With WordPress, there's always the possibility of your blog being hacked, because it executes queries and there's always the chance for bugs to exist some where in the huge ocean of code. On the other hand, with static blog generators (like specter, octopress, pelican, etc) your generated blog will be static html and as far as I know, there's no way you can really question html's security, simply because security doesn't apply to it. You cannot attack html because it doesn't run queries or anything, it's just static data being pulled from the server and displayed by the browser. So, in the end, the security goes back to your host and how good the machines are configured (when you're using shared hosts).

Static engines: * Do one thing _good_ (i.e. blog) * Fewer lines of code, which means: * Easier to maintain * Easier to read * Easier to customize using small chunks of raw code

Dynamic engines: * Do many things (i.e. having multiple authors, multiple formats, visual editors, plugins, etc.) * Many more (as in x^5) lines of code, which means: * * Harder to maintain * * Easier to use for _non programmers_ * * Easy to customize SOME things (apply a theme), HARD to customize the whole thing properly (you need to read huge chunks of code that might break if you change them) --

The above reasons make Wordpress pretty much insecure compared to a Static website (i.e. Jekyll engine like octopress). Of course you could have a bloated wordpress websites where all it's plugins are revised and secure while you could have a static website where it's running buggy JavaScript which reveals your IP to the NSA (random example pick) but the % of having a bug in a bigger (in terms of lines of code) app is way higher.