Your business security checklist

• Using a password manager (see Why you need a password manager)
• Unique, strong password for every account, no reused passwords
• Password manager installed on all devices you use for work
• Master password for the password manager is long and memorable (a passphrase)
• Whatever recovery item your password manager gives you (1Password's Emergency Kit, Bitwarden's recovery code) printed and stored somewhere physically safe

Saved in this browser only.

• 2FA enabled on your primary email account
• 2FA enabled on your website CMS login (WordPress, Webflow, Squarespace, etc.)
• 2FA enabled on your hosting account
• 2FA enabled on your domain registrar account
• 2FA enabled on financial accounts (banking, Stripe, PayPal)
• 2FA enabled on your password manager
• 2FA enabled on social media accounts (Facebook, Instagram, LinkedIn, etc.)
• Using an authenticator app rather than SMS for 2FA where possible
• Backup codes saved for every account with 2FA

Saved in this browser only.

• Business email hosted on a reputable platform (Google Workspace or Microsoft 365)
• Not using a personal Gmail or Hotmail for business communication
• SPF, DKIM, and DMARC records configured for your domain (ask us)
• Team is trained to recognize phishing (see How to recognize phishing attempts)
• Verified process for financial requests (phone call confirmation, never email alone)

Saved in this browser only.

• WordPress (or other CMS) is up to date
• All plugins and themes are up to date
• Unused plugins and themes deactivated and deleted
• Security plugin installed (Wordfence, or Kadence Security: the plugin previously sold as Solid Security)
• Login attempt limiting enabled
• Default "admin" username not in use
• SSL certificate active: site loads on https://
• Website backups running automatically: daily or more frequent
• Backups stored off-site (not just on the same server)
• Backup restore tested at least once

Saved in this browser only.

• Know which registrar holds your domain
• Domain lock (Registrar Lock) enabled
• 2FA enabled on registrar account
• WHOIS privacy enabled
• Auto-renew enabled, or expiry date noted on your calendar
• Domain registered to your business, not a past developer

Saved in this browser only.

• Every team member has their own login, no shared passwords
• People have only the access level they need (no unnecessary admin roles)
• Former employees and contractors have had all access removed
• Offboarding checklist exists and is used (see Security steps when someone leaves)
• Social media accounts have at least two people with top-level access (full control on a Facebook Page, super admin on a LinkedIn Page)

Saved in this browser only.

• All devices have a lock screen with PIN, password, or biometrics
• Operating system auto-updates are enabled on all devices
• Full-disk encryption is enabled (FileVault on Mac; on Windows, BitLocker on Pro, Enterprise and Education editions, or Device Encryption on Home)
• Remote wipe is configured for all devices (Find My for Apple, Find Hub for Android)
• No sensitive work done on unsecured public Wi-Fi without a VPN
• Work devices not shared with others casually

Saved in this browser only.

• 2FA on all social media accounts
• Admin access reviewed: removed anyone who no longer needs it
• Third-party apps connected to social accounts reviewed: revoked anything unused
• Marketing tools (Mailchimp, etc.) reviewed for outdated access

Saved in this browser only.

• Know how to report a problem to Chykalophia
• Know how to contact your hosting provider's support
• Know where your most important account recovery codes are stored
• Know what to do if the site is hacked (see What to do if your site is hacked)
• Know what to do if an account is compromised (see What to do if an account is compromised)
• Business insurance reviewed to understand cyber/fraud coverage

Saved in this browser only.

• Privacy policy on your website: current and linked in the footer
• Cookie consent banner in place (if applicable)
• Marketing email list is opt-in only
• Process in place for handling data deletion requests
• Customer data stored only in systems with appropriate security

Saved in this browser only.

• Review all account passwords for any that are weak or reused
• Review who has access to all systems
• Check domain expiry and auto-renew settings
• Review data you are holding: delete what you no longer need
• Test your backup restore
• Review your privacy policy for any needed updates

Saved in this browser only.