You can use Wordpress (self hosted) as a CMS for a static site with the right plugin.

There are downsides if you do this the free way; anything dynamic stops working if it was a WP module (forms, search etcetera). However, if it's a basic blog, it'll work just fine. SimplyStatic does have a paid version that supports search, and if you need low-volume forms you could probably use JotForm or similar in JS/HTML embed/iframe mode.

Before I switched to static export of WP, I had OTP auth enabled for both the admin and editor accounts. That hasn't changed. I also use a webp plugin that rewrites all image elements (in posts at least) to picture elements; browsers can then pick between the original JPEG or the converted-to-WEBP image. Static export respects this element rewrite.

To enable static exporting, I

* migrated the live site to a new subdomain, * added the Simply Static plugin, * configured SS to not go near wp-uploads - I don't want to double my disk usage, * configured nginx to alias the wp-uploads from the dynamic subdomain to the static site, * configured nginx to HTTP-auth protect the dynamic site - belt/braces approach on top of the existing OTP auth.

I don't care much about publishing from the Wordpress app on my phone, so the HTTP auth hasn't been a problem for me.

Publishing is "create new post, review it on dynamic site, open the SS generate page, click button". It could be automated, but it doesn't bother me enough to do that.

A side-effect is that the blog is never down due to things like Wordpress upgrades (ie, the maintenance page that shows up), because it's not actually powered by WP.