Sometimes I think a static CMS like Lektor may be a better framework to set up. The static nature prevents any of the dynamic exploits but still maintain templating system without adding complexity after the initial setup.

https://www.futurehosting.com/blog/lektor-is-a-static-site-g...