Accounts
- Two-step sign-in on email, the domain registrar, banking, payments, the website and social accounts. Which accounts first.
- A password manager, so every password is unique. Password managers for small teams.
- Each person has their own login; access removed the day someone leaves. The offboarding checklist.
- SPF, DKIM and DMARC set, with DMARC enforced at quarantine or reject. How to set up DMARC.
- A written rule: bank detail changes are confirmed by phone on a known number. Business email compromise.
- Mailbox forwarding rules and connected apps reviewed every few months.
Domain
- Registered in the business’s name, in an account you control. Who owns your domain.
- Auto-renew, transfer lock and two-step sign-in on.
- Obvious look-alike domains registered.
Website
- HTTPS everywhere and the security headers on. Security headers explained.
- Platform, plugins and server software updated. WordPress security checklist.
- Forms send securely and don’t email sensitive data around. Contact form security.
- A privacy policy that matches what the site does.
- Monitoring that tells you within minutes if the site goes down or changes.
Backups
- Website and business data backed up daily, kept separately, with a restore tested. Website backups.
When something goes wrong
- A one-page plan: who to call for the website, email, domain, computers and bank. Our who-to-call card is a start.
- Cyber insurance considered, with honest answers on the application. Cyber insurance questions.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.