Why I built this site without a CMS

A lot of my work is about shrinking the attack surface, cutting down on operational toil and making systems easy to audit. It would be odd if my own website went the other way, with a database, a PHP runtime, a stack of plugins and a steady flow of security updates.

What this site is

It's a few hand-written HTML files and one stylesheet. There's no JavaScript, no database and no server-side code. Any static host can serve it: GitHub Pages, Cloudflare Pages, an S3 bucket or a plain nginx box.

personal-site/
├── index.html
├── feed.xml
├── assets/css/style.css
└── blog/
    ├── index.html
    └── posts/
        └── 2026-11-01-why-a-static-site.html

What I get out of it

• Security: with nothing to execute, there's nothing to exploit beyond the web server itself.
• Zero maintenance: no plugin updates and no outages caused by a dependency change.
• Everything in Git: every change is reviewed, versioned and reversible.
• Speed: pages are a few kilobytes and load instantly.

The best infrastructure is the one you don't have to operate.

The trade-off

Adding a post means copying a template and adding a line to two lists. I'm fine with that. If it ever starts to feel tedious, I can add a small script to generate it, which would be a nice little automation project to write about here.