Comment by superkuh

This is where the very simple and stable "server side includes" (SSI) that every major webserver has had for 30 years come in. It's just enough templating power to make menu.html and include it in every page you care about without any significant attack surface. Working with static HTML fragments on the filesystem is such a delight compared to any CMS.