Howard Miller

That's quite a different question. And rather more understandable.

You have a lot of granular control over what users can do what. See Roles_and_permissions. It sounds like you might consider creating a restricted role for your external users.

I don't know if it's relevant, but Moodle has built-in GDPR "stuff". My (well known) personal opinion is that it is all a bit of a mess but you may want to look at Policies and/or Data_privacy

Yes - they don't work. At least in my experience.

You don't need to use database sessions. You need to use shared sessions. Hence the recommendation to use Redis. Which does work.

At the very least, in the absence of any better ideas, it's something relatively cheap/straightforward to try.

I've managed to doggedly ignore the Moodle ci tools. No particular reason. It's probably very remiss of me...

Have you read Nginx ?

Some specific configuration is required for Moodle to work properly.