I see<p>&quot;GET &#x2F;wp-login.php HTTP&#x2F;1.1&quot;<p>about eight times a day on my lowest traffic sites. And I don&#x27;t even have WP installed. (Or PHP.)<p>WP is a distributed botnet farm. I know people who have given up reseller hosting businesses because keeping customer WP installs clean was becoming a 24&#x2F;7 job for them.<p>Unfortunately Hugo, Jekyll, etc are a poor substitute for WP, because they&#x27;re much too difficult for non-coders to use. They&#x27;re also a poor substitute economically - the WP template &amp; plug-in market is <i>huge.</i><p>It must surely be possible to build a blog engine that&#x27;s secure, easy to use, and easy to customise?