After the news of Linux Mint's Wordpress and phpBB forum installations being compromised, I got to thinking about how ubiquitous and often unnecessary Wordpress has become. (Not to mention Drupal and Joomla and other similar CMS packages.) In many cases, these powerful content management systems that utilize the full LAMP / LEMP stack are being grossly underutilized. And the worst thing is that they inherently come with the risk of a nasty exploit like what Linux Mint had to go through. Yes, it's true that proactive security practices can help mitigate the risk, but sometimes even the best administrators still get hit with zero-day exploits, such as the infamous "Drupalgeddon". It's even uglier when you think about how many users know absolutely nothing about web hosting, so they (over)pay a "web developer" to install Wordpress with a purchased template, both of which probably contain security holes. And since it was a one-off job, countless sites like this lurk across the Internet, just waiting to get exploited and leaking private information and/or serving up drive-by security threats. As mentioned, many of these sites mainly consist of text and pictures, blog posts, articles, and the like. For use cases like that, a full blown server-side CMS with PHP and a SQL database is often overkill. This is even more true if the owner of the site doesn't have the time or the knowledge to keep up with security patches.

Recently I've been doing a lot of research on an alternative way of generating a fairly easy website with no required maintenance and virtually no security risks. I'm not a good web developer, and I hate HTML with a passion. But it turns out there is a boatload of different tools that can be used to generate a nice looking website with minimal effort, minimal coding, and virtually no risk of exploits aside from the variable of your admin password strength:

Enter static site generators. Basically, the concept is to transfer the management and generation of web content from the server to the local user's desktop. This means no server-side generation of content, no PHP or other server-side scripting languages, and no databases. All you do is type up your website's content in a simple markup language (usually Markdown), choose a template, run a few commands on your local computer, and then rsync or upload the resulting directory to a simple webserver or even Github, Dropbox or Google Drive. I'd like to share my research for those who don't yet know about this interesting branch of tools, and also so I don't lose my own research :)

Concept overviews:

• https://www.smashingmagazine.com/2015/11/modern-static-website-generators-next-big-thing/
• https://www.smashingmagazine.com/2015/11/static-website-generators-jekyll-middleman-roots-hugo-review/
• https://www.staticgen.com/

Static site generators that interest me:

• https://gohugo.io/overview/quickstart/
• https://hexo.io/docs/
• http://prose.io/
• https://github.com/netlify/netlify-cms
• http://jekyllrb.com/docs/quickstart/
• https://middlemanapp.com/
• http://blog.getpelican.com/
• http://brunch.io/
• http://nanoc.ws/
• https://getnikola.com
• https://hyde.github.io
• https://jaspervdj.be/hakyll
• http://metalsmith.io/

User comments without Disqus:

• https://github.com/phusion/juvia
• https://commentit.io/
• https://github.com/mpalmer/jekyll-static-comments
• https://posativ.org/isso/

I hope this list is useful to someone. Of course, static site generators may not suit all or even most needs. But before throwing a new site up on a CMS like Wordpress, or even when evaluating the future direction of an existing site, it's worth considering if the added complexity and risks of server-side scripting and databases are really advantageous or even necessary at all.