> 2. The expanded attack surface I'm a fan and a customer of https://www.hardypress.com/ https://www.hardypress.com/ –– they run Wordpress in a sandboxed envir

> 2. The expanded attack surface I'm a fan and a customer of https://www.hardypress.com/ https://www.hardypress.com/ –– they run Wordpress in a sandboxed environment, and have a "publish" function that exports a static site. Of course that limits what you can build – for example, you would need to use 3rd party services for blog comments and for contact forms – but for many use cases that's OK. There is also the "Simply Static" Wordpress plugin that can export a static site.