Two-factor authentication (TOTP)
Add a second factor: your password plus a 6-digit code from an authenticator app (Aegis, 1Password, Google Authenticator…). Recovery codes cover a lost phone.
Backups
Everything you own, in one click. The JSON export covers every table, with every password, key and other credential, every webhook URL, and visitors' phone numbers and IP addresses, redacted, so it is the copy you can hand to someone (after restoring it on a fresh install, re-enter your webhook URLs, as you do signing secrets); the database file is the rawest possible backup on SQLite installs and is not redacted.