Static means the page is finished before anybody asks for it. Everything else follows from that one property.
The one distinction
Dynamic. A visitor arrives, the server runs code, queries a database, assembles a page and sends it. Different visitors can get different pages.
Static. A visitor arrives, the server sends the file. Everybody gets the same page until you change it.
That is the whole difference. It is not about how often the content changes, which is the usual misunderstanding.
| Static | Dynamic | |
|---|---|---|
| Page built | Before the visit | During it |
| Same for everyone | Yes | Not necessarily |
| Database needed | No | Usually |
| Attack surface | Very small | Substantial |
| Hosting cost | Often nothing | Ongoing |
| Speed | The file is already there | Depends on the work |
Why it wins where it fits
Speed. Nothing has to happen. The file exists and can be stored close to the visitor in advance, so pages arrive quickly regardless of where they are.
Safety. No database to inject, no runtime to exploit, no administration login to guess. The great majority of website security advice concerns machinery a static site does not have.
Cost. Serving files is cheap enough that several providers do it free at small-business volume.
Durability. A static site left alone keeps working. A dynamic one accumulates security updates and eventually breaks in a way that needs somebody who understands it.
What it can still do
A blog. Pages are generated from source when you publish, so every post is a ready file. This is how most documentation and a large share of blogs work.
Forms. The form posts to an outside service which mails you the submission. Standard practice, no server required, and there are many such services.
Search. For a site of a few hundred pages, an index built at publish time and searched in the browser is fast and needs nothing running.
Comments and analytics. Both are outside services embedded in the page.
When it is not enough
Accounts. Content that genuinely differs per visitor. Live stock that must be correct to the second. Anything requiring a secret that cannot appear in the page.
Those need a server. Everything else, brochures, portfolios, documentation, landing pages, most blogs, most small business sites, does not.
If this is near what you are doing, What people mean by a static site and How to build a static site cover the cases on either side.
Put it at an address
Check whether pages genuinely differ per visitor, generate everything before publishing, post forms to an outside service, host the files anywhere, and move the work to build time.