WordPress vs Static Websites: Why We Don't Build on WordPress
WordPress runs a huge share of small business websites, and it's the most attacked platform on the web. Here's why every Webralia site is a static website instead, and what that means for your speed, security and costs.
We don’t build websites on WordPress. Not for tradies, not for brokers, not for anyone. Every Webralia site is a static website: pre-built pages served from Cloudflare’s global network, with no database, no plugins and nothing to patch.
That’s a deliberate choice, and an unusual one in an industry where WordPress is the default. This guide explains why we made it, in plain English, so you can decide what’s right for your business.
The short version
WordPress is software that runs every time someone visits your site. It depends on a theme and a stack of plugins from different developers, all of which need regular updates. When updates are missed, which is common on small business sites, the site becomes an easy target. When updates are applied, things sometimes break.
A static website does all of its work in advance. Visitors get finished pages from a server near them. There’s very little that can be attacked, very little that can break, and nothing that needs updating every week. It’s faster, safer and cheaper to run.
How WordPress works (and why that’s the problem)
When someone opens a page on a WordPress site, this happens behind the scenes:
- The web server runs WordPress, written in PHP.
- WordPress asks a MySQL database for the page content and settings.
- The theme builds the layout.
- Every active plugin gets a chance to run: forms, SEO, sliders, page builders, security, analytics, caching.
- The finished page is sent to the visitor.
That happens for every visitor, on every page, unless a caching plugin steps in. It’s a lot of moving parts for what is, on most small business sites, a page that hardly ever changes.
A typical small business WordPress site has somewhere between 15 and 30 plugins. Each one is written by a different developer, updated on a different schedule, and has its own history of security problems. WordPress itself is reasonably well maintained. The ecosystem around it is not consistent.
Why WordPress sites get hacked
Because WordPress is so popular, it’s worth attackers’ time to build automated tools that scan the internet for sites running vulnerable versions of popular plugins. When a new vulnerability is published, scanning often begins within hours. The attacker doesn’t need to know or care who you are. Your site is just one address on a list.
The scale is hard to overstate. Security company Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025, and 91% of them were in plugins. Very few small business owners log in weekly to apply updates, and many web designers don’t either unless you’re paying for a maintenance plan.
When a WordPress site is compromised, the consequences are rarely subtle:
- Spam pages and hidden links injected into your site, damaging your Google rankings.
- Visitors redirected to scam, gambling or adult sites.
- A “This site may be hacked” warning next to your business in Google.
- Your hosting account suspended for sending spam.
- Enquiry forms quietly sending leads somewhere else.
Clean-ups cost hundreds or thousands of dollars, and rankings can take months to recover. For a tradie or broker who relies on the website for work, that’s lost income on top of the repair bill.
The maintenance treadmill
Even when nothing goes wrong, WordPress needs looking after:
- Core updates several times a year, plus security releases.
- Plugin and theme updates, sometimes weekly across a full set of plugins.
- PHP upgrades from your host, which can break older plugins.
- Premium plugin licences that expire and stop receiving updates if not renewed.
- Backups, because updates sometimes break things and you need a way back.
- Database clean-ups and caching to keep the site from slowing down over time.
That’s why so many WordPress sites come with a monthly maintenance retainer, and why so many sites without one end up out of date. It’s a treadmill you never get off.
How a static website works
A static website flips the model. All the work of building pages happens once, when the site is published:
- Your content and design are combined into finished pages.
- Images are compressed and sized for different screens.
- Code is trimmed to only what each page needs.
- The finished files are copied to Cloudflare’s network of data centres around the world.
When someone visits, the nearest data centre sends them the finished page. No PHP, no database query, no plugins. It’s like the difference between a café that cooks everything to order and one that has it plated and waiting on the pass.
Security compared
| WordPress | Static (Webralia) | |
|---|---|---|
| Plugins to keep updated | Typically 15 to 30 | None |
| Public admin login page | Yes (/wp-admin) | None |
| Database reachable through the site | Yes | None |
| Code running on every visit | Yes | None |
| Traffic flood (DDoS) protection | Depends on host | Cloudflare, included |
No website can be made impossible to attack, and anyone who promises that isn’t being straight with you. But a static site removes the most common ways small business sites are compromised. There’s no login page for bots to hammer, no database to inject into and no plugin with last month’s vulnerability. The attack surface is a fraction of the size.
Speed compared
Speed matters for two reasons. People leave slow sites, especially on phones. And Google uses Core Web Vitals, real-world measures of loading speed and stability, as part of how it assesses pages.
WordPress can be made fast, but it takes work: good hosting, a caching plugin, image optimisation, and restraint with page builders and plugins. Many sites never get there. According to the HTTP Archive’s 2025 Web Almanac, only about 45% of WordPress sites pass Core Web Vitals on mobile.
Static sites start with a structural advantage. The page is already built, it’s delivered from nearby, and there’s no database to wait for. With sensible images and lean code, fast mobile performance is the starting point, not a project.
Cost compared
WordPress is free to download. Running it properly isn’t. Decent managed WordPress hosting, premium plugins, a security plugin, backups and a maintenance plan can easily add up to $50 to $200 a month, before anyone fixes anything.
Webralia hosting is $12 a month, including SSL, Cloudflare security, backups and the hosting itself. There are no plugins to license and nothing to maintain. Changes are made for you for $29 each, or included in the $49/month care plan.
“But I want to edit my own site”
This is the main argument for WordPress. In practice, most small business owners rarely log in. The editor is fiddly, page builders are confusing, and many people are nervous about breaking something.
With Webralia, you don’t need a login. Email the change in plain English, such as “add a page about hot water systems” or “change the Saturday hours to 8 till 12”, and it’s done for you, usually the same day. You get the benefit of a professionally managed site without learning a content management system.
Static doesn’t mean basic
Some people hear “static” and picture a brochure. Modern static websites do everything a service business needs, by using small, secure services that each do one job:
- Forms go to a hardened form service with spam filtering, then to your email, phone and lead inbox.
- Bookings use a calendar service that syncs with Google or Outlook.
- Payments go through Stripe, so card details never touch your site.
- Calculators for quotes, borrowing power or solar savings run in the visitor’s browser.
- Reviews are pulled from your Google Business Profile.
Because each service is separate, a problem in one can’t take down your whole site. See some of these in action on what we can build.
When WordPress still makes sense
We’d rather be fair about it. WordPress can suit large publishing sites with editors posting several times a day, membership sites built around specific WordPress plugins, and organisations with an in-house developer to maintain it.
That isn’t most tradies, brokers or small service businesses. For them, a website needs to look professional, load fast, rank well and bring in enquiries, without becoming another thing to manage.
Moving off WordPress
If you’re on WordPress now, switching is straightforward. We rebuild your site as a static website, keep the page addresses that rank, redirect anything that moves and point your domain at the new site. Your email isn’t touched. See website redesign for the details, or read more about static websites and how we secure every site.
Start your brief and see your new site, with no WordPress in sight, before you pay a cent.