[TheOtherHobbes]

I see

"GET /wp-login.php HTTP/1.1"

about eight times a day on my lowest traffic sites. And I don't even have WP installed. (Or PHP.)

WP is a distributed botnet farm. I know people who have given up reseller hosting businesses because keeping customer WP installs clean was becoming a 24/7 job for them.

Unfortunately Hugo, Jekyll, etc are a poor substitute for WP, because they're much too difficult for non-coders to use. They're also a poor substitute economically - the WP template & plug-in market is huge.

It must surely be possible to build a blog engine that's secure, easy to use, and easy to customise?