Most small businesses don’t get hacked because they are “important”. They get hacked because they are easy—outdated software, weak passwords, no backups, and no process when something goes wrong.
This guide covers the foundations of digital security you can implement quickly, without needing a technical team.
1) Start with the real goal: reduce risk, not “be perfect”
Security is about lowering the chance of:
- someone taking control of your website, email, or social accounts
- customer enquiries being intercepted
- downtime that stops leads and sales
- reputational damage (and compliance headaches)
You don’t need enterprise security. You need consistent basics.
2) First thing first: Protect your email
If someone gets access to your email, they can reset passwords for:
- WordPress
- hosting
- social media
- banking apps
- domain provider
Do this today:
- Turn on Two-Factor Authentication (2FA) for email (Microsoft 365 / Gmail/ Yahoo)
- Use a unique strong password (never reused)
- Check forwarding rules (hackers often set hidden auto-forwarding)
- Review “recent activity / signed-in devices”
Best practice: use an authenticator app (Google/Microsoft Authenticator) rather than SMS where possible.
3) Use a password manager (and stop reusing passwords)
Password reuse is still the #1 reason accounts get compromised.
Minimum standard:
- A password manager (1Password, Bitwarden, Dashlane, etc.)
- 16+ character unique passwords for all critical accounts
- Never store passwords in notes, spreadsheets, or WhatsApp messages
If your team needs shared access (e.g., social accounts), a password manager is far safer than sharing logins.
4) Turn on 2FA everywhere (not just email)
Enable 2FA on:
- domain registrar (e.g., GoDaddy, Namecheap)
- website admin (WordPress)
- hosting panel
- social media accounts (Facebook, Instagram, LinkedIn)
- payment systems (Stripe, PayPal)
If you do only one thing after reading this post: enable 2FA.
5) Keep your website updated (especially WordPress)
For WordPress sites, most incidents come from:
- outdated plugins
- outdated themes
- weak admin passwords
- unused plugins left installed
If you have a WordPress website, your immediate checklist:
- Update WordPress core, theme, and plugins regularly
- Delete plugins you don’t use (deactivated isn’t enough)
- Avoid installing “free” plugins from unknown developers
- Limit admin users—only give admin rights to people who truly need it
6) Backups: assume something will break
Backups are your safety net for:
- hacking incidents
- plugin conflicts
- accidental deletions
- hosting issues
Minimum standard:
- automated daily backups (or at least weekly for brochure sites)
- keep backups for 14–30 days
- store at least one backup off-site (not only on the same server)
- test restore occasionally (a backup you can’t restore is useless)
7) Secure your website login (simple improvements)
If you run WordPress, do these:
- change default admin username (avoid “admin”)
- enforce strong passwords
- enable login protection (limit login attempts)
- use reCAPTCHA on login and forms
- use SSL (https)
If your site collects enquiries, form spam protection also prevents inbox overload and reduces risk.
8) Devices and Wi-Fi: don’t ignore the basics
Your website can be secure, but if your laptop isn’t, your accounts aren’t.
Recommended:
- keep macOS/Windows updated
- enable full disk encryption (FileVault on Mac, BitLocker on Windows)
- lock screen with a passcode
- avoid public Wi-Fi for admin work (or use a VPN)
- separate business and personal logins where possible
9) Recognise phishing (it’s getting smarter)
Phishing emails often look like:
- “Your invoice is attached”
- “Your Microsoft password expires today”
- “Payment failed—click to fix”
- “DocuSign/SharePoint file shared with you”
Rules:
- never sign in from a link in an email—go directly to the service
- check the sender address carefully
- if you’re unsure, verify via a second channel (call or WhatsApp)
10) A simple incident plan (so you don’t panic)
If you suspect compromise:
- Change passwords (start with email)
- Enable/verify 2FA
- Log out of all sessions/devices where possible
- Check forwarding rules in email
- Scan devices for malware
- Restore website from a clean backup (if needed)
- Inform customers only if there’s a real data risk (and document what happened)
A plan reduces damage.
Quick checklist
✅ 2FA on email + domain + hosting + social + WordPress
✅ Password manager + unique passwords
✅ Updates weekly (core/theme/plugins)
✅ Automated backups + restore tested
✅ Limit admin users + protect login
✅ Device updates + encryption + screen lock
✅ Phishing awareness + “no email links” rule
Want help tightening your setup?
If you want us to review your website security basics—updates, backups, login protection, and performance—we can do a quick audit and give you clear next steps.
🌐 limitunlimited.com
✉️ [email protected]
☎️ +44 121 725 3098 / +44 7545 839 711