Try “SSH”, “passkeys”, “WordPress” or “Content-Security-Policy”.
Section · 5 guides
Websites are the most visible target a business has. We compare content management systems by attack surface and maintenance effort, explain security headers and give you the checks to run before a site goes live.
/cms/Six ways to run a website, scored on security process, extension risk, updates, support windows and attack surface. The right choice depends less on the code than on the routine you can keep.
High impact6 min
When a WordPress site is broken into, the cause is rarely WordPress core. These steps close the usual gaps in order of impact, with settings and server rules you can copy.
High impact6 min
No database, no login page, no code running on each request: static sites are hard to break into directly. The risks move to the build pipeline, the accounts, the DNS and the scripts you embed.
Medium impact5 min
A handful of HTTP response headers tell browsers to enforce HTTPS, block framing and limit what scripts may load. Here is what each one does, which ones to drop and how to add them on Apache and Nginx.
Medium impact5 min
The week before launch is the cheapest time to fix security. These checks cover HTTPS, logins, error pages, forms, privacy, DNS and email records, backups and monitoring, whatever the site is built with.
High impact5 min
Compare
Interactive comparison
Editorial scores from 1 to 5 for teams that run their own website, where higher is always better.
Best for publishers and newsletters that need no plugins.
Best for sites that change rarely and teams comfortable with git.
Best for mid-sized sites that want MFA and clear support dates without many add-ons.
Best for organisations with agency support that value long, predictable LTS windows.
Best for complex sites with a developer or agency and a deployment pipeline.
Best for small teams that want a familiar editor and will keep plugins to a minimum.
| Criterion | Ghost | Static site generator | Joomla | TYPO3 | Drupal | WordPress |
|---|---|---|---|---|---|---|
| Core security process | ||||||
| Low extension risk | ||||||
| Update automation | ||||||
| Long-term support | ||||||
| Small attack surface | ||||||
| Admin protection | ||||||
| Low maintenance effort |
Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order. Read the full comparison
Tools for this section
