If a website uses HTML & CSS only without any server side language, does it make it Hack-Proof?
Nothing is ever really "hack-proof" when you consider the multitude of attack vectors.
Whilst a purely static website may not be susceptible to SQL injection or WordPress script-kiddie attacks, there's still the possibility of an attacker getting server access or even just FTP access. This can be mitigated by disabling any cleartext access (i.e. use SSH/SFTP in place of telnet & FTP) and good user/password management, but never assume you're totally hack-proof as there's just no such thing.