Are there any cookies on the website? By the sounds of it there is not. If there is no PHP and it is just HTML pages, there are really no dangers with regards to web exploitation (SQLi, XSS, LFI, RFI, XXE, RCE, etc). When it comes to security the actual web server, it's important to make sure to close all ports except the ones which are needed.
That covers website hardening (you can't get any harder than just HTML), and also web server hardening. It is also important to harden your web server software (Apache, nginx, Lighttpd). This will prevent any potential vulnerabilities with the web server from allowing someone to root your boxes in the future.
Realistically speaking, it sounds like this is a very private website which won't be attracting much attention anyways. There are always potentials for attacks, be smart. Also, you should probably consider using a service such as CloudFlare to prevent a DDoS attack and also to help hide your server's IP.