[simonw]

Yeah, static site generators solve so many of these problems. There's a lot less that can go wrong if your hosting is entirely static files out of S3 or Cloudflare or nginx or similar.

[bostik]

Or as in my case, lighttpd, with all its CGI, user-input processing or dynamic execution modules not even loaded.

Makes for an attack surface that gets delightfully close to zero.