Attackers rarely hunt for one specific small company. They scan for easy targets: reused passwords, outdated software, open admin pages. Do these ten things and you are no longer easy.
011. Use a password manager
A unique, long password for every account is impossible to remember, so let a password manager do it. Reused passwords are the most common way accounts are taken over.
022. Turn on two-factor authentication
Add a second step to email, banking, your website admin and your hosting account. An authenticator app or a hardware key is stronger than text messages.
033. Keep everything updated
Operating systems, browsers, your website platform and its plugins. Old software with known flaws is the doorway most attacks use. Turn on automatic updates wherever you can.
044. Back up, and test the restore
Keep at least three copies, on two different kinds of storage, with one copy offline or off-site. A backup you have never restored is only a hope.
055. Protect your email domain
Set up SPF, DKIM and DMARC so nobody can send forged mail in your name. Our guide SPF, DKIM and DMARC explained walks through it.
066. Fix your website basics
HTTPS everywhere and the standard security headers. See the 9-point security headers checklist.
077. Give people only the access they need
Not everyone needs admin rights. Use separate accounts for administration and daily work, and remove access the same day someone leaves.
088. Train for phishing
Most attacks start with a convincing message. Teach the team to check the sender, hover over links, and confirm unusual payment or password requests through a second channel, such as a phone call.
099. Know what is exposed
Old test sites, forgotten admin panels and staging servers often stay online for years. Check which hostnames of your domain are visible to anyone.
Subdomain Exposure
Which hostnames of your domain are publicly visible, and which ones attackers love.
1010. Write a one-page incident plan
Who do we call, who can shut things down, where are the backups, who talks to customers. Ten minutes of planning saves hours when something goes wrong.
Key takeaways
- Passwords, two-factor and updates come first.
- Backups only count if you have tested a restore.
- Know what your domain exposes before an attacker does.
Want us to take a look at yours? Send us a message, we are happy to help.
Talk to us