The simplest question to ask a content management system is this: what happens on the server when a visitor opens a page?
In the common systems the answer is long. PHP runs, dozens of queries go to the database, plugins do their own work and the HTML is assembled on the spot. Then a caching plugin is installed to take the load off, and deciding when to clear that cache becomes a problem of its own.
In HisarBlok the answer is short: a ready HTML file is sent. That is all.
How it works
The admin is dynamic and sits behind a login. When you save a page, the affected files are generated right then and written to the site root: the page itself, the lists it appears in, the tag pages, the sitemap and the RSS feed. Visitors read those files. The work happens when you save, not when someone reads.
That has three consequences:
- Speed is not a setting. There is no caching plugin because there is no cache to clear. The web server sends the file directly, even its pre-compressed copy.
- The attack surface is small. If an anonymous visitor's request runs no code, running code through that request becomes very hard.
- Traffic spikes are not a problem. Serving static files is what a web server does best.
What about the parts that must be dynamic?
Not everything can be static. A contact form, a comment, a forum post or a member sign-in takes data from the visitor by its nature. HisarBlok sends all of them through one narrow, hardened entry point. Forms are baked into the page as static HTML; only the submission reaches that door. The door is rate-limited, every form token is bound to the page it was made for, and visitors get no session and no cookie.
What does it cost?
To be honest, this approach has a price:
- A change that touches the whole site, such as the theme or the menu, rebuilds every page. On small and medium sites that takes seconds; very large sites can take longer.
- Personal content ("hello, Ayşe") cannot be written into the page itself. Pieces like that are filled in as small islands inside the page, with a separate request.
- There is a folder on the server that needs write permission. Getting that right during installation matters; if it is wrong, HisarBlok does not hide it but says so plainly.
For us that price is worth the speed and security we get in return.
This site
The post you are reading was published the same way. kodhisar.com is built with HisarBlok: we saved the post in the admin, and the system wrote this page and the blog list to disk. When you opened it, no PHP ran on the server.