If a website uses HTML & CSS only without any server side language, does it make it Hack-Proof?
Thank you


Nothing is ever really "hack-proof" when you consider the multitude of attack vectors.

Whilst a purely static website may not be susceptible to SQL injection or WordPress script-kiddie attacks, there's still the possibility of an attacker getting server access or even just FTP access. This can be mitigated by disabling any cleartext access (i.e. use SSH/SFTP in place of telnet & FTP) and good user/password management, but never assume you're totally hack-proof as there's just no such thing.

  • Obviously there are more attack vectors than those I've mentioned, but I don't think this answer is the place to start listing every way a website can be "hacked". – Andrew Lott Aug 23 '17 at 13:19
  • 1
    Other possible attack vectors: Cross-site-scripting against JavaScript, DNS poisoning, man in the middle attacks and eavesdropping. – Stephen Ostermiller Aug 23 '17 at 16:05
  • 1
    Even programming environments can be vulnerable even if no code exists on the site. It has been a while, however, at one point PHP and Java environments could be hacked. There are also reflection attacks, proxy attacks, etc. – closetnoc Aug 23 '17 at 20:19
  • 1
    Or bugs in the web server – wb9688 Aug 23 '17 at 20:44
  • 1
    Complex passwords for your site should be considered, too. Change your passwords regularly and don't use any password that you use on another site. – Tracy Welsh Ryan Sep 14 '17 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.