THE TECHNOLOGY FIELD GUIDE
Compare what you gain, what you maintain, and where customer data is exposed. A framework name is not a security rating.
| What matters | Outdated WordPress | Current React + many dependencies | HTML + self-contained JavaScript |
|---|---|---|---|
| Server requirements | PHP + database, usually exposed admin/login routes. | Static output works on basic hosting. Server rendering or an API needs a supported runtime. | Ordinary static file hosting; no app server needed. |
| Main advantage | Familiar editor and an existing site you may already own. | Rich interactions, reusable components and complex public catalogs. | Few moving parts; quick delivery and simple recovery. |
| Maintenance burden | Urgent catch-up, ongoing core/theme/plugin updates and PHP support. | Dependency reviews, lockfile, build security and tested rebuilds. More packages mean more to review. | Keep custom code correct, credentials safe and links current. |
| Local customer data | Often retained by forms, comments, shops and account plugins. | None required for a static build. Custom APIs and CRMs change the data flow. | None required. A custom form backend changes this assumption. |
| Important remaining risk | Known vulnerabilities, account takeover, database exposure and injected checkout links. | Build compromise, unsafe custom code, remote scripts and exposed frontend secrets. | Host/domain takeover, unsafe JavaScript and replacement of public files. |
| Practical verdict | Repair, replace or isolate. A newer payment plugin is not a repair plan. | Reasonable when the interaction justifies the upkeep; publish static files where possible. | A strong default for small showcases and hosted-checkout links. |
Sources: WordPress: WordPress: security and supported releases (external) ↗ · WordPress: Hardening WordPress (external) ↗ · OWASP Top 10:2025: Software Supply Chain Failures (external) ↗ · React: React Server Components security advisory (external) ↗
MAKE IT SPECIFIC
UpsideEasy devlogs, existing themes and a familiar editor.
TradeoffOld core, themes or plugins can become an entry point; maintaining an entire CMS for one game is recurring work.
For this businessA counterfeit download or account-login link can hurt players even without a customer database.
UpsideStrong fit for interactive screenshots, local demos and a custom launch experience.
TradeoffMany dependencies need review and rebuilds; third-party widgets can add tracking and script risk.
For this businessStatic output avoids a live Node server, but a compromised build can still publish a malicious download button.
UpsideFast, inexpensive, easy to back up; ample for one game and several links.
TradeoffDevlog editing is less convenient and richer interactions need deliberate implementation.
For this businessStolen hosting or domain credentials can still redirect fans. Small code is easier to inspect, not invulnerable.
Our practical starting point: Static showcase → itch.io / Steam + hosted newsletter
Read the games guideA dependency count alone cannot predict security. Review what executes in the browser, what runs only during the build and what has server privileges. Pin versions, review updates, remove unused packages and rebuild when relevant fixes are available.
Sources: OWASP Top 10:2025: Software Supply Chain Failures (external) ↗
The December 2025 React Server Components advisory is a useful example: it explicitly excluded client-only React apps from that vulnerability. Do not apply a server-component flaw to every React site—or assume all React stacks are protected because yours is static.
Sources: React: React Server Components security advisory (external) ↗