Does WP Ghost Protect a Plain HTML Website?

No. WP Ghost is a WordPress plugin, so it only protects WordPress websites. You install it from the WordPress dashboard, and everything it does, from the custom paths and the login protection to the 2026 Ghost Firewall and the logs, is built around WordPress files and paths.

A plain HTML website has no WordPress to install WP Ghost into. For a static site, ask your host what protection they offer at the server level, or put a CDN with a web application firewall in front of the site. If you move the site to WordPress later, you can add WP Ghost then.