Whether the database itself is locked down or not, we cannot determine.
But I would say it is unlikely, especially since you have to change the front end behaviour anyway, to avoid tons of error messages.
Instead, all interfaces (front end and APIs if present) are told to lock down, presumably via a config variable, and will then not do any write operations to the database, and probably even use a local cache instead of reading from the database.
I have no insider info on StackOverflow, but I can't think of any other way this could work properly.
As for your "implementation":
On MySQL level you shouldn't really do anything, especially since you probably need to change some things in the database during maintainance.
In PHP, you can do something like this for the APIs or all GET/POST target pages:
if(!$config['readonly'])
{
$db->query('UPDATE `someTable` SET `whatever` = "whocares"');
}
and the same for the front end:
$template->renderViewButton();
if(!$config['readonly'])
{
$template->renderUpdateButton();
$template->renderLikeButton();
}
Just hide any elements that change things in the database, and don't forget to restrict the receiving pages too, as anyone with some dev knowledge can craft their own HTTP request and could probably break your website if you don't secure it (same reason adding readonly
to an HTML <input>
is not sufficient).