A CMS or no CMS
on your website?

Two different philosophies

With an CMS site runs software on the server that assembles pages: a database, an admin log-in, themes and often dozens of plug-ins. That gives power and convenience, but also structural maintenance: every link in that chain can need security updates.

With an static HTML site the live site consists of fixed files (HTML, CSS, images). There is no CMS that you have to update to “stay secure” in the same sense as with WordPress or Joomla. Hosting and any custom scripts do remain relevant; the largest part of the classic CMS attack surface disappears.

Vulnerabilities: what do the figures say?

Public databases and security overviews count reports — not automatically “hacked sites”. Even so, a clear pattern emerges: the larger the ecosystem and the more extensions, the more known vulnerabilities are added each year that you have to track and mitigate with updates.

• WordPress ecosystem (2024): 7,966 new vulnerabilities in the core, themes and plug-ins combined — an increase of 34 % compared with 2023. 97 % of those are in plug-ins, 3 % in themes and only 0,2 % in the WordPress core itself.
• Joomla ecosystem (2024): approximately 43 new CVEs across the Joomla core and common extensions combined. Far fewer in absolute terms, partly because the Joomla Extensions Directory (~5,700 extensions) is also roughly 10× smaller than the WordPress plug-in repository (~59,000). Updates are still needed.
• For reference: within those ecosystems the core itself is actually very small. In 2024 the WordPress core had around 13 CVEs, the Joomla core around 15. The vast majority of the risk therefore lies in plug-ins/extensions and themes.
• Static HTML: no CMS layer, so 0 CMS or plug-in CVEs to keep track of. The server, TLS and any form or analytics code do still need attention — just as with any other site.

Sources. WordPress ecosystem: Patchstack, State of WordPress Security in 2024. Joomla ecosystem (rolling 365 days, tag “Joomla”): CVE Daily; Joomla core specifically: Joomla Security Centre. Size of the extension market: Joomla Extensions Directory and a WordPress Plugin Directory. Counting methods differ per source; use the chart below as an order of magnitude, not as an exact prediction for one specific site.

Benefits of a pure HTML website

• Fewer moving partsNo CMS core, theme stack or plug-in chain to keep running.
• No mandatory CMS maintenance feePay for hosting and for changes whenever you need them (see also website without maintenance costs).
• Top performanceThe server delivers static files; ideal for Core Web Vitals and modest hosting.
• A smaller attack vectorNo /wp-admin or Joomla backend that looks the same on every installation by default.
• Predictable costsA lower entry price for custom work (with us from € 399,-).
• More sustainable per visitLess server work per page; see CMS vs. HTML sustainability.
• No supplier lock-inUniversal technology that virtually any web builder can take over, so you are not tied to one supplier or platform.

When is a CMS the better choice?

Choose a CMS if you want to publish frequently yourself , have many authors, need complex permissions, or want to standardise integrations with other systems via the CMS. WordPress and a Joomla are then a powerful foundation — provided you take the maintenance seriously or outsource it.

In summary

HTML wins on simplicity, speed and predictable ongoing costs for typical presentation sites — often exactly the reason to choose a website without WordPress. CMS wins on autonomy and scalable management. The answer to “a CMS or not?” is therefore: it depends on how you work — and we will help you weigh that up honestly.

Does the choice come out at “no CMS” for you while a CMS site is already running? Then the choice is not irreversible and you do not have to start over either. At Converting a CMS website to HTML you can read how such a conversion works, what you gain in security and speed and what you give up for it.

Get in touch All web design options