A static website builder whose pages ship as plain HTML and CSS

What "static" means, and what it doesn't

On a dynamic site, such as a typical WordPress install, each visit runs code on a server: it queries a database, assembles the page from a theme and plugins, and sends the result. On a static site, that work happened once, when the site was built. The server just hands over the file.

Static doesn't mean the site can never change, or that it can't have a form. You rebuild and republish when the content changes, and forms post to a service that handles submissions. It also doesn't automatically mean "no JavaScript": many static site generators ship sizeable scripts for menus, animations and analytics. Used as a static website builder, Anticode goes further: its pages ship none.

What you gain

Less to attack

With no server code per page, there's no plugin to exploit and no database to inject into. With no scripts in the page, there's no third-party script that can be compromised and no cross-site scripting through injected code to worry about.

Nothing to patch

A dynamic CMS needs core, theme and plugin updates, often monthly. A static page has no runtime to update.

Speed

The browser gets HTML and CSS and can draw the page immediately. No script has to download and run before the content appears.

Privacy by default

No scripts means no tracking code in the page. Anticode counts page views on its side, without cookies.

Portability

A folder of HTML can be hosted almost anywhere and will still open in twenty years.

How Anticode makes pages static

When you build a landing page, store, booking site, dashboard or portfolio, Anticode's design engine lays it out and the Builder writes plain HTML and CSS. Published pages are served with a Content-Security-Policy that includes script-src 'none', so even if a script found its way into the HTML, the browser would refuse to run it. Interaction that would normally need JavaScript is done with HTML and CSS, or moved to the server: forms post to Anticode's form pipeline, which stores and seals submissions, and a site function can do arithmetic on a form or call your own endpoint.

Before a page can be published, Sentinel runs its twelve security checks on the exact HTML that will ship, covering the Content-Security-Policy, forms, links, images and anything that looks like a secret. At publish, the server re-runs the checks that matter most once a page is public (no scripts, no inline handlers, no javascript: URLs, safe form targets, HTTPS), so a modified browser can't skip them. The full list is in the AI website security checklist.

Even in Pro mode's code editor, where you edit the HTML directly, scripts, inline event handlers and javascript: URLs are refused, so the page stays static after hand edits too.

Getting the files out

You can export a page as one self-contained HTML file, with its styles inside it. That's useful as an archive, for hosting on your own server or a static host, or for handing to someone who wants the plain file. The download a website as HTML guide covers the steps.

Bear in mind what the file is: the page itself. The services behind a published Anticode site, such as storing form submissions, connectors, site functions, page-view counts, the per-site sitemap and the security report, belong to publishing on Anticode. If you host the exported file elsewhere, plan where its forms should send data.

When static isn't enough

Some things genuinely need code running somewhere. Anticode handles a few of them on its servers (forms, bookings, CMS collections, site functions), but not everything. If you need visitor accounts, personalised pages, a shopping cart or live data, a static site isn't the answer on its own.

• Interactive tools and games are built as Anticode apps instead: a single HTML document with its own JavaScript, run in a strict sandbox with no network access.
• Accounts, roles and a real database come with the Next.js export, a standard App Router project with Postgres through Prisma, which you host yourself.
• Large content sites with thousands of pages, search and editorial workflows are better served by a dedicated static site generator or CMS.

The guide on static vs dynamic websites walks through the choice in more depth.

Limits

• No custom JavaScript on design-engine pages, including widgets, chat bubbles, embedded booking tools that need scripts, and analytics or ad pixels.
• No Markdown-to-site pipeline. Content lives in the Anticode project (edited in the builder, through the CLI or in CMS collections), not in a folder of Markdown posts that a generator turns into pages.
• Exported HTML is a snapshot. Changes made in Anticode afterwards need a fresh export.

Questions people ask

Are static websites more secure?

They remove whole classes of risk, such as vulnerable plugins and database injection, and a page with no scripts removes more. They're not immune: forms, links and the host still need care, which is what Sentinel's checks look at.

Can a static website have a contact form?

Yes. The form is plain HTML that posts to a server. On Anticode, submissions go to its form pipeline, sealed at rest and optionally emailed to you.

Is a static site good for SEO?

Search engines read plain HTML easily and fast pages help. Each published Anticode site also serves its own sitemap.xml and robots.txt.