Guide
Static vs dynamic public IP
Dynamic addresses change on a lease; static ones never do. A practical comparison, the jobs that genuinely need a fixed address, and the cheaper alternatives.
On this page
The two models
A dynamic public IP is the default everywhere: your ISP lends an address from a pool on a DHCP lease, and it may change on reboot, maintenance or lease expiry (why your IP changes). A static public IP is a specific address permanently reserved for your line — usually a business-plan option or a paid upgrade, and sometimes impossible on CGNAT lines at all.
Side by side
| Dynamic | Static | |
|---|---|---|
| Stability | Hours to weeks between changes | Fixed until you change it |
| Cost | Included | Often a monthly fee or business plan |
| Inbound access | Works while the address holds | Always the same door |
| Reputation | Spreads across the pool — one bad week is not forever you | Accumulates — good or bad, it is all on one address |
| Best for | 99% of home use | Hosting, allowlists, fixed remote access |
When a static IP pays off
- You host something — a web app, a mail server (fixed MX records), a VPN endpoint, an API. Callers need one address that never moves.
- A service allowlists you — some banking, ERP and government systems only accept traffic from a fixed source address.
- Remote access without moving parts — a fixed address plus port forwarding is the old-school way; it is simple and it works, if you keep it locked down.
If none of these is you, a dynamic IP plus a router firewall is the right and safe default — chasing stability you do not need just adds cost and a bigger target.
Cheaper ways to get stability
- Dynamic DNS (DDNS) — a hostname that automatically follows your changing IP (DuckDNS, your router's built-in DDNS). Inbound users type the name, not the number. The standard home-hosting answer.
- A small cloud server — a fixed public IP at the edge, with your home behind it via a tunnel or SNI-based forwarding. Costs a few dollars a month and removes the ISP conversation entirely.
- A commercial remote-access tool — outbounds from the tool's own infrastructure; no port forwarding, no static IP needed.
The security side of a public IP
A static IP is a permanent target: scanners find it once and keep finding it. The discipline that goes with it — and with any exposed service — is the same list every time:
- router firewall on, all ports closed by default;
- forward only the port(s) a service genuinely needs;
- no direct RDP/admin panels to the open internet — use a VPN or a reverse proxy with authentication;
- strong, unique credentials and 2FA for anything exposed.
Check what you are looking at: if the checker shows your address, the verdict and ASN confirm it is a real consumer line. The reputation score matters more once you go static — a listed static address hurts you continuously.
Frequently asked questions
Do ISPs charge for a static IP?
Often yes — typically as a business-line feature or a monthly add-on. Some regions include one on premium plans. CGNAT lines may require an upgrade before a unique IPv4 is available at all.
Is a dynamic IP unsafe?
No. With the router's firewall on and no unnecessary port forwarding, a changing dynamic address is a perfectly secure home setup — and the churn is a mild privacy plus.
Can I host a website on a dynamic IP?
Yes, with DDNS — that is what it is for. Two caveats: your ISP's terms may restrict hosting, and a CGNAT line blocks inbound entirely, so confirm you have a real public address first.
Keep reading
- What is an IP address?
- Public vs private IP addresses
- IPv4 vs IPv6
- How to hide your IP address
- How to check your IP address on a phone
- What is CGNAT?
- How to change your IP address
- Why does my IP address keep changing?
- How to find a website's IP address
- What is a datacenter IP?
- IPv6 privacy extensions
- What is an ASN?
- How IP geolocation works
- What is a local IP address?
- Why am I getting blocked or stuck on CAPTCHAs?
- What is IP reputation?
- How websites detect VPNs and proxies
- What is a DNS leak?
- What is a WebRTC leak?
- Proxy vs VPN
- How to check if your VPN actually works
- How to find out who owns an IP address
- IPv6 in 2026
- Check my public IP address
Check any other IP address
Investigating a suspicious login, a spam email header or a server log entry? Run any IPv4 or IPv6 address through the same geolocation and proxy checks.