I think it would definitely be better to do a SSG or even wordpress with static output since you can throw it all behind authentication, which greatly reduces the attack surface.