Cyber security for small businesses: the plain-English guide
No jargon. The ten things that stop most attacks on small UK businesses, in the order we'd do them.
Most attacks on small businesses aren't clever. Criminals send millions of emails and scan millions of websites looking for the easy ones: reused passwords, missing email settings, out-of-date software. Fixing the basics moves you out of the easy pile.
1. Switch on two-step login for email
Your email is the master key: whoever controls it can reset every other password. Two-step login (a code on your phone) stops most account takeovers. Do Microsoft 365 or Google Workspace first, then banking and accounts software.
2. Use a different password everywhere
Let your phone's or browser's password manager create and remember them. Check whether your main passwords have been leaked.
3. Stop fake emails in your name
Set up SPF, DKIM and DMARC so fraudsters can't send invoices "from" you. Check yours and get the exact fix.
4. Agree a rule for bank detail changes
Never change who you pay based on an email alone. Ring the supplier on a number you already have. Tell everyone who pays bills.
5. Turn on automatic updates
On computers, phones, tablets and your website. Replace anything the maker no longer updates.
6. Keep your website software current
Out-of-date WordPress plugins and server software are the most common way small business websites get hacked. Run a free website check.
7. Back up, and test it
An automatic cloud backup, or a drive you unplug after each backup. Try restoring one file so you know it works.
8. Give people only the access they need
Separate admin accounts, and remove leavers from every system on their last day.
9. Teach everyone the warning signs
Urgency, secrecy, payment changes and unexpected logins. When in doubt, check the email before clicking.
10. Know what you'll do if it goes wrong
Keep your bank's fraud number and Action Fraud (0300 123 2040) somewhere you can find them. Our step-by-step help covers the common situations.
Going further: Cyber Essentials
If you do all of the above, you're most of the way to the government-backed Cyber Essentials certificate. Take the free readiness checklist.
Want us to keep watch for you?
Nimbo Shield re-checks your website and email for you, warns you the same day about new threats and tells you if your site goes down. Try it free for 14 days, no card needed.