Security & when things break
Security
154 guides across 30 sections
Security23
- Business email compromise explainedWhat business email compromise (BEC) is, how it works, and the steps every small business can take to prevent it.
- Choosing a password managerA plain-English comparison of the most popular password managers to help you pick the right one for your business.
- Common email scams targeting businessesThe most common email scams used against small businesses, explained in plain English so you and your team can recognize and avoid them.
- Data privacy basics for your businessA plain-English introduction to data privacy: what data your business likely holds, your responsibilities, and how to handle it well.
- Device & Wi-Fi security basicsSimple steps to keep the computers, phones, and networks your team uses every day secure against common threats.
- How to create strong passwordsSimple, practical rules for creating passwords that are genuinely hard to crack, without needing to memorize complex strings.
- How to recognize phishing attemptsLearn to spot fake emails, texts, and websites before you click: practical warning signs explained in plain English.
- Keeping your accounts & website safePractical security guides for business owners and their teams, from strong passwords to what to do if something goes wrong.
- Malware & your website explainedWhat malware is, how it gets onto websites, what it does when it's there, and how to get it removed.
- Passkeys, explainedPasskeys are a new, password-free way to log in that is more secure and easier than passwords. Here is what they are and how they work.
- Safe browsing habits for your teamSimple, practical habits that keep your whole team safer when browsing the web, no technical expertise required.
- Securing your domain nameHow to protect your domain name from hijacking, unauthorized transfers, and DNS tampering, and what to do if something goes wrong.
- Securing your social media accountsHow to protect your Facebook, Instagram, LinkedIn, and other social media accounts from hackers and unauthorized access.
- Securing your WordPress siteThe key security settings every WordPress site owner should check, from keeping software up to date to limiting login attempts.
- Security steps when someone leavesThe security checklist to run every time a team member, contractor, or employee moves on, to protect your business and remove unnecessary access.
- Security terms, explained simplyPlain-English definitions for every security term you might encounter, from 2FA and brute force to VPN and zero-day.
- SSL & HTTPS, explainedWhat the security icon in your browser means, why every website needs HTTPS, and how SSL certificates work, in plain English.
- Two-factor authentication, explainedWhat two-factor authentication is, which type to use, and how to set it up on your email, website, registrar and other important accounts.
- Using an authenticator appHow authenticator apps work, which one to choose, and how to set one up on your phone for two-factor authentication.
- What to do if an account is compromisedA calm, step-by-step guide to recovering a hacked email, social media, hosting, or other business account, and locking down everything else.
- Why security matters for your businessA plain-English explanation of the real-world risks facing small businesses online, and why basic security steps make a big difference.
- Why you need a password managerPassword managers solve the hardest part of online security (having unique, strong passwords for every account) without the mental overhead.
- Your business security checklistEverything you need to secure your business online, on one page: work through it section by section and tick off each item.
Give us access20
- Delegate access vs. sharing a passwordWhy invitations and role-based access are safer than handing over your personal login details.
- Give us access to CleanTalkHow to share your CleanTalk anti-spam access key and control panel so we can configure spam filtering on your forms, comments, and registrations.
- Give us access to WordfenceHow to share your Wordfence license and grant us access to scan results, firewall rules, and security alerts on your WordPress site.
- Give us access to your Cloudflare accountHow to safely invite our team to manage your Cloudflare DNS, security, and performance settings.
- Give us access to your DreamHost hostingHow to grant Chykalophia account privileges in your DreamHost panel, and which privileges to tick.
- Give us access to your GitHub repositoryHow to safely invite our development team to your GitHub code repository for custom software and headless web builds.
- Give us access to your Kinsta hostingHow to invite Chykalophia as a company user or a single-site user in your MyKinsta account.
- Give us access to your Sucuri accountHow to give us access to your Sucuri website firewall and malware-monitoring account so we can respond to security alerts and clean infections.
- Give us access to your WP Engine hostingHow to add Chykalophia as a user on your WP Engine account so we can manage your hosting environment.
- Give us access to your WPMU DEV HubHow to invite Chykalophia as a team member in The Hub, and which role to pick.
- Give us WordPress admin accessHow to safely add our team as an Administrator in your WordPress dashboard so we can build and maintain your site.
- Give WordPress access with an application passwordA more secure alternative for granting access to third-party apps or specific API integrations without sharing your main password.
- Giving us access, explainedA practical guide to granting Chykalophia secure access to your website, hosting, and online accounts, so we can do our best work for you.
- How to revoke our access laterA step-by-step guide to securely removing our access when a project ends.
- How to share a password safelyWhen you absolutely must share a password with our team, here is the right (and wrong) way to do it.
- How we keep your logins safeOur strict internal security practices for handling, storing, and eventually removing your sensitive credentials.
- Share plugin & theme license keys with usHow to securely provide the premium software licenses we need to keep your website's tools updated and secure.
- Transferring accounts & ownership to youHow we ensure you have complete ownership and control of all your digital assets at the end of a project.
- Using a password manager with usHow to securely share credentials using popular password managers like 1Password or Bitwarden.
- Why we ask for access (and why it's safe)An honest explanation of why Chykalophia needs access to your accounts, what we do with it, and how you stay in control.
Developer platforms14
- Amazon Q Developer & AI code reviewWhat Amazon Q Developer's code review does, how access is granted through AWS, and what an automated reviewer can and cannot tell you.
- Amazon S3 access & file storageHow S3 buckets store application files, how access is granted, and how to share files without making a bucket public.
- AWS accounts & IAM accessHow AWS account access works: the root user, IAM users and roles, access keys, and the practices that prevent an expensive mistake.
- AWS KMS & encryption keysWhat AWS Key Management Service does, how key policies control access, why rotation matters, and why deleting a key is irreversible.
- ClamAV & scanning uploaded filesWhat ClamAV does, why applications that accept file uploads need malware scanning, and how it fits into a wider upload-security approach.
- Developer platforms & services → start hereReference guides for the hosting, cloud, and developer services behind custom applications: access, roles, secrets, and ownership.
- Environment variables & secretsWhat environment variables are, where secrets should live, how to rotate them, and why they must never be committed to a Git repository.
- Expo & EAS access for mobile buildsHow Expo organizations and roles work, what EAS Build does with signing credentials, and why app store ownership is the thing to get right first.
- Managed PostgreSQL accessHow managed Postgres databases are accessed, how roles and connection strings work, and what to check about backups before you need them.
- Render access & service ownershipHow Render workspaces, members, and services work: inviting people, managing environment groups, and transferring ownership.
- SendGrid access & transactional emailHow SendGrid teammates and API keys work, why sender authentication matters, and how to keep application email out of spam folders.
- Sentry access & error trackingHow Sentry catches application errors, how organization roles and DSNs work, and how to keep personal data out of your error reports.
- SurveyJS licensingHow SurveyJS commercial licenses work, which components are paid, how developer seats are counted, and keeping the license key out of public code.
- Vercel access & project ownershipHow Vercel teams and roles work, how to invite people, where environment variables live, and how to transfer a project you own.
Website care14
- Backup plugins explainedHow WordPress backup plugins like UpdraftPlus and All-in-One WP Migration work, where backups should be stored, and who holds the keys.
- End-of-life software & why it's riskyWhat "end of life" means for website software, why it's a serious security risk, and what to do about it.
- How backups workWhat we back up, how often, where backups are stored, what a good backup strategy looks like, and why backups are your most important safety net.
- Restoring your site from a backupWhat restoring your website from a backup involves: how we do it for WordPress sites on our care plan, what Squarespace, Shopify, Webflow, Wix and custom-coded sites can restore, and what to expect.
- Security monitoring explainedHow we watch for threats and suspicious activity on your website, and what we do when something looks wrong.
- Software updates explainedWhy we update your website's software regularly, what we update, and how we make sure updates don't break anything.
- Verifying your backups are workingA 30-second monthly check to confirm your backups are actually running, where to look on each platform, and what to do when the answer is no.
- Website care & maintenance, explainedEverything you need to know about how we keep your website healthy, secure, and running smoothly.
- What keeping a website running actually takesThe full list of recurring jobs a live website needs: how often each one comes round, what it involves, and what happens if it gets skipped.
- What not to touch on your websiteThe short list of settings that can take your site offline, why each one matters, and what to do instead when you need one changed.
- What our care plan coversA plain-English breakdown of every service included in our website care plan, no legalese, no jargon.
- When & how to request emergency supportWhat counts as a website emergency, how to reach us quickly, and what to do while you wait.
- Why websites need maintenanceYour website needs regular care to stay secure, fast, and working. This guide explains why in plain English.
- Your website health checklistThe complete checklist we run through to assess and maintain a healthy website: covering security, performance, content, and functionality.
WordPress11
- Dealing with spam commentsLearn how to handle spam comments on your WordPress site: how to block them, moderate them, and keep your comment section clean.
- How to remove a user safelyLearn how to safely delete a WordPress user, handle their existing content, and revoke access for contractors, former staff, or Chykalophia when a project ends.
- How to reset your WordPress passwordHow to recover access to your WordPress site when you've forgotten your password, using the built-in reset tool.
- How to update plugins safelyLearn how to update WordPress plugins safely, including what to do before you update and how to recover if something goes wrong.
- How WordPress backups workLearn how WordPress backups work, what gets backed up, where backups are stored, and how to restore if something goes wrong.
- Turning on two-factor loginLearn how to set up two-factor authentication on your WordPress site to protect against unauthorized login.
- What to do before a big updateA pre-update checklist for WordPress site owners: everything to do before applying a major WordPress, plugin, or theme update.
- Why updates matterLearn why keeping WordPress, plugins, and themes updated is essential for your site's security, stability, and performance.
- WordPress security basicsA practical guide to the most important security steps for WordPress site owners, without requiring technical knowledge.
- WordPress updates explainedUnderstand what WordPress updates are, what the different types mean, and how the update process works.
- WordPress user roles explainedUnderstand the five standard WordPress user roles (Administrator, Editor, Author, Contributor, and Subscriber) and know which role to assign to each person on your team.
Security for your company10
- Cyber insurance: what insurers check before they cover youWhat cyber insurance typically covers, the security controls insurers ask about on applications, and how to answer accurately so your cover holds up.
- Incident response: who does what in the first hourA first-hour incident response plan for small companies, with roles, a call order, and the mistakes that make a security incident worse.
- Managing company laptops and phones (MDM basics)What mobile device management (MDM) does, the main options for small companies, and how to handle personal phones without overreaching.
- Security for executives: you are the targetWhy owners and senior leaders are singled out by attackers, and the specific protections that matter most for your accounts, phone, money and public profile.
- Security for your companySecurity guides for leaders responsible for a whole organization: a first security plan, SSO, device management, vendor checks, SOC 2 and incident response.
- Security questionnaires and SOC 2: what bigger clients will ask youWhat security questionnaires and SOC 2 reports are, the difference between Type I and Type II, and how a small company can answer larger clients honestly.
- Single sign-on (SSO) and why it matters as you growWhat single sign-on is, how it works with Google Workspace or Microsoft 365, and when it's worth setting up for your company.
- Vendor and third-party risk: what to ask your software providersHow to check whether a software provider or contractor will keep your data safe, with the questions to ask and how to judge the answers.
- Writing a simple security policy for your teamHow to write a short, readable security policy that your staff will actually follow, with a section-by-section outline you can copy.
- Your company security plan: where to startA practical first security plan for a small or growing company, built around the NIST Cybersecurity Framework and sized for people without an IT department.
Google Workspace9
- Exporting your Workspace dataHow to export and download a copy of your organization's Google Workspace data using Google Takeout and the Admin console data export tool.
- Key security settingsThe most important security settings to configure in your Google Workspace Admin console: protecting your organization's accounts, data, and email.
- Managing company devices (overview)An overview of Google Workspace's mobile device management (MDM) tools: how to enforce security policies on phones and computers used to access company data.
- Recovering a deleted user or filesHow to recover a deleted Google Workspace user account or restore files deleted from Google Drive: time limits and step-by-step instructions.
- Removing a user safelyHow to remove a Google Workspace user when someone leaves: what to do before you delete, how to transfer their files, and how to undo a mistake.
- Resetting a user's passwordHow to reset a Google Workspace user's password from the Admin console: quick steps for admins when a team member is locked out.
- The Google Admin console, explainedA tour of the Google Admin console: the control panel where you manage users, security, billing, and settings for your whole organization.
- Transferring files when someone leavesA complete guide to transferring Google Drive files, email, and calendar data from a departing team member, so nothing is lost when someone leaves.
- Turning on 2-step verificationHow to enable 2-step verification (2FA) for your Google Workspace account: the most important step you can take to protect your business email and files.
Risk & resilience6
- Offboarding a staff member across all your systemsA complete checklist for safely removing a departing team member's access to WordPress, Google Workspace, Microsoft 365, hosting, passwords, and more.
- Onboarding a new staff member across all your systemsA complete checklist for giving a new team member the right access to WordPress, Google Workspace, Microsoft 365, hosting, passwords, and more.
- Recovering from a hacked websiteA calm, thorough playbook for getting your hacked website cleaned, secured, and recovered as far as your platform allows, with timelines and prevention steps.
- Risk & resilienceWhat to do when things go wrong: calm, step-by-step guides for every website and account emergency.
- What to do if you lose access to your Google or Microsoft admin accountStep-by-step recovery guide for regaining admin access to Google Workspace or Microsoft 365 when you're locked out.
- Your website disaster recovery planA calm, step-by-step plan for what to do in the first 30 minutes, 24 hours, and first week after a website emergency.
AI for your business5
- Adding an AI chat assistant to your website: options and risksThe main ways to add an AI chat assistant to a business website, what each involves, and the risks to plan for before it starts talking to customers.
- AI and your customer data: privacy basicsWhat happens to customer information you put into AI tools, how to choose settings and plans that protect it, and simple rules your team can follow.
- AI for customer supportHow to use AI tools to handle common customer questions faster, and the rules for keeping responses accurate, honest, and human where it counts.
- AI image generation for marketingWhat AI image tools can do for your marketing, the licensing risks you need to know, and how to keep your brand consistent.
- How to evaluate an AI tool before you pay for itA practical process for trialling and judging an AI tool for your business, covering real-task testing, data and security terms, pricing models, and your exit plan.
Compliance5
- CCPA & CPRA basics for businesses serving CaliforniaWhat California's consumer privacy law means for your website, who it applies to, and the practical steps we take to help you align with it.
- CompliancePlain-English guides to the web-related laws and standards that affect your business, from privacy and accessibility to payment security.
- GDPR basics for businessesWhat the EU's General Data Protection Regulation means for your website, even if your business is based outside Europe.
- HIPAA basics for websites handling health infoWhat HIPAA means for your website if you work in healthcare or collect health-related information, and the technical safeguards we implement.
- PCI compliance for online storesWhat PCI DSS means for your e-commerce site, how payment processing actually works, and why the way we build stores keeps your PCI burden small.
Hosting4
- SSL on FlywheelHow SSL certificates work on Flywheel, how to check your certificate status, and what to do if you see a security warning.
- SSL on KinstaHow Kinsta manages free SSL certificates via Cloudflare, how to check your certificate status, and what to do if you see a security warning.
- SSL on WP EngineHow SSL certificates are managed on WP Engine, how to check your certificate status, and what to do if you see a security warning.
- What is SSL & HTTPS?Learn what SSL certificates and HTTPS are, why they matter for your website, and how they're managed on your hosting platform.
Microsoft 3654
- Removing a user safely in Microsoft 365How to remove a Microsoft 365 user when someone leaves, including how to preserve their email and files before deleting the account.
- Resetting a user's password in Microsoft 365How to reset a Microsoft 365 user's password from the admin center, whether they're locked out or just need a fresh start.
- Security defaults & key settings in Microsoft 365The baseline security settings every Microsoft 365 business account should have, including security defaults, admin account protection, and app permissions.
- Turning on multi-factor authentication in Microsoft 365How to turn on multi-factor authentication (MFA) in Microsoft 365: the single most effective step to protect your business email and files from hackers.
Domains & DNS3
- Cloudflare basics for clientsWhat Cloudflare is, what we use it for, what it means for your domain and DNS, and what you need to know as a client.
- Domain privacy protection explainedWhat WHOIS privacy protection is, why it matters, and how to check it's switched on at common registrars.
- Who owns your domain (and why it matters)Why domain ownership should be in your name, how to check who the registrant is, and what to do if someone else holds your domain.
Email3
- Email security basicsThe essential steps to keep your business email accounts secure: passwords, two-factor authentication, and everyday habits.
- SPF, DKIM & DMARC for email sendersA plain-English explanation of the three DNS records that prove your emails are legitimate and protect your domain from being spoofed.
- Why not use a free Gmail/Hotmail for business?Using a free consumer email address for your business makes you look unprofessional and creates real risks. Here's why a custom domain address matters.
Troubleshooting3
- "Not secure" warning in the browserWhat causes the "Not secure" warning in browsers and how to get your site back to secure HTTPS.
- I got a suspicious email. What now?How to assess whether an unexpected or suspicious email is a phishing attempt, and what to do next.
- I think I was hackedImmediate steps to take if you believe your website or business accounts have been compromised.
WooCommerce3
- Backing up your storeHow to back up your WooCommerce store: why it matters, what needs to be backed up, and how to verify your backups are working.
- Keeping your store securePractical steps to keep your WooCommerce store secure, protect customer data, and reduce the risk of a breach.
- PCI compliance, in plain EnglishWhat PCI compliance means for your WooCommerce store, why it matters, and what you actually need to do about it.
Analytics & Tracking2
- Cookie consent & banners explainedA plain-English explanation of cookie consent banners: why your website has one, what it does, and what visitors see when they interact with it.
- Tracking, cookies & privacyA plain-English guide to how website tracking works, what cookies do, what privacy laws require, and how Chykalophia sets up tracking in a compliant way.
Industries2
- Healthcare websites & HIPAA basicsWhat healthcare providers need to know about building a trustworthy website that handles patient information responsibly.
- Websites for legal & accounting practicesHow law firms and accounting practices can build websites that earn trust, generate consultations, and handle client information responsibly.
Squarespace2
- Contributors & permissionsHow to add, manage, and remove contributors in Squarespace, including the different permission levels available.
- Squarespace settings to leave aloneThe handful of Squarespace settings that can break your whole site, take it offline, or cut off your email, and what to do instead when one needs changing.