There is never a great reason to call .Site.BaseURL from a template. Hopefully we will deprecate that method at some point. Use the absURL and absLangURL functions instead.
Regarding the security notice, you can bypass Go’s protections by placing this in your site configuration: