Static websites with Hugo and Astro: secure, low-cost and quick to load
A static website is built once into plain HTML, CSS and images, then served as files. With no database and no application code running when a visitor arrives, there is far less on the live site to attack or keep updated, the server answers with a ready-made page, and the site runs comfortably on the smallest hosting plan. Hugo and Astro are the two open-source tools we recommend for building one. A static site suits brochure sites, portfolios, documentation and blogs that change a few times a week rather than every minute; on Noiz it runs on a Legacy plan, uploaded over FTPS.
How a static site differs
A dynamic site, such as a standard WordPress install, builds each page when a visitor asks for it. PHP runs, the database is queried, plugins run, and the page is assembled and sent.
A static site does that work in advance. A site generator turns your content and templates into finished pages on your own computer or a build server. You upload the result, and the web server sends the right file.
Why it is more secure
The Open Worldwide Application Security Project (OWASP) describes a site's attack surface as every path for data and commands into and out of the application, and advises removing code and features you do not use. A built static site removes most of that from the live server:
- no login page on the public site
- no plugins running for each visitor
- no database to inject into or steal from
- no server-side code to patch every week
A real example: when a serious flaw was found in the Next.js web framework in March 2025, the UK's National Cyber Security Centre noted that applications deployed as static exports were not affected.
A static site is not immune. Your hosting account and FTP password still need protecting, and any third-party scripts you embed still run in visitors' browsers. But there is much less to go wrong.
Why it loads quickly
Google measures how long a visitor waits for the first byte of a page, and how long until the main content appears. On a static site, the server's part of that wait is as short as it gets: it reads a file and sends it, with nothing to build first. Astro adds to this by sending JavaScript only for the parts of a page that need it.
Why it costs less to host
A static site needs disk space and a web server, not processing power. It runs on the entry Legacy plan with room to spare, and it keeps working well when a post is shared widely and traffic jumps, because each visit costs the server very little.
Hugo
Hugo is a static site generator written in Go and released under the Apache 2.0 licence. It installs as a single program on Linux, macOS or Windows, and by its own account builds a complete site "in seconds, often less". Its built-in asset pipeline processes images, bundles JavaScript, compiles Sass and minifies the output.
Hugo writes the finished site into a folder called public, and that folder is what you upload.
Astro
Astro is an open-source web framework under the MIT licence. Its default output is a completely static site. Its islands approach renders most of a page to plain HTML and adds small pieces of JavaScript only where a page needs interaction, such as a search box or an image carousel. Content collections let you keep posts as Markdown files with checked structure.
Astro builds into a dist folder, which you upload the same way.
A content editor for Astro: EmDash
Editing files suits developers more than marketing teams. EmDash, an open-source content management system (MIT licence) built on Astro and released as version 1.0 by Cloudflare in September 2026, gives an Astro site an editing screen, with plugins that run in a sandbox and get only the permissions they declare.
EmDash runs as an application on a Node.js server, with the pages and the editor in one deployment, so it needs more than static hosting. It runs on a Noiz Cloud server, a self-managed virtual server with full root access over SSH, for anyone who wants an Astro site with an editor.
What a static site needs help with
Some features need something on a server. Each has an open-source answer:
| Feature | Open-source approach |
|---|---|
| Site search | Pagefind (MIT licence) indexes the built pages and searches them in the browser, with no server |
| Comments | Self-hosted comment servers such as Isso or Remark42 (both MIT licence) |
| Contact forms | A short form handler on the same hosting plan, which runs PHP |
Publishing it on Noiz
- On Legacy, build the site on your computer and upload the
publicordistfolder over FTPS or through the Plesk file manager. Hugo's own guide recommends an encrypted connection rather than plain FTP, and building with a clean output folder so old files do not linger. - On Premium, you also have SSH access to your own hosting account, so you can copy the built folder across with Rsync instead.
- With EmDash, run the Astro site and its editor on a Cloud server.
AI assistants are good at writing static sites, too. Ask one for plain HTML and CSS, or for a Hugo or Astro project, and publish the result the same way.
Ask us about a static site
Static sites run on every Noiz shared plan; compare them on the shared hosting page. If you would like help with a static site, or with Astro and EmDash on a Cloud server, get in touch.
Sources
Checked 19 October 2026.
Hugo
Astro and EmDash
- Astro: configuration reference, output
- Astro: islands architecture
- Astro: content collections
- Astro: deploy your site
- Cloudflare blog: EmDash 1.0
- EmDash: architecture
Security
Tools
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
