I use Hugo, and I have a relatively ergonomic workflow set up where I use iA Writer to write posts on my iPad, then Working Copy to push them to a git repo. Then my server pulls that repo on a cron job, and builds and deploys it. It’s fine. It gets the job done.

But I confess that being able to post a new entry to an API and have it published instantly sure is attractive. If WordPress had a better security track record, I’d be tempted to switch to it. You don’t get much more secure than a bunch of static files served straight from disk, though.