A small business cybersecurity checklist covers six areas: your website, your email, your domain and reputation, ongoing monitoring, team access, and backups. Start with multi-factor authentication on email and banking, automatic updates, and backups you have tested. Most steps take minutes, cost little or nothing, and together they make your business a much harder target.
This checklist walks you through the handful of habits that do the most good for a small business. You don't need special software or an IT department. Work through one section at a time, tick things off, and come back to the printable version whenever you want a quick check.
IntroductionWhy does cybersecurity matter for small businesses?
Small businesses are often targeted because criminals expect fewer defenses, not because they're especially valuable. The most common problems are ordinary ones: stolen email passwords, fake invoices, and impersonation emails that trick a customer or employee into sending money. The FBI notes that business email compromise "continues to target small local businesses to larger corporations."
Cybersecurity doesn't have to be complicated. A few consistent habits make a huge difference.
The steps below follow the same ideas as the NIST Small Business Quick-Start Guide, the FTC's Cybersecurity for Small Business guidance, and CISA's Cyber Essentials, translated into plain English.
The checklistYour step-by-step cybersecurity checklist
Pick a section to jump to its checklist and guidance.
Check HTTPS, your certificate, updates and admin logins.
Jump to section 2Put MFA on every mailbox and publish SPF, DKIM and DMARC.
Jump to section 3Keep your domain renewed, locked and off blocklists.
Jump to section 4Catch expiring certificates and broken records with a monthly check-up.
Jump to section 5Manage who can get into what, and help your team spot scams.
Jump to section 6Keep an offline backup and make sure you can restore it.
Jump to sectionSee how your website measures up right now
Run a free outside-in check of your website, email and domain settings and get a plain-English report of what to fix first.
- Free check
- No signup
- No changes to your website
How do I secure my business website?
Your website is visible to everyone on the internet, including automated attack tools. Website problems usually come from missing encryption, out-of-date software or weak admin logins. Most hosts and website builders handle a lot of this for you, so your job is to confirm the settings are switched on.
- Your site loads over HTTPS with the padlock, and visitors who type http:// are sent to https:// automatically.
- Your SSL certificate is valid and set to renew automatically.
- Your website platform, theme and plugins update automatically, and anything you don't use is removed.
- Hosting, website admin and domain accounts all use multi-factor authentication.
- Only the people who need admin access have it, and each person has their own login.
- Recommended security headers are in place (HSTS, Content-Security-Policy, X-Frame-Options and others).
- Your server doesn't advertise exact software version numbers.
- Old encryption versions (TLS 1.0 and 1.1) are switched off.
If a browser shows a "Not secure" warning, start with our guide on why your website says Not Secure. If your SSL certificate has lapsed, see what to do when an SSL certificate expires. WordPress owners can follow the WordPress security checklist for platform-specific steps. If security headers are new to you, start with HSTS, which tells browsers to always use the encrypted version of your site.
Your next step: run the free website security scan and fix anything marked "Needs attention" first.
How do I secure my business email?
Email is where most small business scams start. Criminals either break into a real mailbox or send messages that look like they come from you. A few settings make both much harder.
There are two halves to email security. The first is protecting your own accounts with multi-factor authentication (MFA). The second is publishing three DNS records that tell other email providers which messages really come from you: SPF, DKIM and DMARC. The FTC recommends all three for any business that uses its own domain for email.
- Every mailbox uses multi-factor authentication, starting with owners, managers and anyone who handles payments.
- Your domain has exactly one SPF record listing every service that sends email for you.
- DKIM signing is turned on in Google Workspace, Microsoft 365 or your email provider.
- Your domain has a DMARC record, starting at p=none and moving to p=quarantine once your reports look clean.
- Any request to change bank details or send a payment is confirmed by phone using a number you already know.
- Your team knows how to report a suspicious email, and nobody gets in trouble for reporting a false alarm.
Requests to change payment details are the heart of business email compromise. The FBI's top prevention tip is to use a second channel, like a phone call, to verify any change in account information.
For the full setup, read how to stop email spoofing or SPF, DKIM and DMARC explained. If you use Google, there's also a Google Workspace security guide.
Then check your record with the free DMARC checker. If it's missing, follow how to fix a missing DMARC policy.
How do I protect my domain and reputation?
Your domain name (yourbusiness.com) powers both your website and your email. If it expires, gets hijacked, or lands on a blocklist, customers can't reach you and your emails go to spam. Most of these steps are one-time settings at your domain registrar or DNS host.
- Your domain is set to auto-renew, and the payment card on file is current.
- The registrar account uses multi-factor authentication and a contact email you check.
- Registrar lock (transfer lock) is turned on so nobody can move your domain without your approval.
- You know who controls your DNS settings, and that person isn't a former employee or old web designer.
- A CAA record names the certificate authority you use, so others can't easily get certificates for your domain.
- DNSSEC is switched on if your DNS host offers it as a simple toggle.
- Your domain isn't listed on phishing or malware blocklists.
A blocklist listing usually means something on your site was compromised. If that happens, start with how to tell if your website is hacked.
Today, log in to your registrar and confirm auto-renew, MFA and transfer lock are all on.
How do I keep an eye on things over time?
Certificates expire, plugins go out of date, and a new email tool can quietly break your SPF record. Calendar reminders and a monthly check-up catch these before customers notice.
- Re-run a website and email security scan once a month and after any website or email change.
- Read your DMARC reports, or the summary your email provider gives you, at least monthly while you're setting it up.
- Keep calendar reminders for domain renewal and certificate expiry dates, even if they auto-renew.
- Turn on sign-in alerts in Google Workspace or Microsoft 365 so you hear about logins from unusual places.
- Keep a short list of every online account your business uses, and review it each quarter.
- Watch your business bank accounts for payments or changes you don't recognize.
CyberVigil's free scan gives you a snapshot each time you run it. Automatic monthly monitoring with alerts is on the way. You can see what's coming on the pricing page.
Set a recurring monthly calendar reminder titled "Security check-up" and put a link to the scan in it.
How do I manage team access safely?
Most security incidents involve a person: a reused password, a convincing phishing email, or a former employee whose account was never closed. Clear habits around access solve a lot of this.
CISA recommends MFA for all users, "starting with privileged, administrative and remote access users," and giving people only the access they need for their job.
- Everyone has their own login. No shared passwords for email, banking or admin accounts.
- The team uses a password manager, with long, unique passwords (the FTC suggests at least 12 characters).
- Multi-factor authentication is required for email, banking, payroll, cloud storage and website admin.
- Admin rights are limited to the few people who need them.
- When someone leaves, their access is removed the same day and shared passwords they knew are changed.
- The team gets a short refresher on phishing and payment scams a few times a year.
- Guest Wi-Fi is separate from the network your business devices use.
- Laptops and phones that hold customer data are encrypted and lock automatically.
Your next step: write down every person who has admin access to email, banking and your website, and remove anyone who doesn't need it.
How do I back up and recover my business?
Backups are your safety net for ransomware, accidental deletion, a dead laptop, or a website that breaks after an update. The key word is tested. Until you've restored from a backup, you don't know it works.
The FTC recommends keeping backups that aren't connected to your network. CISA's ransomware guidance explains why: many ransomware variants try to find and delete or encrypt any backups they can reach.
- Important files, accounting data and customer records back up automatically.
- At least one backup copy is offline or otherwise disconnected from your everyday systems.
- You've tested restoring a file, and you know roughly how long a full restore takes.
- Your website has its own backups through your host or platform, and you know how to restore them.
- You have a one-page plan listing who to call: your IT helper, web host, bank, and insurance carrier.
- A printed copy of that plan and key phone numbers is kept somewhere you can reach without a computer.
- You know to report fraud to your bank right away and file a complaint at ic3.gov.
If a fraudulent payment goes out, speed matters. The FBI advises contacting your bank immediately to request a recall of the funds and filing a complaint with IC3 regardless of the amount.
Pick one important file today, delete a copy, and restore it from your backup to prove it works.
Quick checklist (printable)
Print this page or copy this list into a document. If you can tick every line, your business is in good shape on the basics.
Website
- HTTPS works and http:// redirects to https://
- The certificate auto-renews
- The platform and plugins update automatically
- Hosting and website admin accounts use MFA
- Security headers are in place
- Every mailbox uses MFA
- You have one SPF record, and DKIM is on
- A DMARC record is published and moving toward quarantine
- Payment changes get confirmed by phone
Domain and reputation
- The domain auto-renews, and the registrar has MFA and transfer lock
- You know who controls DNS
- Your domain isn't on any blocklist
Monitoring
- You scan monthly and check DMARC reports
- Sign-in alerts are on
- You review the account list quarterly
Team and access
- Everyone has a unique login and uses a password manager
- Admin rights are limited
- Anyone who leaves loses access the same day
- The team gets regular phishing refreshers
Backup and recovery
- Backups run automatically, with one copy offline
- You've tested a restore
- A one-page incident plan is printed
What should you do next?
You don't have to do everything this week. Start with the steps that protect money and email, then work through the rest over the next month.
- Turn on multi-factor authentication for your email, bank and website admin accounts today.
- Run the free website security scan to check your website, email and domain settings in one go. You can preview an example report first.
- Fix any missing email records using the DMARC checker and the SPF checker.
- Spend an hour on a simple cybersecurity risk assessment to decide what matters most for your business.
Common questions
What is the most important cybersecurity step for a small business?
Turn on multi-factor authentication (MFA) for your email, banking and website admin accounts. Many break-ins start with a stolen or guessed password, and MFA means a password alone isn't enough to get in. CISA lists it as one of the first things every small organization should do.
How much does small business cybersecurity cost?
Most items on this checklist are free. MFA, automatic updates, SPF, DKIM and DMARC records, and free HTTPS certificates are built into the tools you already pay for. The main cost is a few hours of setup and a little time each month to check on things.
Do I need an IT person to follow this checklist?
No. Every step is written for business owners without an IT department. A few items, like security headers or DNS records, involve copying settings into your hosting or domain dashboard. If you get stuck, your web host or domain provider's support team can usually help in minutes.
How often should I review my cybersecurity checklist?
Run through it once fully, then do a quick review every month and a full review once a year. Also revisit it whenever something changes, like a new website, a new email provider, or someone joining or leaving the team.
Does a free website security scan check everything on this list?
No. A free outside-in scan like CyberVigil's checks what anyone on the internet can see: HTTPS, your certificate, security headers, and your email and domain records. It can't see inside your computers, accounts or backups, so the team access and backup sections still need your own review.
Sources
- NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide (SP 1300) (National Institute of Standards and Technology)
- Small Business Cybersecurity Corner (National Institute of Standards and Technology)
- Cybersecurity for Small Business (Federal Trade Commission)
- Cyber Essentials (Cybersecurity and Infrastructure Security Agency)
- Business Email Compromise: The $55 Billion Scam (FBI Internet Crime Complaint Center)
- #StopRansomware Guide (Cybersecurity and Infrastructure Security Agency)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.