The 15-minute security check for a small business

#What your business runs on

9 STEPSALL OF THEM, UNTIL YOU ANSWER

#Your check

The steps are in order of what matters most, so if you only have five minutes, start at the top.

1. 01Two-step login on your important accounts

   Start with your email. If someone gets into it, they can reset the password of almost everything else you use. Then do the same for the account where you bought your domain name, and for your website or store.

   Two-step login (often called 2FA) means that after your password, the site asks for a code from your phone. Passwords leak more often than people think, usually through some other site that got breached. In June 2024 that is how attackers got into the accounts of five WordPress plugin developers, and from there they hid a backdoor in plugins used on up to 35,000 websites.

   Source: Wordfence, Jun 2024

   Show me howHide the steps

   1. Email. Gmail or Google Workspace: go to myaccount.google.com, then Security, then 2-Step Verification. Outlook or Microsoft 365: account.microsoft.com, then Security. Anything else: search its help pages for “two-step”.
   2. Your domain. Log into the company you bought it from (OVH, IONOS, GoDaddy, Namecheap, Gandi, Cloudflare…), open the security settings and turn on two-step login. While you’re there, check the domain is locked (sometimes called transfer lock), so nobody can move it to another company.
   3. Your website, store or hosting account. Same thing, in its account or security settings.
   4. When it asks how you want to get your codes, choose an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password…) or a passkey if it offers one. Text messages work, but someone can talk your phone company into moving your number to their SIM card.
   5. Each service gives you backup codes. Print them or write them down and keep them somewhere safe: they get you back in if you lose your phone.

   You’re done when your email, your domain and your website all ask for a code when you log in on a new device.

   From the vendors: Google · Microsoft · Shopify · CISA, the US cyber agency

   Two-step login on your important accounts

   [x]DONE [ ]LATER [-]DOESN’T APPLY TO ME

2. 02Old logins from people who’ve left

   Think of the freelancer who built your site, an agency you worked with years ago, a test account, an employee who moved on. Their logins often still work, and nobody is keeping an eye on them.

   It’s also a good way to spot trouble. The backdoored plugins from the first step worked by quietly adding a new admin account, so an admin you don’t recognise is worth taking seriously.

   Show me howHide the steps

   1. WordPress: go to Users, then All Users, and click Administrator above the list. Delete anyone you don’t recognise or who doesn’t work with you any more. WordPress asks what to do with their pages: give them to your own account.
   2. Store or site builder: Settings, then Users, Staff or Team. Remove anyone who has left.
   3. Hosting, domain and email: look for “users”, “team” or “delegated access” and do the same.
   4. If someone who left ever knew a password you still use, change it.
   5. People who only write pages or posts don’t need to be administrators. In WordPress you can give them the Editor or Author role instead.

   You’re done when every admin is someone who works with you today.

   From the vendor: WordPress, roles

   Old logins from people who’ve left

   [x]DONE [ ]LATER [-]DOESN’T APPLY TO ME

3. 03WordPress plugins

   Plugins are the add-ons that give a WordPress site its contact form, its shop, its SEO settings. Each one comes from a different developer, and that’s where nearly all the security problems are. Of the 11,334 flaws found in WordPress sites in 2025, 91% were in plugins and 9% in themes. WordPress itself had 6.

   Fixes usually come out quickly. The trouble is sites that never install them, and bots go looking for exactly those.

   Source: Patchstack, State of WordPress Security in 2026

   Show me howHide the steps

   1. Go to Dashboard, then Updates. If your host has a one-click backup, take one first, then install everything that’s waiting.
   2. In Plugins, then Installed Plugins, click Enable auto-updates on each plugin. Then go to Appearance, Themes, open each theme and do the same.
   3. Delete the plugins you’ve switched off or don’t use, and every theme except the one your site uses (and its parent theme, if it has one). Switching a plugin off isn’t enough: its files stay on your server, and some flaws can be reached even when it’s off.
   4. For the plugins you keep, look them up on wordpress.org and check Last updated. If it’s been more than a year, the plugin is probably abandoned and nobody will fix its next flaw. It’s worth finding a replacement.

   You’re done when no updates are waiting, auto-updates are on, and there are no switched-off plugins left in the list.

   From the vendor: WordPress, auto-updates · WordPress, managing plugins

   WordPress plugins

   [x]DONE [ ]LATER [-]DOESN’T APPLY TO ME

4. 04Your hosting panel

   Your website runs on a programming language called PHP, and your host lets you pick which version. Older versions stop getting security fixes, so anything found in them later stays open. Right now (November 2026) versions 8.2 to 8.5 are still covered, and 8.2 drops off on 31 December 2026.

   While you’re in there, look for FTP and SSH. They’re two older ways into your server: FTP for uploading files, which sends your password unencrypted, and SSH for typing commands directly on it. They often get switched on once and forgotten.

   Source: PHP, supported versions

   Show me howHide the steps

   1. Find your PHP version. In WordPress: Tools, then Site Health, then Info, then Server. Or in your hosting panel (cPanel, Plesk or your host’s own), look for “PHP version” or “PHP selector”.
   2. If yours is older than 8.2, most hosts let you switch in one click. Take a backup first, switch to the newest version on offer, then open your site and check the main pages and the checkout still work. If something breaks, switch back and ask your host or developer which plugin needs updating first.
   3. In the same panel, find FTP accounts and delete any nobody uses. If you do still upload files that way, use SFTP instead, which is encrypted.
   4. Find SSH access. If nobody uses it, turn it off. If your developer does, ask them to use a key instead of a password.

   You’re done when you’re on PHP 8.3 or newer and every FTP or SSH login has a reason to exist.

   From the vendor: WordPress, hardening

   Your hosting panel

   [x]DONE [ ]LATER [-]DOESN’T APPLY TO ME

5. 05Files your website shouldn’t be showing

   Sometimes a website ends up with files on it that were never meant to be public: a full backup, an error log, or a settings file with your database password in it. Bots check every website for these, all day long.

   In August 2024, researchers at Palo Alto Networks found a group that had collected passwords and keys from settings files like these (they’re called .env files) on 110,000 websites. They used them to get into the owners’ cloud accounts, copied the data, and asked for a ransom.

   Source: Unit 42, Palo Alto Networks, Aug 2024

   Show me howHide the steps

   Type your website’s address and we’ll list the addresses bots try most often. Open each one. The links go straight from your browser to your site, so we never see them.

   ++++ YOUR WEBSITE

   >MAKE THE LIST

   1. Fine: a “not found” page, an error like 403 Forbidden, or just your home page.
   2. A problem: a page of text with words like DB_PASSWORD, API_KEY or SECRET, a list of files, or a download that starts on its own (you can cancel it, you’ve seen what you needed to).
   3. If you find one, delete that file in your hosting panel’s file manager, or ask your developer to. Then change every password and key that was in it, since there’s no way to know who saw it first.

   You’re done when every link in the list gives an error, a not-found page or your home page.

   From the vendor: WordPress, hardening

   Files your website shouldn’t be showing

   [x]DONE [ ]LATER [-]DOESN’T APPLY TO ME

6. 06Apps connected to your store

   Shopify, Wix and Squarespace take care of their servers and software updates for you. What they don’t take care of is the apps you’ve added. Each one was given permission to see things like your orders, your customers or your payments, and it keeps that access even if you stopped using it years ago.

   If the company behind an app gets hacked, gets sold or just stops maintaining it, that access is still there.

   Show me howHide the steps

   1. Open your list of apps. In Shopify it’s Settings, then Apps. In Wix and Squarespace, look for Apps or Extensions in your dashboard.
   2. Uninstall anything you don’t use any more. If you’re not sure what an app does, its page in the app store will tell you.
   3. Do the same with tools connected from outside, like Zapier, Make, your email-marketing tool or your shipping tool. Their settings usually have a list called “connected accounts” or “integrations”.
   4. For the apps you keep, check on the app store page that they still get updates.

   You’re done when every app on the list is one you actually use.

   Apps connected to your store

   [x]DONE [ ]LATER [-]DOESN’T APPLY TO ME

7. 07The box in your office

   A NAS, a VPN box or a router you set up yourself is basically a small computer with its own software, called firmware. If it can be reached from the internet, people can try to break into it from anywhere, and these boxes almost never get updated by hand.

   In January 2022, ransomware called DeadBolt locked the files on thousands of QNAP NAS boxes that were reachable online. QNAP had released a fix the month before; the boxes that got hit just hadn’t installed it. VPN boxes from Fortinet, Ivanti, SonicWall and Cisco also keep showing up on the US government’s list of flaws used in real attacks.

   Sources: The Hacker News, Jan 2022 · CISA, known exploited vulnerabilities

   Show me howHide the steps

   1. Not sure if you have one? Look at what’s plugged into your internet box. Anything with its own power supply and a brand name on it (Synology, QNAP, Netgear, Fortinet…) could be one. The label on it usually gives the address of its admin page.
   2. Update it. Log into its admin page, find Update or Firmware, install the latest version, and turn on automatic updates if it has them.
   3. Switch off remote access you don’t use. On a NAS that’s QuickConnect (Synology) or myQNAPcloud (QNAP), port forwarding and UPnP. On a router, look for “remote management” or “remote administration”. If you never use it from outside the office, turn it off.
   4. Change the admin login. No box should still have its factory password. On a NAS, turn off the built-in admin account and use your own, with two-step login.
   5. A VPN box has to be reachable from outside, that’s its job. So bookmark the maker’s security advisory page and check it every month. (Liaison checks these every week and tells you when yours is on it.)

   You’re done when the box is up to date, updates itself, and nothing on it is open to the internet without a reason.

   From the vendors: Synology, securing your NAS · Synology advisories · QNAP advisories

   The box in your office

   [x]DONE [ ]LATER [-]DOESN’T APPLY TO ME

8. 08Keys in your code

   An API key is basically a password that lets your code use a paid service like Stripe, AWS, OpenAI or your email provider. It’s easy to commit one to Git by accident. If the repository is public, or someone else gets into it, they can run up charges on your account or read whatever the key opens.

   Deleting the file afterwards doesn’t fix it, because Git keeps every old version. The key itself has to be replaced.

   Show me howHide the steps

   1. On GitHub, open each repository’s Settings, then Advanced Security (or Code security), and turn on secret scanning and push protection. Push protection blocks any commit that contains a key. Both are free on public repositories; for private ones it depends on your plan.
   2. Check that .env is in your .gitignore file, so settings files never get committed.
   3. Search your code for sk_live, AKIA and BEGIN PRIVATE KEY. Those are how a live Stripe key, an AWS key and a private key start.
   4. If a key was ever committed, revoke it with the provider and make a new one.

   You’re done when push protection is on, .env is ignored, and every key that was ever committed has been replaced.

   From the vendor: GitHub, secret scanning · GitHub, push protection

   Keys in your code

   [x]DONE [ ]LATER [-]DOESN’T APPLY TO ME

9. 09Backups, and who to call

   If something does go wrong, what matters is how quickly you get back to normal. That mostly comes down to two things: a backup that actually works, and knowing who to call.

   Restoring a backup once is the only way to know it works. And keep one copy of your important files somewhere that isn’t plugged in all the time, because ransomware encrypts every drive it can reach.

   Show me howHide the steps

   1. Your website: find where its backups are (a Backups page in your hosting panel, a backup plugin, or your builder’s settings). Check how many days back you can go, and whether a copy is kept somewhere other than your host.
   2. Have you ever restored one? If not, block 30 minutes this month to restore one onto a test copy, or ask your host or developer to walk you through it.
   3. Your files: the things you can’t lose (invoices, contracts, client files) should exist in two places, one of them not always connected to your computer.
   4. Write an emergency note, on paper: your host and domain company and how to reach their support, who has admin access to what, where the backups are, and how to put your site into maintenance mode or take it offline.

   You’re done when you know where the backup is, you’ve restored one at least once, and the note is in a drawer.

   Guidance: WordPress, backups · NCSC, the UK cyber agency’s small business guide

   Backups, and who to call

   [x]DONE [ ]LATER [-]DOESN’T APPLY TO ME