Cyber Security on a Shoestring: A 12-Step Checklist for Small Businesses

Many small business owners assume attackers only go after big companies. In reality, most attacks are automated and opportunistic. Bots scan the internet for weak passwords, outdated websites and unprotected email accounts, and they do not care how big you are.

The good news: you don't need a security department or a large budget to block most of these attacks. This small business cyber security checklist covers 12 practical steps, most of which cost little or nothing and can be done in an afternoon or two.

Work through them in order. The first few steps give you the biggest protection for the least effort.

Why small businesses are an easy target

Attackers look for the path of least resistance. Small businesses often have:

• Shared or reused passwords across staff and services
• One email account that controls everything: banking, domain, hosting and social media
• Old laptops, routers or websites that no longer get updates
• No tested backup, so ransomware or an accidental deletion becomes a crisis
• No written plan for what to do when something goes wrong

Each of these is fixable. Government agencies such as the UK's National Cyber Security Centre publish a free small organisations guide to cyber security, and the US Cybersecurity and Infrastructure Security Agency offers cyber guidance for small businesses. The checklist below draws on the same core advice.

Steps 1–3: Lock down your accounts

Step 1: Turn on multi-factor authentication (MFA) everywhere it matters. Start with email, then banking, your domain registrar, web hosting, accounting software, social media and any admin panels. MFA means a stolen password alone is not enough to get in. Prefer an authenticator app or passkeys over SMS codes where the service offers them, because they are harder to phish or intercept.

Step 2: Use a password manager and unique passwords. Reused passwords are one of the most common ways accounts get taken over: one leak elsewhere opens every door. A password manager generates and stores long, unique passwords for each service, and business plans let you share logins securely without sending them in chat. While you are at it, change any default passwords on routers, cameras, printers and POS devices.

Step 3: Give people only the access they need. Not everyone needs admin rights. Use individual accounts instead of shared logins, so you can see who did what and remove access cleanly. Keep a simple list of who has access to which systems, and remove accounts the same day someone leaves.

Steps 4–6: Keep devices and networks safe

Step 4: Turn on automatic updates. Operating systems, browsers, phones, apps, website plugins and router firmware all receive security fixes. Enable automatic updates wherever possible, and plan to replace devices and software that no longer receive updates from the manufacturer.

Step 5: Use the protection already built into your devices. Modern Windows and macOS include malware protection and disk encryption. Make sure they are switched on, set screen locks with a short timeout, and enable "find my device" and remote wipe on laptops and phones in case one is lost or stolen.

Step 6: Secure your Wi-Fi and separate guests. Use WPA2 or WPA3 encryption with a strong password, change the router's admin password, and give customers a separate guest network. Keep payment terminals and POS systems off the guest network. If you use a POS system, ask your provider how it should be networked.

Steps 7–9: Protect your data and email

Step 7: Back up, keep a copy offline and test restores. A common rule of thumb is to keep three copies of important data, on two different types of storage, with one copy offsite or offline. Ransomware often targets backups that stay connected, so at least one copy should be separate from your everyday network or held in a backup service designed for this. Most importantly, test that you can actually restore files. An untested backup is only a hope.

Step 8: Know what data you hold and collect less. Make a short list of the personal and financial data you store: customer records, invoices, ID copies, card details. Delete what you don't need and avoid storing card numbers yourself; let your payment provider handle them. Less data means less to lose, and it also helps with privacy laws. See our GDPR-compliant website checklist if you serve customers in Europe.

Step 9: Protect your email domain. Ask whoever manages your domain to set up SPF, DKIM and DMARC records. These help receiving mail servers check that email claiming to come from your domain really does, which makes it harder for criminals to impersonate you and helps your legitimate emails reach inboxes.

Steps 10–12: Your website, your people and your plan

Step 10: Keep your website patched and monitored. Your website is public, so it is constantly scanned by bots. Keep the CMS, themes and plugins updated, delete anything unused, use HTTPS, and lock your domain at the registrar. Never install "nulled" (pirated) themes or plugins; they are a well-known way to plant backdoors. Learn the warning signs in our guide Is your WordPress site hacked?, or consider whether a static site would remove most of the risk.

Step 11: Train your team to spot phishing and payment fraud. Most attacks start with a message: a fake invoice, a "password expired" email, or a supplier asking to change bank details. Teach staff to check sender addresses, avoid unexpected links and attachments, and verify any payment or bank-detail change by calling a known number, never the one in the message. Make it easy and blame-free to report mistakes quickly.

Step 12: Write a one-page incident plan. Decide in advance who to call and what to do if an account is taken over, a laptop is stolen, ransomware appears or your website is defaced. Include contacts for your IT provider, web developer, bank, hosting company and domain registrar, plus where your backups are and how to restore them. Keep a printed copy, because you may not be able to reach your files during an incident.

Putting the checklist into practice

You don't need to do everything at once. A realistic schedule for a small team:

1. This week: MFA on email and banking, password manager, automatic updates
2. This month: backups with an offline copy, Wi-Fi and router fixes, access review
3. This quarter: email domain records, website hardening, staff phishing session, incident plan

Then review the list every six months, and whenever you add a new system, hire staff or change providers. Security is a habit, not a one-time project.

How HEXACODES can help

HEXACODES offers cyber security services alongside websites, e-commerce, apps and POS systems, so we can help you secure the systems we build and the ones you already run: website hardening and monitoring, secure hosting setups, email domain configuration and cleanup after a compromise. We learned some of this the hard way, having recently moved our own website off WordPress to a fast static site after cleaning up a spam-injection compromise.

If your website is outdated and hard to secure, a rebuild can be simpler than patching. We offer a full business website starting at $30/month. For a security review, contact us on WhatsApp or by email.

Frequently asked questions

What is the most important cyber security step for a small business?

Turning on multi-factor authentication for your email and other key accounts gives the most protection for the least effort. Email is usually the account used to reset every other password, so protecting it protects everything connected to it. Pair it with unique passwords from a password manager.

How much should a small business spend on cyber security?

Many of the most effective measures, such as MFA, automatic updates, built-in device protection and staff awareness, cost little or nothing. Paid items like a password manager, a backup service or website monitoring often carry modest monthly fees. Start with the free basics and add paid tools where your risk is highest.

Do small businesses really get hacked?

Yes. Many attacks are automated and look for weaknesses rather than specific targets, so a small business with an outdated website or a reused password can be hit just as easily as a large one. Common outcomes include hacked websites, hijacked email accounts, ransomware and invoice fraud.