There are cache plugins that effectively turn it into a static site. You could also run CF atop of it.
WordPress is used at scale by many companies.
Cache plugins still go through the PHP interpreter. I'm under the impression there still isn't anything faster than serving HTML files.
Better is use a static site plugin, then you don't have to bother with configuring any caching or external services.
Best is also use the SQLite Database Integration plugin, so the server doesn't even have to run MySQL/MariaDB (other than initial installation), and on an otherwise light server, the filesystem will effectively keep the site in page cache while using less memory, if I understand that correctly.
The WordPress interface can be kept behind HTTP auth or client cert.
That seems like a great stack, if you're looking for one!