I saw a meme the other day that made me stop scrolling.

On one side: a WordPress site drowning under hundreds of plugins. On the other: an Astro site with a package.json that had somehow ballooned to a thousand npm packages. The caption was something like “which one is actually less secure?”

It was funny. It was also incomplete.

I’ve been thinking about this comparison a lot lately, mostly because the default framing (static vs server, or “plugins are bad / npm is bad”) misses the more interesting part: how each platform creates (or avoids) shared, exploitable surfaces . So I sat down and tried to map the real attack surfaces instead of just counting dependencies.

The meme is pointing at something real

WordPress and Astro do have different default shapes.

WordPress ships with a large, well-known set of endpoints and an extensibility model where plugins run with significant privileges inside the same process.…