I use WP and find it's OK. Once a user is accustomed to how to add content they can make changes easily. Two basic security plugins that I use are IQ Block Country and All In One WP Security, there are a few good Youtube videos that can walk someone through the best practical settings. I've also used Barracuda Drive (now FuguHub) and it's small and fast but requires more backend maintenance. It even fits on mini/micro computers like a Raspberry Pi.

As I recall from a NT Workstation class in 1998 or '99, this was a requirement from the government that a human had to initiate the login process. C-A-D would not be accepted by the login process from within Windows, it had to come from the keyboard. Sort of an early two-factor login process. Maybe not the best explanation, but that's the best I can do after 13 years.