If a website uses HTML & CSS only without any server side language, does it make it Hack-Proof?
Thank you


1 Answer 1


Nothing is ever really "hack-proof" when you consider the multitude of attack vectors.

Whilst a purely static website may not be susceptible to SQL injection or WordPress script-kiddie attacks, there's still the possibility of an attacker getting server access or even just FTP access. This can be mitigated by disabling any cleartext access (i.e. use SSH/SFTP in place of telnet & FTP) and good user/password management, but never assume you're totally hack-proof as there's just no such thing.

  • Obviously there are more attack vectors than those I've mentioned, but I don't think this answer is the place to start listing every way a website can be "hacked". Commented Aug 23, 2017 at 13:19
  • 1
    Other possible attack vectors: Cross-site-scripting against JavaScript, DNS poisoning, man in the middle attacks and eavesdropping. Commented Aug 23, 2017 at 16:05
  • 1
    Even programming environments can be vulnerable even if no code exists on the site. It has been a while, however, at one point PHP and Java environments could be hacked. There are also reflection attacks, proxy attacks, etc.
    – closetnoc
    Commented Aug 23, 2017 at 20:19
  • 1
    Or bugs in the web server
    – wb9688
    Commented Aug 23, 2017 at 20:44
  • 1
    Complex passwords for your site should be considered, too. Change your passwords regularly and don't use any password that you use on another site. Commented Sep 14, 2017 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.