No Server, No Plugins, No Login to Steal: Why We Build Business Sites as Static Pages on Cloudflare

01 / 06

Why does a static site shut out most website attacks?

Because most attacks need something to run. Login guessing needs a login page, plugin exploits need plugins and injected code needs a server that builds pages on request. A static site has none of those at request time. Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins (Patchstack, 2026). A static site has no plugins to exploit.

This is the sixth guide in our series on hacked websites. The earlier guides covered a hidden plugin, doorway pages that fooled four checks, a link and a server that survived cleanups and what bots hunt for. Every one of those attacks needed something running on a server: a plugin, a login, a database, a page built on request.

A static site removes that. The pages are built once, ahead of time, into finished files. When a visitor arrives, the file is sent as it is. There is no WordPress to log into, no plugin to exploit and no database to inject into. The Jamstack community, a group that began at the hosting company Netlify, puts it this way: "Serving pages and assets as pre-generated files allows read-only hosting reducing attack vectors even further" (Jamstack, 2026).

The contrast with self-hosted WordPress is stark. Patchstack counted 11,334 new WordPress ecosystem vulnerabilities in 2025, 91% of them in plugins, and heavily targeted ones were first exploited after a weighted median of 5 hours (Patchstack, 2026). Five hours is faster than most small businesses update anything. The surest patch is having nothing there to patch.

Static does not mean "cannot be attacked". It means the attacks that hit the sites in this series have far less to grab. What remains is covered below.

02 / 06

What happened when a hacked WordPress site was rebuilt as a static site?

The attacks kept coming, and found nothing. In its first five days as a static site on Cloudflare, the plumbing company's website logged 1,588 requests for a WordPress login from 920 addresses, scans for plugin weaknesses and hunts for configuration files (First-party edge data, 2026). None of those things existed on the new site.

The plumbing company had been hacked repeatedly on WordPress, by the owner's account about three times a year for three years. We rebuilt it as a static site on Cloudflare, kept its real pages and phone numbers, answered its old spam pages as gone and put our edge in front.

The bots did not notice the change at first. In the first five days, 920 addresses requested the WordPress login page 1,588 times, and 84 of those requests tried to sign in. Scanners probed for known plugin weaknesses and upload folders. Someone checked whether the old casino spam pages were still up. A toolkit checked for a known backdoor from 9 different hosts.

Every one of those requests asked for something the new site did not have. On the old WordPress site, each would have reached a real login form, real plugins or a real server. The full numbers are in what our edge saw in five days.

We did the same with our own site. seoeliteagency.com was a WordPress and Elementor build of 502 addresses; we rebuilt it as a static site on Cloudflare Pages, keeping 374 pages, permanently redirecting 113 and removing 15 low-quality ones. Our page on Cloudflare web hosting covers that move.

03 / 06

What does Cloudflare add in front of a static site?

A global network, attack protection on every plan and a place for an edge to filter traffic. Cloudflare says its DDoS protection is "available on all plans" (Cloudflare DDoS Protection, 2026), its Free Managed Ruleset is "available on all Cloudflare plans" (Cloudflare Managed Rules, 2026) and on Pages, "requests to static assets are free and unlimited" (Cloudflare docs, 2026). The site sits on the same network that protects it.

On Cloudflare Pages, the finished files are uploaded to Cloudflare's network: "Pages uploads each file on your site to Cloudflare's globally distributed network" (Cloudflare Pages limits, 2026). Visitors get the copy nearest to them. There is no separate origin server to hide, because the network is the host.

Protection comes with it. Cloudflare lists DDoS protection as "available on all plans" (Cloudflare DDoS Protection, 2026). Its Free Managed Ruleset is "available on all Cloudflare plans" and "provides protection against high-impact and widely exploited vulnerabilities" (Cloudflare Managed Rules, 2026). Bot Fight Mode adds free bot filtering, with the limits we describe in our bot guide.

Cost is rarely the blocker. Cloudflare says "on both free and paid plans, requests to static assets are free and unlimited" (Cloudflare docs, 2026). A spike in traffic, real or bot, does not turn into a hosting bill for the static part of the site.

One update for anyone reading Cloudflare's documentation now: Cloudflare's Pages docs say "Start new projects with Workers", and Workers can serve static assets too (Cloudflare Pages docs, 2026). Either way, the model is the same: finished files served from Cloudflare's network.

04 / 06

Where does an edge layer fit on a static site?

In front of everything, filtering traffic before it reaches the site. Cloudflare's free tools are a strong base. A managed edge adds tuned rules, traps and reporting on top. RankShield, our founder's security company, describes its edge as "a managed filtering layer on Cloudflare's global network that sits in front of your whole site", at $39 a month on top of a RankShield plan.

A static site removes most of what attackers want to break into. It does not stop them asking. Bots still scrape content, fill in forms with spam, click ads and probe for weaknesses, and on a busy day those requests still cost you something in analytics noise, form spam or ad spend.

That is where an edge layer earns its place. It sees every request first, sorts real visitors and real search engines from bots, and sets traps no customer would trigger. On the plumbing site, it was the edge that recorded the 3,412 trap hits behind our bot guide.

RankShield runs that layer on Cloudflare. In its own words, it "runs on top of Cloudflare, filling the gaps its free tier leaves", and setup is usually one DNS record. It costs $39 a month, added on top of a RankShield plan; details are on the RankShield edge page. A disclosure, because it matters: RankShield is our founder's company. We tell every client that before they choose it, and it is an add-on, never a condition of working with us.

Any edge must be tested against Google. We learned that ourselves, and the story is in our bot guide.

05 / 06

What can still go wrong on a static site?

The accounts that publish it, any server code you add and the domain. A static site still has logins: the Cloudflare account, the code repository and the domain registrar. Forms and dynamic features need server code, such as Pages Functions or Workers, which brings back a small surface. Protect each with two-step login.

The accounts come first. On a static site, the pages are published from a code repository to Cloudflare. Whoever controls those accounts controls the site, so two-step login on both is not optional. The same goes for the domain registrar; our cleanup guide shows what happened when a plumbing company's domain settings were reset.

Server code comes second. Contact forms, search and other dynamic features need some code to run. Cloudflare Pages can run server-side code through Pages Functions (Cloudflare Pages docs, 2026). That code is small and specific, a far cry from a full content system with dozens of plugins, but it is code, and it needs care.

Fit comes third. A static site is a weaker fit for a business that depends on particular WordPress plugins, needs staff to edit pages daily without help or runs a store or member area. We say so on our Cloudflare hosting page and in our builder comparison, and we recommend the platform that fits the business.

06 / 06

Is a static site on Cloudflare the right move for your business?

For most service businesses, yes. If the site explains services, shows work and collects calls and form leads, a static site on Cloudflare does that faster and with far less to attack. If the business needs a store, member logins or daily self-editing, keep a platform built for that, and protect it well.

Use the five questions above to check the fit. The pattern from this series is clear: every site we had to clean up ran self-hosted WordPress, and every attack used something a static site does not have. For a plumber, a law firm, a gallery or a real estate brokerage, the website's job is to be found, load fast and turn visitors into calls. Static pages do all three.

Moving is a project, not a switch. Pages need to be rebuilt, old addresses redirected and forms reconnected. Our guide to what moving off WordPress actually changes walks through it, and our website design services page shows how we build.

If you want to know where your current site stands first, start with our free SEO audit.