Attacks on small businesses are mostly opportunistic. The defences that matter are unglamorous and cheap.
Access control first
- Multi-factor authentication on every business account — email, hosting, payments, ad platforms, social.
- A password manager, with no shared logins between people.
- Least privilege: admin only for those who need it, reviewed quarterly.
- Immediate removal of access when someone leaves. This is the single most commonly skipped step.
Backups you have actually restored
Automated daily backups of site, database and critical documents. At least one copy offsite and not writable by your main system. Then test a restore — an untested backup is a hope, not a plan.
Keep software current
Patch your platform, plugins, themes and dependencies on a schedule. Remove anything unused; every abandoned plugin is an unattended door. Prefer fewer dependencies overall, which is one reason we build client sites as static pages with a small surface area.
Payment and data handling
Use established payment providers and never store raw card data. Collect the minimum personal information you need, delete it when the purpose ends, encrypt what you keep, and know which of your tools hold customer data.
Train the people
Most incidents start with a convincing message. Teach the team to verify unusual payment or credential requests through a second channel, to distrust urgency, and to report suspected mistakes immediately without fear of blame. Fast reporting limits damage more than any tool.
AI-era additions
- Do not paste customer data, credentials or contracts into consumer AI tools; use business accounts with clear data terms.
- Expect more convincing phishing, including voice and video impersonation. Verification through a known channel is the defence, not spotting spelling errors.
- If you run AI agents, restrict what they can access and log what they do.
Have an incident plan before you need one
One page covering: who is called, which systems are isolated first, where backups live, how customers and regulators are notified, and who speaks publicly. Rehearse it once a year. Deciding this during an incident is how small problems become large ones.
A monthly ten-minute check
Review new accounts and access, confirm backups ran, check for pending updates, scan login alerts for anything unfamiliar. Ten minutes a month prevents most of what we get called about.