Using a locked-down WordPress as the form backend for my static sites

To use a locked-down WordPress as a form backend for static sites, create a WordPress install with one plugin (e.g. CraftForms) and block all public frontend requests. This minimizes attack vectors and keeps submission data on your own infrastructure. Simply add a few lines of code to restrict the REST API and block XML-RPC and public frontend requests. This setup is fast, cheap, and secure.