Most small-business security incidents are not clever hacks. They are reused passwords, a convincing fake email, or an old account that nobody closed. The defences against these are simple and mostly free. This guide covers the essentials in order of impact, so you can protect your business accounts in an afternoon.
1. Use a password manager
People cannot remember dozens of strong, unique passwords, so they reuse a few. When one site is breached, attackers try the same email and password on other sites, and reused passwords fall like dominoes. A password manager creates and stores a different long password for every account, so you only need to remember one strong master passphrase. Choose a well-reviewed one, set a long master passphrase made of several random words, and store the recovery information somewhere safe offline.
2. Turn on two-step verification everywhere it matters
Two-step verification (also called two-factor or multi-factor authentication) asks for something in addition to your password. Even if your password is stolen, the attacker cannot get in. Turn it on first for:
- Your email accounts, because a hijacked email lets attackers reset every other password
- Banking, payment and accounting accounts
- Your domain registrar and web hosting
- Social media and advertising accounts
- Your password manager and cloud storage
Prefer an authenticator app, a security key or a passkey over text messages, because phone numbers can be hijacked. Save the recovery codes in a safe place.
3. Learn to spot phishing
Phishing messages try to rush you into clicking a link or sharing a code. Warning signs include:
- An urgent threat or deadline ("your account will be closed today")
- A sender address that looks almost right but is not, such as a swapped letter in the domain
- A request to log in through a link in the message, or to share a verification code
- An unexpected invoice, delivery notice or file share
- A message that seems to come from your boss or a supplier asking you to change bank details or buy gift cards
When in doubt, do not click. Open the website by typing its address yourself, or phone the person on a number you already know. No legitimate service will ask you for your password or a one-time code by message or phone.
4. Keep software updated
Updates fix security holes that attackers actively use. Turn on automatic updates for Windows, your browser, your phone and the apps you rely on. If you run a website, keep the platform, plugins, themes and server software up to date, and remove anything you no longer use.
5. Give each person their own account
Sharing one login among several people makes it impossible to know who did what, and impossible to remove one person's access without changing the password for everyone. Where a service allows it, create separate accounts with the lowest level of access each person needs. Use a password manager's sharing feature when a shared login is unavoidable.
6. Have an offboarding checklist
When a contractor, employee or agency stops working with you, remove their access the same day. Write a short checklist covering email, shared drives, the website admin, hosting, social accounts, advertising accounts and any tools you pay for. At the same time, change shared passwords they knew and revoke any access tokens.
7. Review connected apps and browser extensions
Over time you grant many apps access to your Google, Microsoft or social accounts. Review the list every few months and remove anything you do not recognise or use. Do the same for browser extensions, which can read the pages you visit and are a common route for malicious code.
8. Back up what matters
Ransomware and accidents both end the same way: lost data. Follow the 3-2-1 approach in our Windows backup guide, and keep at least one copy that is not permanently connected to your computer.
9. Protect your devices
- Use a screen lock with a PIN, password or biometric on every computer and phone.
- Encrypt laptops and phones so a lost device does not expose your data. Windows offers encryption on supported editions and hardware, and phones are usually encrypted by default when a lock is set.
- Install apps only from official stores or the developer's own website.
10. Know what you will do if it goes wrong
Decide in advance what you would do if an account were compromised. A short plan helps you act calmly:
- Change the password from a device you trust and sign out all other sessions.
- Check the account's recovery email, phone number and forwarding rules for changes.
- Turn on or reset two-step verification.
- Change passwords for any other accounts that used the same one.
- Warn customers or colleagues if messages may have been sent in your name.
- Report fraud to your bank or payment provider quickly if money is involved.
Where to start today
If you only have thirty minutes, do these three things: install a password manager and change your email password to a strong unique one; turn on two-step verification for your email; and turn on two-step verification for your bank or payment accounts. Those steps block the most common ways small businesses get hurt.