Protect email and administrator accounts first
Email accounts are especially valuable because password resets, invoices, customer conversations, and cloud-service notifications often flow through them. If an attacker controls email, they may be able to reset other accounts or impersonate the business.
Start with unique passwords and multi-factor authentication for email, hosting, domain registrar, cloud dashboards, banking-related services, and website administration. Administrative access should be limited to the people who genuinely need it.
- Use a password manager instead of reusing passwords.
- Enable multi-factor authentication wherever it is available.
- Remove unused admin accounts and old staff access quickly.
Keep systems patched
Many compromises do not require a sophisticated attack. They rely on known vulnerabilities in outdated software. Website platforms, plugins, operating systems, browsers, routers, and business applications should receive security updates on a defined schedule.
For a production website, updates should be backed by a rollback plan. A small staging environment or recent backup can reduce the risk of an update causing downtime.
- Know which systems you are responsible for updating.
- Do not leave abandoned plugins or scripts installed even if they are disabled.
- Schedule routine maintenance rather than waiting for a warning.
Back up the data that keeps the business running
A backup is useful only if it is separate enough from the original system and can actually be restored. Ransomware, accidental deletion, a bad software update, or a hosting failure can all create recovery situations.
Decide what data is critical, how much data loss is acceptable, and how quickly it must be recovered. Then test the restoration process periodically.
- Keep more than one recent backup generation.
- Store at least one copy separately from the primary server or computer.
- Test that databases, files, and configuration can be restored together.
Reduce phishing risk with process controls
Security awareness is important, but people are more reliable when the business process itself makes fraud harder. For example, a payment-account change should require confirmation through a known phone number rather than relying only on an email request.
Train staff to inspect unexpected login pages, urgent payment requests, attachment prompts, and messages that ask for credentials. Encourage reporting without embarrassment so a suspicious message can be checked quickly.
- Verify bank-detail changes through a second trusted channel.
- Do not approve unexpected multi-factor prompts.
- Hover or inspect links before entering credentials.
- Report suspicious messages to whoever manages IT.
Limit access and separate roles
Employees and applications should have the access needed for their work, not unrestricted access by default. This reduces the damage a compromised account can cause.
For websites, database users should have appropriate permissions, public upload directories should not execute arbitrary code, and administrative areas should not be exposed to search engines. For office systems, separate administrator accounts from everyday browsing accounts where practical.
- Use role-based access where the platform supports it.
- Review access when people change roles.
- Keep API keys and database passwords out of public repositories.
Prepare a simple incident plan
When something suspicious happens, speed and clarity matter. A one-page incident plan can state who to contact, how to isolate an affected device, where backups are located, who controls domains and hosting, and how customers will be informed if necessary.
The purpose is not to predict every attack. It is to avoid improvising basic decisions while the business is under pressure.
- Record the domain, hosting, email, and cloud account owners.
- Keep provider support details available outside the affected system.
- Define who can authorize password resets, shutdowns, restores, and customer communication.