A focused review of your current site and Cloudflare setup, with a short, practical list of improvements. Ideal if you know things are messy but do not know where to start.
Knowledge hub
Static websites vs WordPress, a practical comparison
You do not need a holy war about tools. You need to know what fits your organisation, your staff, and your risk. This page explains the real differences between a static site and WordPress so you can make an informed choice and plan your next steps.
I work with both setups in the wild. I see what goes wrong when sites are left to drift, and what works when foundations are tidy. This is not about selling you a shiny rebuild. It is about putting you on a stable footing, whether you stay on WordPress, move to a static build, or run a sensible mix.
If you decide to stay on WordPress, there are still small fixes that make a big difference. For example, there is a free 18+ age gate snippet for WordPress in this knowledge hub that adds a clear boundary around adult or sensitive topics without installing another heavy plugin.
Plain English
Security aware
Evidence based
How static sites and WordPress work in practice
Static site in simple terms
A static site is made of plain files that live on a server or on a content delivery network. There is no ongoing application running in the background. When someone visits your site, their browser is simply given the files that already exist.
That makes static sites predictable. There is less to break, fewer moving parts to patch, and less room for an attacker to play with your login pages or plugins. With Cloudflare in front, most requests never touch the origin server at all.
WordPress in simple terms
WordPress is a content management system. When someone visits your site, the server runs PHP code, talks to a database, pulls in your theme and plugins, then builds the page on the fly. It is powerful and flexible, but the moving parts need more care.
This is ideal when you have a lot of content editors, complex publishing workflows, or interactive features that would be awkward to handle in a static build. It just comes with more responsibility around updates, access control, and backups.
Side by side comparison
Every organisation is different, but there are common patterns that come up again and again. The table below captures the main trade offs when I review real sites for clients.
| Factor | Static site | WordPress |
|---|---|---|
| Speed | Very fast by default. Files are served directly, often from a content delivery network. Easy to keep quick for years. | Can be fast if tuned well, but often slowed down by heavy themes, plugins, and shared hosting. |
| Security | Small attack surface. No login page on the public site. With Cloudflare and sensible firewall rules, probes are easier to contain. | Larger attack surface. Login page, admin area, plugins, and themes all need patching. Safe if managed well, risky if ignored. |
| Editing content | Changes are usually made through a developer or a simple editing process. Less flexible on the fly, but edits are deliberate and documented. | Non technical staff can log in and change pages, posts, and menus. Good when you have a clear content owner and governance. |
| Maintenance | Low maintenance. Once deployed, there are no core updates to apply. Most work is around content and small improvements. | Ongoing maintenance. Core, theme, and plugins all need updates. Needs monitoring and a safe process for changes. |
| Features and plugins | Many features can be handled at the edge with Cloudflare or through simple forms and embeds. Some very dynamic ideas may require extra services. | Large plugin ecosystem. Useful, but easy to overload a site or introduce weak spots if there is no clear owner. |
| Logging and evidence | Straightforward logs from your hosting, Cloudflare, and any analytics you choose. Easier to create evidence grade records of access and changes. | Logs can be rich, but are often not configured. If an incident happens, it is common to find there is limited history or no clear record of changes. |
| Costs | Often cheaper over time. Simpler hosting, fewer licences, and less time spent firefighting. Upfront build can be an investment. | Can be affordable, but costs rise when you need ongoing maintenance, plugin licences, and cleanup work after something breaks. |
When WordPress is the better fit
WordPress suits you if
- You have several staff who are expected to publish content regularly.
- You run a blog, news section, or resource library with frequent updates.
- You rely on specific plugins for forms, bookings, memberships, or events.
- You already pay a trusted person or team to maintain WordPress properly.
What I usually do in that case
I do not push a static rebuild just for the sake of it. Instead, I focus on:
- Hardened Cloudflare rules around your WordPress installation.
- Basic clean up of plugins, themes, and user accounts.
- Backups, updates, and logging that you can point to later.
- A light 18+ age gate pattern if your content covers adult or sensitive topics.
- Clear notes so you are not stuck with a single supplier.
You keep the flexibility of WordPress with less risk. If a static rebuild ever makes sense, it is done on your timetable, not as a panic move.
When a static site is the better fit
Static suits you if
- Your site is mostly informational, with a clear set of key pages.
- Content changes are important, but not daily.
- You care about uptime, speed, and security more than endless widgets.
- You would rather send edits to a trusted person than manage a dashboard.
What I usually put in place
- A clean static build, tuned for speed and clarity.
- Cloudflare in front for protection, caching, and logging.
- Plain English notes on how content changes happen in future.
- Evidence grade logging where it genuinely helps you answer questions from boards, funders, or regulators.
The aim is a site that feels boring in a good way. It is there when people need it, it loads quickly, and it does not demand constant attention.
If you already have a WordPress site
Many organisations come to me with a WordPress site that sort of works, but feels fragile. They might be worried about security, confused by updates, or unsure who owns the hosting. We do not start by tearing anything down.
1
Map what you already have
I check your domain, hosting, WordPress version, plugins, and Cloudflare configuration if it exists. You get a short written summary in normal language, not a wall of jargon.
2
Stabilise the current site
Basic fixes come first. That can include backups, access control, updates, and Cloudflare firewall rules. The goal is to reduce risk before you consider any rebuild.
3
Agree a future path
Sometimes the best option is a well managed WordPress site. Sometimes a static build makes more sense. Sometimes a mix of both. We choose the path that matches your risk, budget, and capacity.
Related support from Ki-Ki
-
Website and Cloudflare tidy up
-
Evidence grade logging
Logging and simple dashboards that help you answer questions from boards, funders, or regulators about traffic, incidents, and changes over time.
-
Accessible pricing
Flat monthly rates tuned to your size, with options for food banks and community projects that genuinely cannot stretch to standard pricing.
-
Free 18+ age gate snippet for WordPress
Drop in PHP function for WordPress that adds a full screen 18 plus notice without a heavy plugin. Written with accessibility, Cloudflare caching, and privacy in mind.
Common questions about static vs WordPress
Do I have to rebuild everything to move from WordPress to a static site?
Not usually. A lot of the time your existing content can be carried over and reshaped into a static build. The larger question is which pages actually earn their keep. I help you plan a sensible structure, rather than cloning every old page for the sake of it.
Can I keep WordPress for blogging and have a static front page?
Yes. Some organisations use a static site for the public facing core pages, with a separate WordPress instance for news or resources. With Cloudflare in front and clear navigation, visitors get a fast home page and you still keep a familiar editor for posts.
Will a static site break my contact forms or donations?
No, but the way they work will be different. Forms and donations on a static site usually rely on trusted external services or serverless functions, not heavy plugins. The key is to pick providers that respect privacy and give you enough logging to answer questions later.
Is WordPress unsafe by default?
No. WordPress powers a large part of the web. It is not unsafe on its own. Problems tend to appear when nobody owns updates, plugins are installed without review, or hosting is neglected. A well managed WordPress site is fine. An unmanaged one can become a risk.
Can you look at my current site and tell me what you would do?
Yes. A short foundations review is often the best first step. I look at your domain, hosting, site, and any Cloudflare configuration, then send you a short written summary with suggested next steps. You can decide what to act on and when.