I solved this with a script, tied to keyboard shortcut: CTRL+SUPER+DELETE.
Create the script in /usr/local/bin, and call it something like lock_and_suspend:
$ sudo gedit /usr/local/bin/lock_and_suspend
Here's the script:
Update its permissions:
$ sudo chmod a+x /usr/local/lock_and_suspend
$ sudo chmod 711 /usr/local/lock_and_suspend
$ sudo chown yourusername /usr/local/bin/lock_and_suspend
And run it by simply typing lock_and_suspend at the command line. Or tie lock_and_suspend to a keyboard shortcut with SettingsManager > Keyboard > Application Shortcuts.
It works by simply locking the screen before suspending the system. The sleep command is necessary because the screenlock needs time to take effect. Suspend will stop it before it has finished if there is no pause between them.
You may need to install xscreensaver. The screenlock is usually executed by xlock4. But xlock4 just cycles through possible screenlockers such as xscreensaver and selects the one that works. I don't remember precisely why I did this. Suffice to say that it did not work when I attempted to lock the screen using xflock4 (using its default keyboard shortcut of CTRL+ALT+DEL) before suspending the system.
Anyway, the point is that you actually to do three things: lock screen, suspend system, close lid. And from experience, you want to make sure the system is locked and suspended before closing the lid, because it's often been the case that when you rely on some setting to lock and suspend when you close the lid, it sometimes fails, and you've no way of checking without opening the lid. But since opening the lid wakes the system from suspend, how do you know if it had suspended? (It's a case of Schrödinger's cat. Or Fourdan's mouse). The only way to be sure is you lock and suspend the system before closing the lid. And the only convenient way to do this is with a single keyboard shortcut (CTRL+SUPER+DEL).
You might need to close backdoors to xscreensaver screenlock.
At some point I may have installed light-locker, and configured it to lock the screen. I don't remember if this was actually necessary.
$ sudo apt install light-locker
$ xfconf-query -c xfce4-session -p /general/LockCommand -s "light-locker-command --lock" --create -t string
It might also be necessary to enable xscreensaver and power manager in Settings > Sesstion and Startup > Application Autostart. And perhaps to uninstall / disable gnome-screensaver.
You might want to install xfce4-power-manager, and to configure it (using settings manager or
xfce4-power-manager --customize) to 'suspend', 'when laptop lid is closed'. In that case, you might need to configure power manager to handle the lid close event properly. But I was inclined to lock+suspend before closing the lid.