If you're lazy (like me) and still running a few (mostly static) WordPress sites, I can recommend Simply Static. Export the whole site/blog as static pages, and take away the security / maintenance hassle of running WP and PHP.

https://wordpress.org/plugins/simply-static/

Simply Static – The Static Site Generator

Create a static website directly from your WordPress website with Simply Static.

WordPress.org
Of course, less of a fit for sites that depend on a lot of dynamic content and forms and whatnot.
But it did wonders for my blog, which sees increased traffic for the Mastodon-related posts and guides. Should load faster now :) https://www.forceflow.be/2022/11/11/moving-from-twitter-to-mastodon/
A guide to Mastodon (for Twitter users) - Jeroen Baert's Blog

Last Update: 22/07/2023 (Links cleanup) General resources Huh? What is a server? Why should I care? This is where the first major difference between Mastodon and Twitter becomes clear: Update: Since May 2023, Mastodon uses mastodon.social as the default instance using the sign-up process on mobile. This should make it …

Jeroen Baert's Blog
You can still run the original site on a secret, password protected subdomain, for easy updating / changing themes etc. Huge reduction of attack surface.
@jbaert I agree this approach makes so much sense. I have it on my long list of personal “IT tasks” to do this for several of my WP sites that I update very infrequently.