And the files can certainly be edited as they aren’t immutable.

They are less resource intensive and easier to maintain, but aren’t immune.

(Running mostly static sites converted from Wordpress sites, but also running 10 year old+ word press sites that haven’t been changed in forever)

If you have Wordpress exposed to the internet, there's a lot more security stuff to deal with.

There's no DB with juicy data and no compute to abuse for mining crypto or running DDOS attacks.

There’s less payoff, but people still do it.

What would hacking an HTML file even mean.

The first time I caught them in the act and pulled the NIC on it because from file names it looked like CSAM was being uploaded to it.

After the third time I went static and never looked back.

Comments and search never worked right (or depended on the Wordpress box being reachable by the public at the admin URL anyway.) went through algolia, disqus, updates inevitably broke them again

Between all that and the corporate behavior im ready to move on from WP. The site in question hasn’t been online for several months now and the more I read about this the more I went, it’s time to find something else for this need

After that I added a cron job that compared the hash of the index.html with a precomputed value. Didn't change often enough to be a hassle.

Your source of truth for a static site will never be the deployed contents of the server (even if you do go that route). It will be your local Git repo or possibly your upstream Git forge.

Even in the rare case that such a simple case gets you hacked, you can throw away your entire setup and start over quite easily. Whereas all of the Wordpress/Drupal/etc/etc. options I'm aware of will require you to do your own database backups, if you are self-hosting, or else you are simply hosed (as the attacker could corrupt or erase the source of truth).

If you are with a hosted solution then obviously your security (and backups) will be as good as their security/backups, and all of this will be moot except for pricing.

I think static sites are a good technique that has vastly improved security over dynamic sites, but thinking that using them makes you invincible is faulty.

I'm not sure if Debian's packages are kept up to date with security patches, though. The latest changes to the wordpress package[0] were in December 2022 and and May 2024.

[0] https://metadata.ftp-master.debian.org/changelogs//main/w/wo...