I have new to Hugo and dont know much more about security matters of it. My site have a big traffic from warsaw but no relation to this city. Because language of the site is not polish and no related content to this people. but traffic is so big as a new user. I am afraid there may be a csrf or some kind of unwanted traffic exploit this site. hugo is static as i know but some people may use my site as a proxy or something ?
As you said, Hugo produces static sites. This is therefore not a Hugo issue.
If you believe something is wrong, check what web server etc. you are using and ask for help in some server related forum.
Good luck!