A website security checklist you can finish this afternoon

Part 3 of 3 in our series on website security for business owners.

You can make your business website much safer this afternoon, and you don't need a developer to do it.

Part 1 covered how small business sites get hacked. Part 2 covered where each type of site is weakest. This part is the to-do list. Most steps mean logging into an account you already have and changing a setting.

1. Turn on two-step login

Two-step login means you approve each login on your phone after typing your password. Someone who only has your password can't get in. You'll also see it called two-factor authentication or MFA.

Turn it on for these accounts first:

• Your business email. Whoever controls it can reset every other password you have.
• Your domain registrar. That's the company where you bought your domain, like GoDaddy or Namecheap.
• Your website builder or host.
• Your payment processor and bank.

Use an authenticator app or a passkey if you can. Text message codes are weaker. A scammer can sometimes talk your phone carrier into moving your number to their phone.

2. Get a password manager

A password manager remembers your passwords and makes a new random one for each account. Bitwarden and 1Password both work well. The ones built into Apple and Google accounts are fine too.

Start with the accounts from step 1. If any of them share a password with another account, change it today.

3. Lock down your domain

Losing your domain is painful and slow to fix. Log into your registrar and check these settings:

• Auto-renew is on. Make sure the card on file won't expire soon.
• Transfer lock is on. This stops anyone from moving your domain to another company without extra steps. Some registrars call it registrar lock.
• The contact email works. Use an address you actually check, on a different domain. If your domain lapses, email on that domain stops working right when you need it.
• Two-step login is on. You did this in step 1, but double-check it here.

4. Remove old access

List everyone who can log into your website, domain, email admin or payment accounts. Remove anyone who no longer needs access. Former employees and past agencies are the usual leftovers.

Give everyone else only the access their job needs. Your social media person shouldn't be able to delete the website.

5. Update your software and delete what you don't use

• WordPress: Update everything and turn on auto-updates. Delete any plugin or theme you aren't using.
• Squarespace, Wix or Shopify: Review your installed apps and code snippets. Remove anything you don't use or don't recognize.
• Custom site: Ask your developer when the code packages were last updated. Agree on who handles updates from now on.
• AI-built site: Have someone who knows databases check who can read your data.

6. Test your backups

A backup only helps if it's stored away from your website and you can restore it. Find out where yours live and how often they run. Then restore one to a test copy to make sure it works. A lot of people find out their backups were broken on the day they need them.

Each website builder backs up different things. Check their help docs to see what's covered.

7. Confirm any change to where money goes

This step can save you more money than anything else on the list.

Set a rule for your business. Any request to change payment details gets confirmed by phone. Call a number you already had, and never the one in the message.

This covers vendors who say their bank details changed. It also covers "your boss" texting for a quick wire or gift cards. In part 1, we saw that these scams cost businesses over $3 billion in 2025. AI-written emails and cloned voices make the fakes harder to spot.

Tell everyone who handles money about the rule. Make it clear they'll never get in trouble for calling to check.

8. Collect less customer data

Any customer data you store can leak. If your contact form asks for a birthday or home address you never use, remove those fields. Data you never collect can't be stolen.

9. Write a short plan for a bad day

A note on your phone is enough. Write down how to reach whoever manages your site, even on a weekend. Add your bank's fraud phone number.

If money gets stolen, call your bank right away. Then file a report at ic3.gov. The FBI says fast reports give it a better chance to freeze the money.

If customer data may have leaked, talk to a lawyer about whether you have to notify anyone. The rules depend on your state and the type of data.

This post is general info, not legal advice.

If you want help

Once you've worked through this list, your site is much harder to break into. If you'd rather hand it off, our Launch + Care Plan covers security monitoring and backups for you. Get in touch and we'll go through your setup together.