Not seeing why you need WordPress.
The safest way I can see to make a secure connection across an untrusted network is to use a VPN of some sort, specifically a mesh network like Wireguard or Tailscale.
Tailscale has the advantage of being almost zero config, plus has the Serve and Funnel features which provide a mechanism to allow specific traffic into your Tailscale network.
Edit: Tailscale Serve is probably what I’d use.
Yea, if you use Tailscale with Funnel, you get a secure connection with no config required by the web user.