What attack surface means for a small business website
Attack surface is the parts of a website that can be reached and need looking after. How it differs between a traditional PHP site and a static one.
Nikolas Gannon · · 1 min read · Systems and security
Attack surface is a security term for everything about a system that can be reached from the internet. It is a useful way to think about what your website needs looking after, whatever kind of site you have.
A traditional site
A traditional site is an application. A PHP process, a database and a set of plugins run on a server and build each page when someone visits. Each of those parts can be reached from the internet, so each needs to be kept updated. PHP2Shell and wp2shell in 2026 were both examples of why.
That does not make traditional sites unsafe. It means they need regular maintenance, the same way a car needs servicing.
A static site
A static site is built ahead of time into a folder of finished files, which are served from a CDN. There is no application running behind the pages, so there is less to update.
What every site still has
Static is not invulnerable. Every site, whatever it is built with, still depends on:
- the domain registrar account
- the hosting or CDN account
- the email accounts tied to them
- any outside services for forms, booking or payments
Strong passwords and two-factor login on those accounts matter on any site.
Putting it together
If you are happy maintaining a traditional site, or paying someone to, that is a reasonable choice. If you would like less running software to look after, a static site reduces it. Either way, the free audit maps what your site depends on and what needs attention.
Free resource: Website security check
Free resource: Website health check
Read next: PHP2Shell: critical PHP vulnerability patched October 2026 · What a static site actually is · The plugin supply chain risk, explained
Questions
What is an attack surface?
All the parts of a system that someone on the internet can reach. Less running software generally means less to look after.
What makes up a traditional site's attack surface?
The PHP application, the database, the plugins and the server, plus the logins used to manage them.
What about a static site?
Mostly the hosting account, the domain and any outside services used for forms or booking. There is no application running behind the pages.