If you're lazy (like me) and still running a few (mostly static) WordPress sites, I can recommend Simply Static. Export the whole site/blog as static pages, and take away the security / maintenance hassle of running WP and PHP.

https://wordpress.org/plugins/simply-static/

Simply Static – The Static Site Generator

Create a static website directly from your WordPress website with Simply Static.

WordPress.org
Of course, less of a fit for sites that depend on a lot of dynamic content and forms and whatnot.
But it did wonders for my blog, which sees increased traffic for the Mastodon-related posts and guides. Should load faster now :) https://www.forceflow.be/2022/11/11/moving-from-twitter-to-mastodon/
A guide to Mastodon (for Twitter users) - Jeroen Baert's Blog

Last Update: 22/07/2023 (Links cleanup) General resources Huh? What is a server? Why should I care? This is where the first major difference between Mastodon and Twitter becomes clear: Update: Since May 2023, Mastodon uses mastodon.social as the default instance using the sign-up process on mobile. This should make it …

Jeroen Baert's Blog
You can still run the original site on a secret, password protected subdomain, for easy updating / changing themes etc. Huge reduction of attack surface.
@jbaert I agree this approach makes so much sense. I have it on my long list of personal “IT tasks” to do this for several of my WP sites that I update very infrequently.
@jbaert learned last month about "partial hydration". Basically, doing everything statically and only load js for the couple sections that need it (if that section of the page is even accessed at all)