A CMS to publish nothing: the real cost of the "editable" website

The conversation happened this week, between us and a partner preparing a quote. Their client, an industrial company, has a Drupal website. The site is old, HTTPS does not even work, and the question was: do we give it a facelift on Drupal, or move on? Then they opened the news page. Last post: 2016.

Ten years of CMS, ten years of updates, hosting and vulnerabilities to watch, for a frozen page. This is not an isolated case, it is almost the rule. Clients want a CMS “so they can edit things themselves”. They publish two or three articles in the first week, then everything is forgotten. The service pages never move at all.

The CMS, an insurance nobody claims

The reflex is understandable. Nobody wants to depend on a provider to fix a phone number. A CMS reassures: there is an “Edit” button, so you are free.

In practice, we always see the same curve at the companies we work with: a burst of activity at launch, a few news items, then silence. Service pages are written once and stay as they are for years. It is not laziness: a business website changes little, and that is normal. What is not normal is paying every day for a capability used twice a year.

What unused flexibility costs

A WordPress or Drupal site runs code on every visit. It queries a database, assembles the page, then sends it. That machinery has a price, paid even when nobody publishes anything.

Security. WordPress powers 39.6% of websites according to W3Techs, which makes it a profitable target. According to Patchstack, a vendor of WordPress security solutions, the ecosystem recorded 11,334 new vulnerabilities in 2025, 91% of them in plugins (Patchstack 2026 report). Patchstack sells protection, so read its figures as an order of magnitude, but the trend is not in dispute. And the foundation itself is not safe: in October 2026, PHP had to fix two critical flaws that allowed taking over a server, as we explain in the article on the October PHP vulnerability.

End of life. Drupal 7, which still runs many business websites, has had no official security fixes since 5 January 2025 (Drupal announcement). A site like the one in our example has no choice but to migrate, whatever the path.

Speed. On HTTP Archive field data, measured on real visitors, 48% of WordPress sites pass Google’s three thresholds on mobile, against 71% of Astro sites, in September 2026. These are two different populations, not a controlled experiment, and a well-built WordPress can be fast. But the gap says something: the less work the server does on each visit, the faster the page arrives. Details in our Astro or WordPress comparison.

Time. Updates to the core, plugins, theme and PHP, database backups, monitoring: that is a monthly maintenance budget, whether the site publishes or not.

The static site: editable, without the machinery

A static site is built at the moment you publish, then served as is by a delivery network. No database, no exposed admin panel, no plugin to patch. What an attacker cannot find, they cannot exploit.

The objection always comes: “So how do I edit my site?” This is where the paradigm has changed. Three ways exist today, all as simple as a CMS:

• In plain language. You write “replace the phone number in the footer” or “add a news item about our next trade show”, AI prepares the change, a preview appears, and one click puts it live. We describe how it works in the article on editing a website in natural language.
• With a headless editor. For a team that publishes often, an editor such as Sanity offers the same fields as a classic CMS, but it does not serve the pages: it feeds the site at publication time.
• In text files. For a blog, a single Markdown file per article, reviewed then published. The choice depends on how often you publish, as explained in our article on a blog in Markdown or in a CMS.

Every change keeps its history, and every mistake is undone in one click. That is more control than a CMS, not less.

Why now is the right time

AI changed the question. Yesterday, a static site needed a developer for every comma, and the CMS was the price of autonomy. Today, autonomy goes through conversation: anyone who can describe what they want can edit their site, without knowing the tool. A server running permanently “just in case” no longer makes sense for most business websites.

Beware of the opposite shortcut, though: AI does not build a solid website in one hour. It makes editing easy once the site is well built, which remains skilled work, as we tell in “I can do it in 1h with Astra in ultra code”.

A CMS remains the right choice in some cases: a newsroom publishing every day, several roles approving content, a shop with moving stock. For a showcase site that changes three times a year, it is paying for a race car to fetch the bread.

Where to start

Look at the date of your latest news item, and at how many times your service pages have changed in two years. If the answer fits on one hand, your site needs to be editable, not to run a CMS.

Our guide to migrating with Astro details the method. Our static site migration keeps all your addresses and your search rankings, sets up plain-language editing, and trains your team to use it. Your site becomes faster, safer, and you can finally forget about plugin updates.

Sources

1. W3Techs, WordPress market share, October 2026 (new tab)w3techs.com
2. Patchstack 2026 report (new tab)patchstack.com
3. Drupal 7 End of Life (new tab)drupal.org