS and JavaScript files (Web Almanac 2025, CMS). Security vulnerabilities, too, are found mainly in plugins and themes (Patchstack, Feb 25, 2026).

Use case: blogs and magazines with several authors, clubs and associations with changing contributors, and online stores run by their own team. It also fits websites where the marketing team regularly creates new pages itself. If your team knows WordPress and an outside provider handles maintenance, we see little reason to switch.

Strengths: Because the server doesn’t have to generate anything, it responds consistently fast. The prebuilt files can be distributed across several CDNs (web.dev, Rendering on the Web). With real visitors, these sites come out ahead. In September 2026, 71–78% of sites built with Astro, Hugo or Jekyll passed all three Core Web Vitals on mobile, compared with 48% of WordPress sites (HTTP Archive). There’s no login and no database on the web server, and there are no updates for you to install there.

Limits: Every change means editing a file, rebuilding the site and uploading it. You only get an editing interface if you connect a CMS, such as a headless CMS, which manages content but doesn’t serve any pages itself (Astro Docs, CMS). Search, login or payments come from external services. A static site calls them at build time or directly from the browser with JavaScript (Jamstack.org). And static doesn’t automatically mean fast: Gatsby sites, which load a lot of JavaScript, passed the Core Web Vitals less often than WordPress sites.

Use case: websites for service businesses, law firms, medical practices and trades businesses whose pages change a few times a year. Campaign landing pages and technical documentation are a good fit, too. Decide in advance whether an outside provider will handle changes or your team will use a connected CMS.

Both approaches deliver finished HTML: a static site builds it in advance, and WordPress generates it on the server. Problems start when content only appears once JavaScript runs in the browser. That’s why Google still calls server-side or pre-rendering “a great idea”: it makes websites faster, and not all bots can run JavaScript (Google Search Central on JavaScript). In a measurement that the cloud platform Vercel published in 2024, none of the major AI crawlers, including those of OpenAI, Anthropic and Perplexity, rendered JavaScript (Vercel, Dec 17, 2024).

Good Core Web Vitals, the three metrics for load speed, responsiveness and layout stability, don’t guarantee top rankings (Google Search Central on page experience). To check whether your content is in the HTML, see the section Can Google see content that JavaScript generates? in our technical SEO guide. Our article AI crawlers and robots.txt explains which AI crawlers exist and what blocking them does. To check this on your own website, use our how-to on JavaScript and AI crawlers.

The figures come from the HTTP Archive’s Core Web Vitals Technology Report. It combines measurements from real Chrome visits, taken from the Chrome UX Report (CrUX), with the technologies the HTTP Archive detects in its monthly crawl. A site counts as good if it meets all three thresholds at the 75th percentile of page loads. The thresholds are 2.5 seconds for LCP (load time of the largest element), 200 milliseconds for INP (response to input) and 0.1 for CLS (layout shift). If a site has no INP data, it’s assessed on LCP and CLS (HTTP Archive, September 2026 data). Our article on Core Web Vitals covers what each metric means in detail.

Source: HTTP Archive, Core Web Vitals Technology Report (external site), Sep 30, 2026 · September 2026 data, mobile

For Germany, CrUX counts visits from users whose IP address is in Germany (CrUX documentation, countries). The figures therefore also include websites from other countries. For visits from Germany, every share is higher, but the order stays the same (HTTP Archive, Germany filter).

The share of WordPress sites with good scores is rising. A year earlier, in September 2025, only 45.0% of them passed all three metrics worldwide, or 59.9% for visits from Germany. Over the same year, though, Astro and Hugo sites improved more, from 61.6% to 71.1% and from 70.2% to 78.2%. Worldwide, the gap actually widened (HTTP Archive).

Response time: Time to First Byte (TTFB) measures the time from the request until the first byte of the response arrives. Up to 0.8 seconds counts as good. TTFB isn’t one of the Core Web Vitals, but it comes before the loading metrics First Contentful Paint (FCP) and LCP (web.dev on TTFB). According to web.dev, static rendering achieves a consistently fast TTFB because the server doesn’t have to generate the HTML first. With server-side rendering, that’s exactly the step that takes time (web.dev, Rendering on the Web).

Caching: The WordPress handbook calls caching “the fastest way to improve performance.” Caching plugins store posts and pages as static files and serve those instead. For pages that rarely change, this can improve performance “several hundred times over” (WordPress handbook, as of Oct 14, 2026). The HTTP Archive data doesn’t show how many WordPress sites use such a cache.

JavaScript: For responsiveness to input, 90.3% of WordPress sites had good scores, compared with 85.0% for Astro and 76.0% for Gatsby. The web.dev guide adds that prebuilt pages only respond quickly to input if they limit the JavaScript that runs in the browser. On mobile, Gatsby sites transferred a median of 1.02 MB of JavaScript and WordPress sites 0.68 MB. Astro sites came in at 0.41 MB, Hugo sites at 0.31 MB and Jekyll sites at 0.18 MB (HTTP Archive, page weight).

What the data doesn’t show: These are shares of groups of very different sizes: 2.7 million WordPress sites versus 47,277 Astro sites. The data doesn’t show whether switching would make a particular website faster. The HTTP Archive detects technologies automatically with a tool called Wappalyzer, and its URLs come from CrUX (HTTP Archive FAQ). The report doesn’t distinguish between Astro sites that prebuild their pages and those that render them on request. CrUX also includes only websites with enough Chrome visits (CrUX documentation).

According to OWASP, an application’s attack surface covers all the paths that data or commands take into and out of it, plus the code that protects those paths (OWASP on attack surface analysis). A static site without a form has few of them: the server delivers files and accepts no input. WordPress has user accounts for editors and generates pages with PHP. Plugins and themes bring code of their own.

Figures from Patchstack, a company that sells protection for WordPress sites, show how this plays out. In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem, up 42% from 2024. Of these, 91% were in plugins and 9% in themes. Only six were in the core, and all of them were low priority. For 46%, the developer hadn’t released a fix by the time the vulnerability was publicly disclosed. The most heavily attacked vulnerabilities were first exploited a weighted median of five hours after they became known.

Source: Patchstack (external site), Feb 25, 2026 · vendor study

A security team of more than 50 experts looks after the core. Only the latest version is officially supported, but the team also backports fixes to older versions (WordPress.org on security). WordPress updates plugins and themes automatically only in special cases determined by its security team (WordPress handbook, updates). As of version 5.5, you can turn on automatic updates for each plugin and theme individually (auto-updates for plugins and themes).

A static site shifts the risks to access credentials and tools. According to the US Cybersecurity and Infrastructure Security Agency (CISA), a worm known as “Shai-Hulud” compromised more than 500 packages in the npm registry in September 2025. The malware searched for credentials such as GitHub tokens and keys for cloud services (CISA, Sep 23, 2025). Generators such as Astro get their packages from this registry (Astro Docs, installation). And as soon as a form accepts data, even a static site runs code on a server again.

WordPress: From December 2025 to October 2026, WordPress shipped 15 releases of whichever series was newest at the time, including the major releases 6.9, 7.0 and 7.1. WordPress says only the most recent version in the 7.1 series is “safe to use and actively maintained” (WordPress.org, release archive).

On top of that, there’s PHP, the programming language WordPress is built on. On November 8, 2026, more than 30% of the installations that WordPress.org tracks were running PHP 8.1 or older (WordPress.org statistics). These versions no longer get security updates. For PHP 8.2, which another 22.6% run, security support ends on December 31, 2026 (php.net, supported versions). WordPress recommends PHP 8.3 or later (WordPress.org, requirements).

Extensions: For almost half of the vulnerabilities that became known in 2025, no update was available when they were disclosed (Patchstack, Feb 25, 2026). Back up your site before every update, as the WordPress handbook also advises, and check your most important pages afterward.

Static site: The server runs no site software that could go out of date. What you maintain instead is the toolchain that builds the pages. Astro, for example, requires Node.js 22.23.4 or later (Astro Docs). According to the Node.js project, long-term support (LTS) releases typically get fixes for critical bugs for a total of 30 months (Node.js releases page). If years pass between two changes, you’ll often have to move to new major versions before you can make the change.

Calculate both options over the same period, such as five years, using these items:

1. one-time cost of building the site or of a redesign
2. monthly hosting × number of months
3. monthly maintenance × number of months, including paid plugins and themes for WordPress
4. changes per year × hours per change × hourly rate × number of years
5. services for forms, search or a CMS, if your static site needs them

Our cost guide lists market prices in euros for running a website in Germany, such as hosting and maintenance contracts, in its section What does a website cost to run?

WordPress with a cache: A caching plugin stores pages as files and serves them without generating them again (WordPress handbook, as of Oct 14, 2026). You keep the editor and the plugins, and the maintenance, too.

WordPress as a backend CMS: Through its programming interface, the REST API, WordPress passes content to other applications (WordPress REST API Handbook). A generator can use that content to prebuild finished pages. Your visitors then get the prebuilt files, but WordPress still needs updates behind the scenes. Developers call this setup “headless.”

Static site with a headless CMS: The CMS manages text and images but doesn’t serve any pages itself; the generator fetches the content from it. Most of these systems offer a visual editor and a way to collaborate as a team (Astro Docs). The site is rebuilt after every change.

If you want a website without WordPress and without custom code, a website builder is another option. Our cost guide explains what a builder costs and who it’s enough for in its section Website builder or web designer: which costs less?

1. Who changes the content? Several people without technical skills point to WordPress. An outside provider, or someone who’s comfortable working with text files, points to a static site.
2. How often do you change things? Changes several times a week, for example for posts or promotions, point to WordPress. A few changes a year point to a static site.
3. Which features do you need? An online store, a members’ area or a booking system with user accounts points to WordPress or custom software. A contact form and search work with either approach.
4. Who installs updates? If no one is clearly responsible, that points to a static site. With a maintenance contract or a designated person, either works.
5. How much do load time and attack surface matter? If they matter a lot, that points to a static site. With WordPress, a cache, a lean theme and few plugins help.
6. What does your team already know? If your team knows WordPress well, you need a good reason to switch. Switching means a website migration, often with new URLs.
7. What will it cost over five years? Calculate both options over the same period, including hosting, maintenance and changes.

If you plan to switch, set up a redirect for every old URL. Our website migration checklist covers what else matters. The questions and how we weigh them are our own assessment; no one has tested them as a whole.