@jsmith I think you should remove "login" privileges from all users except the admin. just viewing privilege stays on... if you need a more customized solution, you can remove "posting" privileges as well...

Cronjob sounds great. I would use the S3 to store the backup files. For backing up the site, I'd use 2 different solutions. Daily DB backup with Cronjob, and another one is instance snapshot. Installed NodeBB on a Docker instance, and what I need to do is that commit the instance once a week, output it as .tar file, store it somewhere reliable. For image assets, I prefer offshore storage like the S3, so the instance snapshot won't be really big in size..

Also, I must add. This is the smoothest backup experience I've ever had. It's literally a db dump and a single directory. Insanely quick! Love it!