Quick gut check: when did someone at your organization last log in and edit your website? If the answer is “over a year ago” — which it is for a lot of small-business sites — then you’re paying the full cost of a CMS (updates, security exposure, hosting, maintenance) for a benefit nobody is using.

What a CMS costs when nobody edits

A CMS is a login, a database, and a pile of code that must be patched forever — that’s the deal, and it’s a fine deal when editing is real. When it isn’t, the unused admin login is pure liability: most hacked small sites we see were compromised through CMS or plugin vulnerabilities on sites whose owners hadn’t logged in for years. They were carrying a motor through the woods on a trip where they never left the campsite.

The static alternative

A static site is just finished pages — no database, no login, no plugins. Changes go through a developer (or a simple content file), and in exchange: near-zero attack surface (nothing to log into is nothing to break into), hosting that costs almost nothing (ours runs this way — static files with a small worker for forms, and the hosting bill is pocket change), speed that no CMS matches without effort, and nothing to update monthly. For a site that changes a few times a year, “email your developer the change” costs less than twelve months of maintaining machinery you didn’t use.

The honest sort

You likely need the CMS if: several people edit, content changes weekly, there’s a real blog cadence, or the site has structured content with rules. You likely don’t if: it’s five to ten pages that change quarterly, one person “owns” the site, and every actual change goes through a developer anyway — which means you’re already living the static workflow, plus the CMS bills.

And if you have the CMS and it’s already gone unmaintained, this is worth raising at rescue time: sometimes the right rescue isn’t reviving the machinery — it’s admitting the site never needed it.