Maybe a longshot for your case, but Ghost[1] was developed as a simplified alternative to Wordpress. Their feature list[2] bring up several security-focused design choices.

The original idea of Ghost was made by John O'Nolan, then a lead dev at Wordpress Foundation.

[1] https://ghost.org [2] https://ghost.org/feature-index/

That's literally Wordpress minus plugins powered by a theme you created yourself.