Every October, cyber security month rolls around and the internet fills up with padlock icons and vague warnings about hackers in hoodies. Most of it has little to do with what actually breaks a small business website or email system.
We have spent 25 years fixing the aftermath of the boring stuff. Not sophisticated attacks, just neglected admin: a lapsed domain, a backup nobody tested, an old login nobody cancelled. None of it makes for a dramatic LinkedIn post. All of it is entirely preventable.
Here are four checks worth doing this month, before it becomes next month's emergency.
Check Who Actually Owns Your Domain
Ask three questions. Is auto-renew switched on? Is the payment card behind it still valid? And whose name is the domain actually registered in?
That last one catches people out more than it should. We regularly meet businesses where the domain sits under a former employee's personal account, an old agency's details, or a card that expired two finance managers ago. When a domain lapses, the website and every email address attached to it stop working at the same time. It tends to happen on a Sunday, when nobody is watching and support lines are closed.
Five minutes in your registrar account settings this week saves a frantic Monday morning later.
Know What Platform the Site Is Actually Running On
Websites do not announce when they fall out of date. A site built on an old CMS or an unsupported plugin framework will carry on rendering perfectly well for visitors, right up until it becomes the easiest route in for anyone looking to compromise it.
Security updates get phased out long before a platform visibly stops working. That gap, between "still functions" and "still supported", is where most small business breaches happen. Not through sophisticated exploits, but through known, published vulnerabilities in software nobody got round to updating.
If no one in the business can say with confidence what the site is built on and when it was last updated, that is the first thing to find out.
Test the Backup, Don't Just Trust It Exists
Having a backup and having a backup that works are different things. We have seen businesses discover, mid-crisis, that their nightly backup had been quietly failing for months, or that the restore process required a password nobody still had, or that the backup covered the database but not the files.
A backup nobody has ever restored is not a safety net. It is an assumption with a filename attached to it. The only way to know a backup is genuinely useful is to restore it somewhere safe and check the result looks like the live site. Do that once, properly, and repeat it periodically. It is tedious. It is also the single cheapest insurance policy available to a small business.
Audit Who Still Has Access
When someone leaves a business, does their login leave with them? In our experience, usually not. Most small businesses are carrying active accounts, on the CMS, on hosting, on email, on analytics, belonging to people who left two or three years ago.
Each of those accounts is a door that was never locked behind them. It does not need malicious intent to become a problem; a forgotten password reused elsewhere, or an account nobody remembered to disable, is enough. A proper access review, even an informal one done annually, closes gaps that otherwise sit open indefinitely.
Boring Beats Expensive
None of these four checks involve firewalls, penetration testing, or anything that photographs well for a security awareness campaign. They are domain admin, software maintenance, backup hygiene, and access control. The unglamorous basics that actually determine whether a small business website survives a bad week.
We build and maintain websites for a living, and the vast majority of the emergency calls we get trace back to one of these four things being left unchecked for too long. Fixing them in advance costs a fraction of fixing them after the fact.
If it has been a while since anyone looked properly at the domain, the platform, the backups, or who still has keys to the castle, our team is happy to run through it with you. It is a short conversation, and considerably less stressful than the alternative.
