Security Basics Every Online Business Owner Should Set Up

Use a different password everywhere

Reused passwords are the main way accounts fall. A service you signed up for years ago gets breached, the list gets published, and software tries that email and password against every major platform. Your hosting, domain registrar and email are the accounts where that hurts most, because whoever holds them can take your site.

You cannot remember a unique password for every account, which is why a password manager is not a luxury. It generates them, stores them and fills them in, and you remember one strong passphrase.

Turn on two-factor authentication

Two-factor means a stolen password alone is not enough. Turn it on for your email first — email is the reset path for everything else — then your domain registrar, hosting, payment provider and social accounts.

• Prefer an authenticator app over SMS, which can be intercepted by number takeover.
• Save the backup codes somewhere you can reach if your phone is lost.
• Do not disable it for convenience on a shared device.

Be careful on public Wi-Fi

Airport, café and hotel networks are shared and often badly configured. Most sites encrypt traffic now, but a hostile network can still see where you go, push fake login pages, and exploit anything that falls back to an unencrypted connection.

Have backups you have actually tested

A backup you have never restored is a hope, not a backup. Keep at least one copy of your site and your content somewhere separate from the host that stores the live version, and restore it once so you know the process.

• Export your content — articles, images, customer list — on a schedule.
• Keep one copy off the platform that runs the site.
• Restore a backup once a year to check it works.

Keep payments off your hands

Never store card numbers, and never build your own checkout form. Use a provider that hosts the payment page, so card data goes straight to them. It removes an entire class of risk and a lot of compliance work.

Also watch the everyday things: check who has access to your accounts after someone stops working with you, be sceptical of urgent emails about your domain expiring, and confirm any payment change request by a second channel before you act on it.