Or as in my case, lighttpd, with all its CGI, user-input processing or dynamic execution modules not even loaded.

Makes for an attack surface that gets delightfully close to zero.