Two-step sign-in: which accounts to protect first

In this order

1. Business emailEvery password reset for everything else goes here. If someone gets your email, they can get the rest. Every mailbox, including shared ones like info@.
2. Domain registrar and DNSWhoever controls these controls your website and your email. Turn on two-step sign-in and the registrar lock.
3. Banking and paymentsBank, payment processor, payroll.
4. Website and hostingAdmin logins for the site, the hosting account, and anything that can change the site.
5. Google Business Profile and social accountsA hijacked profile can change your phone number or post scams to your customers.
6. Everything else with customer dataBooking, CRM, accounting, file sharing.

Which kind of second step

• Passkeys or a hardware security key: the strongest, and they can’t be phished. Use them where offered, especially on email and the registrar.
• An authenticator app: a six-digit code that changes every 30 seconds. Good for most accounts.
• Text message codes: better than nothing, but they can be stolen by someone who talks your carrier into moving your number. Use an app instead where you can.

Don’t lock yourself out

• Save the backup codes each service gives you somewhere safe and offline.
• Add a second method or a second admin on accounts the business can’t lose.
• When someone leaves, remove their access the same day, and move any accounts tied to their personal phone.