In the scenario where I create a website using HTML5, Javascript, and CSS3 with no forms or input fields other than mouse clicks on links, as well as no logins, messaging, or comments - will this site still be vulnerable to attacks?
Recently, my hosting service has flagged malicious PHP and Wordpress files twice in one month that needed cleaning.
Considering the previous incident caused my site to crash, I am contemplating removing all PHP and Wordpress components and coding everything from scratch. If we eliminate the possibility of someone hacking into my account's control panel or FTP, could my code still be susceptible to unauthorized changes or injections?