Guide

Security basics for small business software and websites.

Most attacks on small businesses are not clever. They exploit reused passwords, unpatched software, over-generous access and staff tricked by a convincing email. Basic habits stop most of them. This guide gives a practical checklist for owners and managers. It is general information, and it is not a security audit.

Key takeaways

Turn on two-step sign-in for email, hosting, banking and every admin account.
Update software and plugins promptly, and remove what you do not use.
Give people only the access their job needs, and remove it when they leave.
Keep backups that have been tested, stored away from the main system.
Know in advance who does what if something goes wrong.

Sign-in and accounts

Use a password manager and a different, long password for every service. Reused passwords are the biggest single cause of break-ins.
Turn on two-step verification (an app code or a security key) for email first, since email resets everything else, then for hosting, domain, payment, accounting, social and admin accounts. Prefer an authenticator app or key to text messages where you can.
No shared logins. Each person has their own account, so you can see who did what and switch one off.
Separate admin accounts from everyday ones, and have more than one administrator so you are never locked out.
Review who has access at least twice a year, and remove leavers the same day.

Keeping software up to date

Apply updates to your website platform, plugins, apps, operating systems and devices. Most attacks use weaknesses that have a fix available.
Remove what you do not use. Old plugins and abandoned test sites are common entry points.
Know what you run. Keep a short list of your systems and who is responsible for each.
Choose maintained software. A product nobody updates becomes a liability. See maintenance and support.

Backups and recovery

Back up the website, databases, documents and anything you could not recreate.
Keep a copy separate from the system it protects, so one incident cannot destroy both.
Test a restore at least once. A backup nobody has restored from is a hope, not a plan.
Write down the recovery steps, and who does them, in a place you can reach if your own systems are down.

People and phishing

Phishing emails and messages pretend to be a supplier, a bank or your own boss, and ask for a payment, a password or a click. Teach staff to pause on urgency and to check by another channel.
Payment changes need a second check. A request to change bank details, even from a known contact, should be confirmed by phone on a number you already hold.
Make reporting easy and blame-free. People who fear punishment hide mistakes, and the damage grows.
Keep devices locked and encrypted, and be able to wipe a lost phone or laptop.

Your website and software

Use https everywhere, and keep certificates renewed.
Collect less data. Information you do not hold cannot leak. See the PDPO guide.
Keep secrets out of code, and out of messages and shared documents.
Limit who can reach the admin area, and require strong sign-in there.
Have logs, so that if something happens you can see what.
Test before relying. A security review before launch, and after major changes, is cheaper than a breach.

Questions to ask suppliers

How is our data protected, and who at your company can see it?
Where is it stored, and which outside services touch it?
How do you handle updates, backups and incidents, and how fast will we be told about a problem?
What happens to our data if we end the contract?
Which of these can you evidence, rather than describe?

We do not claim security certifications on this site; we are glad to answer specific questions about the controls for your project.

If something goes wrong

Contain it. Change the passwords, disconnect affected devices and switch off the compromised account.
Find out what happened and what data may be affected, with help if needed.
Tell the right people. That may include customers, your bank and the authorities. Hong Kong's privacy regulator publishes guidance on data breaches, and you should take professional advice on your duties.
Learn from it, and fix the cause, not only the symptom.

Frequently asked questions

We are small. Would anyone target us?

Attacks are mostly automatic and indiscriminate, so small firms are hit too, and they often have weaker defences. Basic habits protect you against most of it.

Is two-step sign-in really worth the bother?

Yes. It stops most account takeovers even when a password is stolen. It is the single most effective step for the effort.

Do we need a security audit?

For systems that hold sensitive data or process payments, an independent review is wise. For a small brochure site, the basics here go a long way.

Unsure how safe your systems are?

Tell us what you run and what it holds. We will point to the gaps worth closing first.

Request a project quote