[sshine]

How do you hack a static HTML page?

The point is that most WordPress pages don’t warrant the dynamic code execution on every page load.

When you use a static site generator and make content creation convenient behind the scenes, you move the entire attack surface to, in my case, nginx, the load balancer, and OpenSSL.

[kmoser]

You don't hack a static HTML page, you hack the (presumably public-facing) vibecoded admin panel that can update the static page.

[sshine]

I think "yolo" gets overloaded here to mean "not thinking".

I've described it as static HTML.

The admin dashboard isn't static HTML, but it also isn't public-facing.

The admin dashboard lives behind an oauth2-proxy authenticated via keycloak, and only accessible to the corporate wifi / vpn. The dashboard is really a completely separate application.

The probability that you can hack an admin panel because you know the public URL assumes either there's a "Login" button on the front page, or that the admin panel depends on the source code in the same way as the public-facing pages.