A static website CMS, explained honestly

What a static website CMS is, and what CMS MESH does

A static website CMS publishes finished files instead of building each page when a visitor asks for it. CMS MESH is the one we built and use. Pages are plain HTML files, edited by hand by our team, with no database and no plugins to update on the server. A Media Express staff member checks every page before it goes live. We call it a new-generation manual CMS because people write and verify each page, and the output is nothing more exotic than HTML, CSS and images.

What "static" means technically. MDN defines a static site as one that returns the same hardcoded content whenever a particular resource is requested, so every visitor gets the same file. A dynamic site generates content from the request and from data, typically by fetching records from a database and inserting them into an HTML template. MDN also lists real advantages of the dynamic approach: data in a database is easy to extend, change and search, and one template change updates every page that uses it. Static is a trade, not a verdict.^[13]

• Plain HTML files

  For a page view the server sends a stored file. No database query and no plugin runs.

• Checked by a person

  The Build date on a page is the date of its last manual QC, and it changes only after that review.

• Structured for machines

  JSON-LD structured data, a sitemap, robots.txt rules, llms.txt and a change-notification key file ship with the site.

• Small server surface

  Fewer moving parts to patch, and security headers set at the server instead of in a plugin.

What it is not. It is not an open-source product or a template marketplace. Our public explainer on mediaexpress.us describes CMS MESH as a proprietary system maintained by Media Express LLC, and says its tools and QC methods are not licensed to other agencies. The 5.1 in the name is an era number for the whole system. The Build date identifies the last manual QC of each individual page.

How editing, building and publishing work

1. Write the pages

   Our team writes each page as HTML with its title, description, canonical link and structured data. AI helps us draft, test and audit faster. A person decides what the page says.

2. Build and scripted checks

   A build step assembles the files, and our build and QC scripts stop on problems such as dead internal links, images loaded from another domain, duplicate titles or a sitemap that does not match the pages.

3. Manual QC and Build date

   A staff member reviews the page against our checklist. The Build date changes only after that review, and nothing is published without a person signing off.

4. Publish and notify

   Plain files are uploaded to the host, the sitemap date of the changed pages is updated, and changed addresses go to search engines through IndexNow, Bing Webmaster Tools and Google Search Console.

What the quality check covers. Our public explainer lists these checks: validity of the HTML and CSS against W3C standards, schema.org markup reviewed by a person, canonical and hreflang tags, security headers, social preview images of 1200 by 630 pixels, internal links, a review against a list of phrases we do not use (such as ranking promises) and the integrity of the links in llms.txt. It also lists Core Web Vitals measured before deployment. We do not publish the internal scripts, and where a check is automated a person still signs off.

What the AI does and what a person approves. We use AI models to draft text, run tests and audit pages, the same way we run our own operations. A person approves every change that goes live, and the Build date is set by a human sign-off, not by a tool. See how we run AI agents for the guardrails we use.

Speed: what static pages change and what they do not

Time to First Byte (TTFB) is the time between starting navigation and the first byte of the response arriving. web.dev describes it as the sum of redirect time, DNS lookup, connection and TLS negotiation, and the request itself, and suggests most sites aim for 0.8 seconds or less at the 75th percentile of visits. It calls that a rough guide and notes that TTFB is not a Core Web Vital. For a static page the server's share is small, because answering means sending a stored file.^[9],[13]

web.dev gives the good Core Web Vitals thresholds as Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less and Cumulative Layout Shift of 0.1 or less, assessed at the 75th percentile of page loads, segmented across mobile and desktop. Largest Contentful Paint reports the render time of the largest image, text block or video visible in the viewport. A static page does not make a large hero image small, a web font quick or a chat widget light. Those still decide the score.^[10],[11]

Stored files also cache well. MDN explains that an HTTP cache stores a response and reuses it, so a nearer cache can answer without the origin server processing the request, and that static files whose contents never change work best. HTML cannot be renamed on every change, so MDN suggests no-cache (revalidate before reuse) for it. Our sites follow that pattern: images, fonts, stylesheets and scripts carry a max-age of 2,592,000 seconds (30 days), HTML, XML and text files such as the sitemap and llms.txt carry 600 seconds, and text is compressed.^[12]

Do not read "static" as "WordPress is slow". The HTTP Archive 2025 Web Almanac CMS chapter says WordPress performance variance is driven more by configuration than by core limitations, while its Figure 12.8 text puts WordPress among the lowest ranked on mobile Core Web Vitals with a pass rate of 45%. The chapter has no static-site category, so it cannot tell you how static pages compare. Google's own page says good Core Web Vitals align with what its core ranking systems seek to reward, and recommends them. It stops short of promising a ranking.^[23],[29]

Security surface and the rules that apply

The OWASP Top 10:2025 is a standard awareness document for developers and web application security, and injection is A05 in that edition. OWASP describes an application as vulnerable when user-supplied data is not validated, filtered or sanitized, or when dynamic queries are used directly in an interpreter. A static page view runs no query on the server, so there is no database query for an attacker's input to alter. That removes one class of risk for page views. It does not remove it for a form handler or any other code you add.^[15],[16]

OWASP's A03, Software Supply Chain Failures, covers not tracking the versions of the components you use, running unsupported or out-of-date software and not scanning for vulnerabilities regularly, and advises removing unused dependencies and unnecessary features. A WordPress site has a lot to track. WordPress.org asks for PHP 8.3 or greater and MariaDB 10.11 or greater or MySQL 8.0 or greater, and its hardening guide tells owners to keep WordPress and plugins up to date and to delete plugins they do not use, adding that once a fix ships the information needed to exploit the flaw is almost certainly public. A static site has no CMS runtime, database or plugins on the server to patch. It still has a web server, a hosting account and TLS to keep current.^{[17],[19],[20]}

Headers are the other half of the server surface. OWASP's A02, Security Misconfiguration, includes a server that does not send security headers or sends them with weak values. Our sites set them at the server. On 2026-10-13 a service page of a site built on CMS MESH sent a Content Security Policy that starts from default-src 'none' and allows scripts and styles only from its own origin and from hash-listed inline blocks, plus the Google tag script for analytics. It also sent X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a referrer policy, a permissions policy and an HSTS policy of 31,536,000 seconds (one year). MDN describes CSP as mainly a defense against cross-site scripting that protects a site even if sanitization fails, to be set in addition to sanitizing input.^[14],[18]

Why it matters beyond the damage itself: Google's spam policies define hacked content as content placed on a site without permission because of vulnerabilities in the site's security, and say it gives poor search results to users and can install malicious content on their machines.^[31]

• Illinois Personal Information Protection Act (815 ILCS 530). Section 45 requires a data collector that owns, licenses, maintains or stores records containing personal information about an Illinois resident to implement and maintain reasonable security measures against unauthorized access, acquisition, destruction, use, modification or disclosure, and a contract disclosing that information must require the recipient to do the same. The Act says a data collector may include privately held corporations. "Personal information" means a name combined with specified data elements such as a Social Security number, driver's license number, account or card number, medical information, health insurance information or unique biometric data, so whether a form is covered depends on what it collects. Ask your web vendor how form data is protected.^[33]
• FTC guidance for small business security. The FTC's guide Start with Security (August 2023) has ten lessons, including "Update and patch third-party software" and "Make sure your service providers implement reasonable security measures". It states that outdated software undermines security and advises applying updates as they are issued.^[32]

What an AI ready website honestly means

Start with what the largest search engine says. Google's page on AI features and your website states that there are no additional requirements to appear in AI Overviews or AI Mode, that you do not need to create new machine readable files, AI text files or markup for those features, and that there is no special schema.org structured data to add. A page still has to be indexed and eligible to be shown in Search with a snippet, and indexing is not assured. An AI ready website is therefore mostly a well-built, crawlable and accurate website. The extras below are cheap hygiene for other tools, not a route to a citation.^[2]

Sources: ^{[1],[2],[3],[4],[5],[6],[7],[8],[25],[26],[30]}

AI crawlers come in separate kinds. OpenAI documents OAI-SearchBot (surfaces sites in ChatGPT search), GPTBot (disallowing it signals that content should not be used for training) and ChatGPT-User (user-initiated visits, where robots.txt rules may not apply), and says a robots.txt change can take about 24 hours to be reflected for search. Anthropic documents ClaudeBot for training data, Claude-User for answering user questions and Claude-SearchBot for search quality, and says they honor robots.txt directives. You can allow search access and still decline training. That is your decision, and we write it into robots.txt once you have made it.^[27],[28]

Static website vs WordPress: a plain comparison

WordPress is the default choice for a reason. The HTTP Archive's 2025 Web Almanac reports that CMS-driven sites account for over 54% of observed websites and that WordPress powers roughly 64% of CMS-driven sites. That means plenty of plugins, hosts and people who know it. The table sets that against what a static site on CMS MESH does differently. The WordPress column comes from WordPress.org, MDN and the HTTP Archive. The CMS MESH column is our own statements.^[23]

Sources: ^{[13],[19],[20],[21],[22],[23]}

No row wins on its own. If the third row matters most to you, WordPress or a similar CMS probably fits better. If the first two rows matter most and your pages change by request, static fits. A WordPress site that is lean, current and well cached can perform well, and our WordPress cleanup and speed page is for exactly that case.

How a static site connects to your other tools

Static pages cannot run your business logic, but they can hand off to services that do. Each outside script must be named in the Content Security Policy, which is a useful discipline: MDN describes the policy as controlling which resources, in particular JavaScript, a document may load. Payment providers offer hosted pages too. Stripe documents payment links that you share by link or add to a website as a buy button on a Stripe-hosted page.^[14],[34]

• Forms and email: a handler with spam protection sends each request to the mailbox you choose.
• Analytics: a tag such as Google Analytics, named in the security policy.
• Calendars, chat, maps and video: embedded widgets, each adding third-party code and one line in the policy.
• CRM, accounting and e-commerce systems: usually connected through a form or a webhook handled by a small service. Larger integrations are conventional software and are covered on our custom apps and integrations page.
• Payments: hosted payment links or buy buttons for a handful of products.

When you should NOT choose CMS MESH

We build both kinds of site, and we say so on the first call. Choose something else in these cases:

• Many people publish every day. A news desk, a large blog or a team that edits pages daily needs an admin screen. Dynamic systems are built for that, and MDN notes that with templates and a database one change updates every page that uses it.^[13]
• A store with stock levels, carts, shipping and tax. A hosted payment link or buy button works for a few products. A catalog with inventory needs a shop platform.^[34]
• Member areas, accounts, comments or forums. These need an application that responds to each visitor, which is the dynamic model MDN describes, not stored files.^[13]
• Features that depend on a specific plugin. If your plan rests on a WordPress plugin, such as a course platform or a booking tool, a static rebuild means replacing it with an embed or a custom service. WordPress.org describes its plugin directory as the largest directory of free and open source WordPress plugins, and a static site has no equivalent.^[21]
• You want any agency to be able to edit the site. The HTML is portable, but the authoring toolchain is proprietary and not licensed to other agencies, so ongoing edits come from us or from someone comfortable editing HTML.
• You hope speed will fix weak content. A static site delivers pages efficiently. It does not make an unclear offer or thin copy any better.

Moving from WordPress or another CMS, and how a project runs

Google's guidance for moving a site with URL changes is the backbone of a migration. Map every old URL to its new URL, set up server-side permanent redirects (301 or 308) straight to the final destination, move a section first if the site is large, update the sitemap in Search Console, and keep the redirects for as long as possible, generally at least one year. Google also says to expect temporary fluctuation in rankings during the move, so no one can promise that rankings will hold.^[24]

1. Request

   You describe the site, the goal and the pages that matter. We set up a short call.

2. Short call and written scope

   We ask about goals, tools and limits, and say honestly whether CMS MESH or something else fits. The estimate is free and we work with every budget. Goal, pages, tools, approvals, success measure and cost go into a written scope before any work starts.

3. Inventory and URL map

   We list every address, form and function the old site has. On WordPress, the export screen produces a WXR XML file with posts, pages, comments, custom fields, categories, tags and users, which helps the inventory. Each old address gets a new one.

4. Rebuild and manual QC

   Pages are rebuilt as static HTML with structured data, a sitemap, robots.txt, llms.txt and security headers, then checked by a person. The old site stays backed up.

5. Launch and notify

   Redirects go live, the sitemap is updated, and changed addresses go to search engines through IndexNow, Bing Webmaster Tools and Google Search Console.

What to prepare:

• Access to the domain registrar and DNS, and to the current host.
• The pages that bring calls and leads, from your own analytics.
• The forms on the site, where their messages go and any plugin functions you rely on.
• Logos, photos and text you have the right to use.
• The person who approves content, and your decision on who edits after launch.
• Any contract or policy that limits where customer data may be stored.

If your WordPress site only needs repair or speed work, a rebuild is not required: see WordPress cleanup and speed. If you are starting from nothing, our web design page covers a new build. Media Express LLC has worked in digital since April 1995 from Mount Prospect, Illinois, with 2,500+ digital projects delivered and 100+ web properties kept running and monitored by our own team of AI agents (Claude, ChatGPT, Gemini and open-source runtimes). We support clients in English and Polish. Call 773-800-1520, Monday to Friday 9 to 5 and Saturday 10 to 2 Central.

Questions answered

Sources

1. Introduction to structured data markup in Google Search (Google Search Central), accessed 2026-10-13. JSON-LD recommended; structured data can enable richer results, not a promise; fewer but complete properties.https://developers.google.com/search/docs/appearance/structured-data/intro-structured-data
2. AI features and your website (Google Search Central), accessed 2026-10-13. No additional requirements, no new machine readable or AI text files, no special schema for AI Overviews and AI Mode; indexing and snippet eligibility.https://developers.google.com/search/docs/appearance/ai-features
3. Sitemaps XML format (sitemaps.org protocol) (sitemaps.org), accessed 2026-10-13. Required and optional tags, 50,000 URL and 50MB limits, location rule, robots.txt reference.https://www.sitemaps.org/protocol.html
4. Build and submit a sitemap (Google Search Central), accessed 2026-10-13. Google ignores priority and changefreq and uses lastmod only if consistently and verifiably accurate; limits; absolute URLs.https://developers.google.com/search/docs/crawling-indexing/sitemaps/build-sitemap
5. Learn about sitemaps (overview) (Google Search Central), accessed 2026-10-13. When a sitemap may not be needed (about 500 pages or fewer, comprehensively linked) and that a sitemap does not ensure crawling or indexing.https://developers.google.com/search/docs/crawling-indexing/sitemaps/overview
6. The /llms.txt file (llmstxt.org (Jeremy Howard)), accessed 2026-10-13. Proposal date, file location and format, status as a proposal.https://llmstxt.org/
7. IndexNow documentation (IndexNow), accessed 2026-10-13. Key file at the site root, GET and POST submission, up to 10,000 URLs per post, sharing among participating engines.https://www.indexnow.org/documentation
8. IndexNow: the instant way to inform search engines (IndexNow), accessed 2026-10-13. Participating search engines named on the home page; no mention of Google.https://www.indexnow.org/
9. Time to First Byte (TTFB) (web.dev (Google)), accessed 2026-10-13. Definition, components, 0.8 second rough guide at the 75th percentile, not a Core Web Vital.https://web.dev/articles/ttfb
10. Web Vitals (web.dev (Google)), accessed 2026-10-13. Core Web Vitals good thresholds and the 75th percentile assessment.https://web.dev/articles/vitals
11. Largest Contentful Paint (LCP) (web.dev (Google)), accessed 2026-10-13. What LCP measures and which elements count.https://web.dev/articles/lcp
12. HTTP caching (MDN Web Docs), accessed 2026-10-13. Cache reuse, static immutable files, HTML cannot be cache busted, no-cache for HTML.https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Caching
13. Client-Server overview (static and dynamic sites) (MDN Web Docs), accessed 2026-10-13. Definitions of static and dynamic sites and the stated advantages of dynamic sites.https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Server-side/First_steps/Client-Server_overview
14. Content Security Policy (CSP) (MDN Web Docs), accessed 2026-10-13. What CSP does, XSS defense in depth, set in addition to sanitizing.https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
15. OWASP Top 10:2025 (OWASP Foundation), accessed 2026-10-13. The 2025 category list and the description of the Top 10 as an awareness document.https://top10.owasp.org/2025
16. OWASP Top 10:2025 A05 Injection (OWASP Foundation), accessed 2026-10-13. When an application is vulnerable to injection and the preferred prevention.https://top10.owasp.org/2025/A05_2025-Injection/
17. OWASP Top 10:2025 A03 Software Supply Chain Failures (OWASP Foundation), accessed 2026-10-13. Tracking components, out-of-date software, scanning, removing unused dependencies.https://top10.owasp.org/2025/A03_2025-Software_Supply_Chain_Failures/
18. OWASP Top 10:2025 A02 Security Misconfiguration (OWASP Foundation), accessed 2026-10-13. Missing security headers and unnecessary features as misconfiguration.https://top10.owasp.org/2025/A02_2025-Security_Misconfiguration/
19. Requirements (WordPress.org) (WordPress.org), accessed 2026-10-13. PHP 8.3 or greater, MariaDB 10.11 or greater or MySQL 8.0 or greater.https://wordpress.org/about/requirements/
20. Hardening WordPress (WordPress Developer Resources), accessed 2026-10-13. Keep WordPress and plugins updated, delete unused plugins, exploit information public once a fix ships.https://developer.wordpress.org/advanced-administration/security/hardening/
21. WordPress Plugin Directory (WordPress.org), accessed 2026-10-13. Directory described as the largest directory of free and open source WordPress plugins.https://wordpress.org/plugins/
22. Tools Export screen (WordPress.org Documentation), accessed 2026-10-13. WXR export contents: posts, pages, comments, custom fields, categories, tags, users.https://wordpress.org/documentation/article/tools-export-screen/
23. Web Almanac 2025: CMS chapter (HTTP Archive), accessed 2026-10-13. CMS and WordPress share, WordPress mobile Core Web Vitals pass rate, performance variance and configuration.https://almanac.httparchive.org/en/2025/cms
24. How to move a site with URL changes (Google Search Central), accessed 2026-10-13. URL mapping, server-side permanent redirects, keeping redirects at least one year, expected ranking fluctuation.https://developers.google.com/search/docs/crawling-indexing/site-move-with-url-changes
25. RFC 9309: Robots Exclusion Protocol (IETF (RFC Editor)), accessed 2026-10-13. Location in the top-level path as /robots.txt and the statement that the rules are not access authorization.https://www.rfc-editor.org/rfc/rfc9309
26. Schema.org (Schema.org), accessed 2026-10-13. Mission, founders (Google, Microsoft, Yahoo, Yandex) and supported formats.https://schema.org/
27. Overview of OpenAI crawlers (OpenAI), accessed 2026-10-13. OAI-SearchBot, GPTBot and ChatGPT-User purposes, robots.txt control and about 24 hours for changes.https://developers.openai.com/api/docs/bots
28. Does Anthropic crawl data from the web, and how can site owners block the crawler? (Anthropic), accessed 2026-10-13. ClaudeBot, Claude-User and Claude-SearchBot purposes and robots.txt compliance.https://support.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-site-owners-block-the-crawler
29. Understanding Core Web Vitals and Google search results (Google Search Central), accessed 2026-10-13. Good Core Web Vitals align with what ranking systems seek to reward; recommendation to achieve them.https://developers.google.com/search/docs/appearance/core-web-vitals
30. Understand JavaScript SEO basics (Google Search Central), accessed 2026-10-13. Server-side or pre-rendering is still a great idea; not all bots can run JavaScript.https://developers.google.com/search/docs/crawling-indexing/javascript/javascript-seo-basics
31. Spam policies for Google web search (Google Search Central), accessed 2026-10-13. Definition of hacked content.https://developers.google.com/search/docs/essentials/spam-policies
32. Start with Security: A Guide for Business (U.S. Federal Trade Commission), accessed 2026-10-13. The ten lessons, patching third-party software, service providers.https://www.ftc.gov/business-guidance/resources/start-security-guide-business
33. 815 ILCS 530: Personal Information Protection Act (Illinois General Assembly), accessed 2026-10-13. Sec. 45 reasonable security measures and contract provision; definitions of data collector and personal information.https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67
34. Payment Links (Stripe Documentation), accessed 2026-10-13. Hosted payment page, shareable link, embeddable buy button, no code.https://docs.stripe.com/payment-links

How we checked this page

Last verified 2026-10-13 · Media Express LLC

General information, not legal, financial or security advice. Rules and vendor terms change; check the cited source before you rely on a figure.

Related

• Custom web design in ChicagoWeb design
• WordPress speed optimization in ChicagoWordPress cleanup and speed
• SEO, AEO, GEO and AI SEO in ChicagoSEO, AEO and GEO
• Custom software development in ChicagoCustom apps and integrations
• Is your company ready for AI agents ?Free self-check