What is the biggest cybersecurity risk for a small business website?

Stolen or weak logins. Phished passwords, reused passwords and admin accounts without multi-factor authentication give attackers the easiest way in, whether to your website, your email or your domain registrar.

Is SMS two-factor authentication good enough?

It is much better than a password alone, but it can be defeated by SIM swapping and real-time phishing. Use an authenticator app, a hardware security key or passkeys for important accounts like email, domain registrar, hosting and banking.

What are passkeys, and should my business use them?

Passkeys replace passwords with a cryptographic key stored on your device or password manager, unlocked by a fingerprint, face or PIN. They resist phishing because they only work on the real site. Turn them on wherever your key services support them.

How do I know if an email is a phishing attempt?

Be suspicious of urgency, unexpected attachments, requests to change payment details, and login links. Check the sender's actual address and go to the site directly instead of clicking. Verify payment or banking changes by phone using a number you already have.

Cybersecurity for small businesses: phishing, logins and the website front door

Most small business security incidents don't start with a sophisticated hack. They start with a phished password, a reused password, or an admin login with no second factor. Protect those first: turn on phishing-resistant multi-factor authentication for email, your domain registrar, hosting and website admin; use a password manager; train staff to spot phishing; and limit who has admin access. Then harden the website itself.

Think in terms of front doors

A small business has several front doors, and attackers try all of them:

Front door	What an attacker gets	First protection
Business email	Password resets for everything else, invoice fraud, impersonation	MFA (ideally passkeys or security keys), DMARC
Domain registrar	Control of your website and email routing	MFA, registrar lock, limited users
DNS provider (if separate)	Redirect your site or email	MFA, limited users
Hosting account	Your site, files, databases, backups	MFA, separate user accounts
Website admin (wp-admin, Webflow, Shopify)	Defacement, malware, customer data	MFA, fewer admins, updated software
Payment and banking portals	Money	MFA, alerts, call-back verification

Notice that email sits at the top. If someone controls your inbox, they can reset the password on almost everything else. Treat your email account as the master key.

Phishing: still the most common way in

Phishing emails and texts try to get someone to enter a password on a fake page, open a malicious attachment or approve a payment. They have become harder to spot because AI tools write convincing, error-free messages and can mimic a vendor's tone.

Common patterns aimed at small businesses:

Fake login pages for Microsoft 365, Google Workspace, your bank or your domain registrar.
Invoice and payment-change scams where a "vendor" asks you to update their bank details.
"Your domain is expiring" or "your site has been reported" notices with a link to log in.
Fake shared documents that ask you to sign in to view them.
Executive impersonation asking an employee to buy gift cards or send a wire, urgently.

Habits that stop most phishing

Never log in from a link in an email. Type the address or use a bookmark.
Verify any change to payment details by phone, using a number you already have, not one in the email.
Slow down on urgency. Pressure is the tell.
Report, don't just delete. A shared mailbox or quick message to whoever handles IT lets you warn the team.
Use a password manager. It will not autofill a password on a fake domain, which is a useful warning sign by itself.

Logins: MFA, passkeys and password managers

Multi-factor authentication, ranked

Not all MFA is equal. From strongest to weakest:

Passkeys and hardware security keys. Phishing-resistant, because they are tied to the real website's domain. A fake page cannot use them.
Authenticator app codes or push approvals with number matching. Strong, but a convincing fake page can relay a code in real time, and push prompts can be spammed.
SMS codes. Better than nothing, but vulnerable to SIM swapping and relay attacks.
Password only. Not acceptable for any business account.

Turn on the strongest option each service supports, starting with email, registrar, hosting and banking.

Passkeys

A passkey replaces a password with a key pair: the private half stays on your device or in your password manager, and you unlock it with a fingerprint, face or PIN. Google, Microsoft and Apple accounts support them, as do a growing number of business tools. Because a passkey only works on the site it was created for, it shuts down the fake-login-page attack almost entirely.

Password managers

A business password manager gives everyone unique, strong passwords, lets you share access to shared accounts without sharing the password itself, and lets you revoke access when someone leaves. It is one of the highest-value tools a small business can adopt.

Access hygiene

Many incidents come from access nobody remembered granting.

One person, one login. No shared admin accounts. Shared logins make MFA awkward and make it impossible to know who did what.
Least privilege. Content editors don't need administrator rights. Contractors don't need permanent access.
Offboarding checklist. When an employee or vendor leaves, remove their access to email, website, hosting, registrar, analytics, ad accounts and social media the same day.
Own your accounts. Your domain, hosting and website should be registered to your business, not your developer's personal account. Invite vendors as users instead.
Review quarterly. List who has admin access to each front door and remove anyone who doesn't need it.

Hardening the website front door

Once logins are protected, look at the site itself. The details depend on the platform.

WordPress

WordPress powers a large share of the web, so it is a frequent target, almost always through outdated plugins, weak admin passwords or abandoned themes. The basics:

Keep core, themes and plugins updated, and remove anything you are not using.
Require MFA for every administrator and editor.
Limit login attempts and consider moving or protecting the login page.
Use a web application firewall, either from your host or a service in front of the site.
Choose hosting that isolates sites and handles server-level patching.

We go deeper in WordPress security: updates, plugins and hardening that actually matter, and our hosting guide covers what to look for in a host.

Hosted platforms (Webflow, Shopify, Squarespace, Framer)

The platform handles server security and patching. Your job is account security: MFA, limited users, careful review of third-party apps and embedded scripts, and the same offboarding discipline.

Static and headless sites (Next.js on Vercel or Netlify)

There is no public admin login on the site itself, which removes a common attack path. The risk moves to your Git repository, hosting dashboard, CMS account and API keys. Protect those with MFA and keep secrets out of code. See Netlify vs Vercel for setup tips.

Forms, the forgotten door

Contact and quote forms attract spam and, sometimes, abuse. Use server-side validation, spam protection that doesn't punish real users, and never email sensitive data (Social Security numbers, card numbers, health details) through a basic form. If you collect that kind of information, it needs a secure, purpose-built workflow. That matters especially for medical, finance and professional services firms.

Email authentication protects your name

SPF, DKIM and DMARC are DNS records that tell receiving mail servers which senders are allowed to use your domain. Without them, scammers can more easily send email that appears to come from you to your own customers. Google and Yahoo now require bulk senders to authenticate their mail, and a DMARC policy is good practice for every business domain. We walked through the setup in domains, DNS, SSL and email authentication.

Plan for the bad day

Even well-protected businesses have incidents. Prepare before you need it:

Backups of your website and key business data, stored separately and tested. Our backups and ransomware guide covers the 3-2-1 approach.
A contact list: who to call at your host, registrar, bank, IT provider and insurer.
Know your recovery options for key accounts: backup codes stored safely, more than one admin on critical accounts.
Check your cyber insurance requirements. Many policies expect MFA and backups as conditions of coverage.

A one-afternoon checklist

Turn on passkeys or app-based MFA for email, registrar, hosting, website admin and banking.
Set up a business password manager and move shared credentials into it.
Remove former employees and vendors from every account.
Downgrade anyone who doesn't need admin rights.
Confirm your domain and hosting are in the business's name.
Check SPF, DKIM and DMARC on your domain.
Update or remove outdated website plugins and themes.
Confirm backups exist and that you know how to restore them.
Send the team a short note on phishing habits: no logins from email links, verify payment changes by phone.

For the website side in more detail, our original small business website security checklist is still a good companion.

The short version

Protect the logins first, especially email. Use phishing-resistant MFA, a password manager and tight access control. Then keep the website updated, minimal and backed up. Most attacks on small businesses are opportunistic, and these steps put you out of reach of most of them.

Want help locking down your website and accounts? See our care and security plans or contact us.