Static site or CMS: what an admin panel costs
Most sites run on a CMS, a management system that keeps pages in a database and assembles them again on every visit. In practice that usually means WordPress, with Drupal and commercial systems further up the scale. The approach is familiar, and it carries a cost that nobody thinks about until they meet it.
How a site on a management system works
When someone opens a page on such a site, a program starts on the server. It queries the database, pulls the content, drops it into a template and returns finished HTML. That takes time and resources, so the site needs a more expensive plan, and it starts to struggle when visitors arrive in numbers. On top of that everything needs updating, both the system itself and its extensions, because that is where the vulnerabilities are found.
How a static site differs
A static site is built the other way round. Pages are assembled once, on the developer's machine or on a build server, and turned into ordinary files. Only those files stay on the server, with no database and no running program. The visitor gets the file immediately, with no computation.
Almost everything else follows from that. Such a site opens fast and is not afraid of load, since serving a file to a thousand people is no harder than serving it to one. Hosting costs next to nothing, because nothing is asked of the server. There is essentially nothing to break into, since there is no login form, no database and no third-party extensions. The site you are reading now is built exactly this way.
The one real limitation of static, and how it is worked around
There is exactly one limitation, and it is a real one: to change a piece of text the site has to be rebuilt. In the simple setup that means "call the developer". For a landing page or a services site that changes a few times a year this is not a problem at all. For a news site publishing daily the problem is obvious, and there a management system wins outright.
That said, the choice stopped being strictly binary long ago. There is a middle route where the editor's experience stays familiar. You edit text in a separate admin panel in the browser, and after saving, the site rebuilds itself automatically and ships to the server. To the editor it looks like an ordinary management system, while the visitor gets static with all of its advantages. This option costs more at the start and noticeably less to run.
It is worth separating two different meanings of "the site changes". Forms, search, a cart and a customer account do not get in static's way, because they run through small separate services rather than through rebuilding pages. A rebuild is only needed when the content of the pages themselves changes.
When a management system is justified
A management system remains the right choice if you have several authors, publish daily, have many editable entities and complex relationships between them. The same is true when you need a specific piece of ready functionality that the system already implements and that is cheaper to take than to write. A store with a thousand products and constantly changing prices and stock levels also belongs on its territory.
The names matter here too, because the costs behind them differ. WordPress is chosen for its extensions and for the fact that a contractor can be found anywhere, and it is paid for with regular updates and attention to security, since an abandoned site on an outdated version is the first one broken into. A commercial system is chosen for the exchange with an accounting system and for a catalogue with many products, and its price is made up of the licence, a heavier hosting plan and the work of someone who knows it. Builders such as Wix, Squarespace or Tilda sit alongside as a third option, except that there you pay a subscription rather than a licence, and you edit the site with a mouse rather than through an admin panel backed by a database.
When static works out better
Static works out better for a services site, a landing page, a portfolio, documentation and a blog that publishes once a week. In other words, for the overwhelming majority of sites that small businesses commission. For them the real cost is not the development but the next three years of hosting, updates and repairs after the next vulnerability is found.
A practical way to test a contractor: ask what happens to the site in two years without your involvement. Static will work exactly as it did on handover day. A management system left without updates for two years turns into a hole, and that is not an exaggeration. Abandoned sites on outdated versions are the first ones to be broken into.