What is a static site?

A static site is a set of files — HTML, CSS, JavaScript, images, fonts — that a browser can render exactly as they're stored, with no server-side step in between. When someone requests a page, the file for that page is handed over as-is. Nothing runs to build it first.

What counts as a static site

Anything that ships as finished files rather than a running program. That includes:

• HTML — the pages themselves, one file per page, or one file that JavaScript updates in place
• CSS — how those pages look
• JavaScript — anything that runs in the visitor's own browser, including calls out to a third-party API
• Images — photos, illustrations, icons, screenshots
• Fonts — your own type files, self-hosted rather than pulled from elsewhere

A static site can still call out to other services from JavaScript running in the visitor's browser — a form-submission service, an analytics script, a payment button — because that call happens on the visitor's device, not on ours. What makes a site static is that we don't run anything to produce the response; we just hand over the file that was already there.

What doesn't qualify

Anything that needs a process running on our servers to produce a response:

• Server-side code — PHP, Node, Python, Ruby, or any language executed on request
• A database — nothing here queries or writes to one on our infrastructure
• Cron jobs, or any scheduled task running on our servers
• A build step on our side — see connecting a Git repository for what that means in practice

If a project needs any of these, it isn't a fit for Lemonade Host today. The full, formal list of what's off-limits and why lives in the acceptable use policy.

Why static is faster and safer

Two things follow directly from having no server-side process:

1. Nothing to compute on request

   A dynamic site queries a database and assembles a page before it can answer. A static site's answer already exists as a file, so there's no query to wait on and nothing to cache around — the response is close to instant.

2. Nothing to exploit

   No admin login, no plugin, no server-side code path — there's no attack surface behind the files themselves. The most common ways sites get compromised, like an outdated plugin or an exposed admin panel, don't apply when there's no server-side code to target.

Sites that fit

If the finished thing can be described as a folder of files rather than a running application, it fits:

• Portfolios and personal sites
• Brochure and small-business sites
• Documentation, like this page
• Landing pages and pre-launch sites
• Résumés and link-in-bio pages
• Sites exported from a page builder, or generated by a static site generator