What's the right level of lockdown? Starting a page with "if not authorized, return 403" would've seemed adequate before this.

I'd suggest reading https://github.com/php/php-src/blob/master/php.ini-productio..., then doing a web search for "editing php.ini for maximum security".

Maybe compare with https://github.com/php/php-src/blob/master/php.ini-developme..., too.

Then similar for your web server (Apache, nginx, whatever).

EDIT: About your "would've seemed adequate before this" - I dug up a copy of a PHP v5.2 php.ini file (2-ish decades ago). That file begins thus:

   ;;;;;;;;;;;
   ; WARNING ;
   ;;;;;;;;;;;
   ; This is the default settings file for new PHP installations.
   ; By default, PHP installs itself with a configuration suitable for
   ; development purposes, and *NOT* for production purposes.
   ; For several security-oriented considerations that should be taken
   ; before going online with your site, please consult php.ini-recommended
   ; and http://php.net/manual/en/security.php.