In this article
Illustrative photo by Sasun Bughdaryan / Unsplash.
- Use a password manager and a unique password for every account.
- Turn on two-factor authentication for email, hosting, payments and your website.
- Keep software updated and test your backups.
Most small-business breaches are not sophisticated. They start with a reused password, a missed update or an account without two-factor authentication. The good news is that closing these gaps takes less than an hour. Work through this checklist once, then repeat it every quarter.
Use a password manager (5 minutes)
Memorising dozens of strong passwords is not realistic. A reputable password manager creates and stores long, unique passwords for you, so one breached site cannot unlock the rest. Protect the manager itself with a long passphrase.
Turn on two-factor authentication (10 minutes)
Two-factor authentication (2FA) adds a second proof, usually a code from an authenticator app or a hardware key. Enable it on the accounts that matter most, in this order:
- Your primary email account.
- Hosting and domain registrar accounts.
- Payment and banking accounts.
- Your website admin login (for WordPress, a two-factor plugin works well).
- Social and advertising accounts.
Prefer authenticator apps or security keys over text messages where the service allows it, and store backup codes somewhere safe and offline.
Update everything (5 minutes)
Outdated software is the most common way websites get compromised. Update your CMS, themes, plugins, and the operating system on your devices. Remove plugins and apps you no longer use, because unused code is still attack surface.
Back up and test the restore (5 minutes)
A backup you have never restored is only a hope. Schedule automatic backups of your site files and database, keep at least one copy off the server, and try a restore on a test copy at least once.
Limit access (3 minutes)
- Give each person their own login instead of sharing one.
- Use the lowest role that lets them do their job.
- Remove access immediately when a contractor finishes.
- Limit login attempts and hide default admin usernames.
Watch for phishing (2 minutes)
Be suspicious of urgent messages asking you to log in, pay or change details. Check the sender address, hover over links before clicking, and go to the site directly instead of following an email link.
Plan for the bad day
Write down who to call and what to do if an account is compromised: change passwords, revoke sessions, restore from backup, notify affected customers. Keeping the plan on one page makes it usable under stress.
Related reading
Good security also supports growth: visitors and subscribers trust sites that are safe. See how to grow your first 1,000 email subscribers and browse more in Security & Privacy.
Final thoughts
Security is a habit, not a product. Spend 30 minutes now, schedule a quarterly repeat, and you will avoid the majority of preventable incidents.