GDPR and your website
When you created your GDPR conformance policy, you should have given consideration to where data is located in your organisation. If you do not know where it is located, you cannot really claim to control it.
The websites I have created over the last 5 years do not contain a lot of user data by design. The data in the site, other than what is visible to the public is generally limited to the administrators and editors on the site, things such as email addresses and where subscriber lists are present there may be subscriber names and email addresses held in the site. But not much else.
This means if a hacker gets into a site, there is not really very much there which might be of value to them.
I am aware of some sites though that contain copies of forms being submitted through the site. This can occur if someone else has added a form manager that does this, or a database extension to collect and store user submitted information.
There is no value in keeping copies within the website if the email function is working and all user submitted data is sent to your organisation for processing. In fact retaining copies of previously submitted forms will likely contain sensitive information which could represent a data breach if the data fell into the wrong hands.
Check your website
It is worth checking your website to make sure there are no records of previous form data being retained in the website. If you find something and you know this data has been submitted to the organisation through an email account, you do not need copies on your website. So delete them all. It is worth considering whether it is possible to stop copies being retained, or if you cannot stop copies being retained, make a note to revisit your site and delete them regularly. A form manager that does not retain copies might ultimately be a better choice for the future.