Static Site Generation (SSG)

The entire website is pre-rendered into a collection of static assets during a build step, not at the moment a user requests a page. This process typically occurs in a CI/CD pipeline triggered by a content change or code commit.

• No server runtime: No application server, database connections, or server-side processing is required to serve a page.
• Atomic deployment: The output is a directory of HTML, CSS, JavaScript, and media files that can be deployed as a single immutable unit.
• Example: A Next.js project using next build and next export generates a complete static site from dynamic React components.

Because the output is pre-built static files, the entire site can be served directly from a Content Delivery Network (CDN) edge cache. There is no origin server bottleneck for content delivery.

• Global distribution: Static assets are replicated to points of presence worldwide, minimizing latency for all users.
• Cache hit ratio: Effectively 100%, as every file is a cacheable artifact with a unique URL and content hash for fingerprinting.
• Origin offload: The origin server is only hit for the initial deployment, not for individual user requests, enabling massive traffic spikes without infrastructure scaling.

Each build produces a completely self-contained, atomic version of the site. This immutability eliminates entire categories of operational risk.

• Atomic rollbacks: Reverting to a previous deployment is as simple as repointing a CDN origin to a prior build artifact directory.
• Consistency guarantee: Every user accessing a given deployment version sees exactly the same content, eliminating cache fragmentation and version skew.
• Immutable infrastructure: The deployed artifacts are never modified in place; any change triggers a full new build and deployment.

An SSG site dramatically reduces the attack surface by eliminating live server-side execution. There is no application server, no database, and no user input processing at request time.

• No server-side vulnerabilities: SQL injection, cross-site request forgery, and server-side template injection are simply not applicable to static files.
• No authentication surface: The web server serves only public files; there is no login system or session state to exploit.
• Read-only infrastructure: The serving infrastructure has no write permissions, preventing defacement or data exfiltration via application exploits.

SSG frameworks fetch all external data during the build process, not at request time. Content from headless CMS platforms, APIs, and local files is pulled in and rendered into static markup.

• Data pipeline integration: Build scripts query REST or GraphQL endpoints, transform the data, and generate pages for each entity.
• Content as code: The relationship between content and presentation is resolved once, producing a deterministic output.
• Stale-while-revalidate: Modern SSG frameworks like Next.js extend this model with Incremental Static Regeneration (ISR), allowing individual pages to be re-rendered in the background without a full rebuild.

SSG is a foundational pillar of the Jamstack architectural philosophy, which stands for JavaScript, APIs, and Markup. It represents the 'Markup' component—pre-built files served directly to the browser.

• Decoupled architecture: The frontend build process is completely independent of any backend services, which are consumed only at build time or via client-side JavaScript.
• Git-based workflows: The entire site, including content and code, can be version-controlled, enabling pull request previews and branch deployments.
• Ecosystem compatibility: SSG integrates natively with headless CMS platforms, CI/CD pipelines, and edge functions for dynamic capabilities layered on top of the static base.