Security isn't an add-on

Most attacks on small businesses aren't clever. They walk through doors that were left open. Here's how to close them.

You don't need a security team to be safe online. You need a few habits, set up once and checked often. Start with these five.

1. Use HTTPS everywhere

Every page should load with the padlock in the browser. It protects what people type into your forms and it's a trust signal. Most hosts include a free certificate, so there's no reason to skip it.

2. Turn on multi-factor authentication

Add a second step to log in (an app code or a security key) on your website admin, email, domain registrar and social accounts. A stolen password alone then isn't enough to get in.

3. Keep everything updated

Old plugins, themes and apps are the most common way in. Turn on automatic updates where you can, remove plugins you don't use, and check monthly for the rest.

4. Give people only the access they need

Not everyone needs to be an admin. Give each person their own login with the lowest access that lets them do their job. When someone leaves, remove their access the same day.

5. Back up, then test the backup

Keep regular copies of your site and data somewhere separate from the live site. A backup you've never restored is a guess, so try a restore at least once a quarter.

Where to go next

The Australian Cyber Security Centre has free, practical guides for small businesses at cyber.gov.au, including the Essential Eight. It's a good checklist once these basics are in place.

Security works best when it's built in from the first plan, not patched on at the end. That's how we build every project.