It all depends on what is written in the HTML. Is there code such as php, asp, .net. It can also depend on the server, is the version of whatever software your using (e.g. Apache, IIS, nginx) vulnerable. There is more to it then what you may think. Also, are there other means to get into the server? (SSH, FTP, RDP, VNC). Is it easy to determine a possible username? If so, can we also attempt a bruteforce against the server, or will connections be blocked after N amount of attempts.
When you configure your server, you need to take into account a bit of information:
- "What is the purpose of this server? If it just a webserver, if so,
do I solely run httpd, or do I also need SSH access.
- "If I need SSH access, will I always be accessing the server from a
dedicated address, or a dynamic one? Can I block (firewall) all and
allow just me?"
- "If I am going to use PHP, is it something I have written, or is it
written by someone else? Has the code been tested for security
vulnerabilities (tampering, injection, etc)"
There are many variables to consider when putting up a webserver besides worrying only about the code.