Less to attack.
WHY THEY ARE SAFER
No database No application processing input No plugins to become vulnerable Nothing to log into
WHAT CAN STILL GO WRONG
Compromised credentials for your hosting or deployment A vulnerable third-party script Exposed files that should not be public A compromised dependency in your build
THAT LAST ONE
Build tools pull in many dependencies.
A compromised package can inject code into your output.
Keep dependencies updated and review what you install.
WHAT TO PROTECT
Your hosting credentials Your deployment credentials Your source repository
WHAT TO CHECK
That no configuration or environment file is web-accessible That version control directories are not exposed
STILL USE HTTPS
Static does not mean secure in transit.
Run AutoSSL.
WHAT YOU DO NOT NEED
Most of the security plugins a WordPress site needs.
