5 Security Mistakes Small Businesses Make

Start with the gaps you can actually close

A small business does not need an enormous technology shopping list to improve security. Start with five common gaps: important accounts protected only by passwords, software that is not updated, excessive access, backups that have never been restored, and no plan for an incident. These steps apply whether a team runs the website or the owner manages every account personally.

The aim is not to promise that an incident can never happen. It is to make unauthorized access harder, limit the damage if it does happen and know how to resume work. CISA and Cyber.gov.au both place multifactor authentication, updates and backups among the fundamentals for small businesses.

1. Relying on passwords alone for critical accounts

Your primary email account can reset passwords for other services. A website administrator can change content, users and settings. One compromised password can therefore lead far beyond the first account.

Turn on multifactor authentication (MFA) first for email, file storage, the website CMS, hosting and administrator accounts. Give each person a separate account rather than sharing an admin password. A password manager makes unique passwords easier to maintain. For sensitive accounts, prefer a security key or another phishing-resistant option when the service supports it. CISA's business MFA guidance emphasizes remote access and privileged accounts.

This week: identify the five accounts that control the business, turn on MFA and check where recovery codes are kept.

2. Waiting for something to break before updating software

Updates can close known vulnerabilities, not just change how a product looks. Websites may depend on a CMS, plugins, themes, libraries and outside services. You cannot maintain software you do not know is there. OWASP Top 10:2025 also addresses software supply-chain failures, a wider problem than one outdated plugin.

Keep a short inventory of the website, team devices, email service, plugins and important integrations. Assign an owner to each. Enable automatic updates where appropriate, and schedule testing for changes that may affect checkout or bookings. Remove plugins and services nobody uses; unused software can still create exposure.

This week: check the CMS, plugins and browsers used by administrators. A site that appears to work can still need a security update.

3. Giving everyone administrator access and never reviewing it

A designer updating images does not need access to orders. A writer does not need to manage users. A former contractor should not keep an active account. Excessive permissions enlarge the impact of mistakes and compromised accounts. OWASP identifies broken access control as a major web-application risk.

Review users across the website, hosting, analytics, domain registrar and connected tools. Give each person only the access required for their work. Revoke it when the work ends. Keep API keys and passwords out of shared documents and source code.

This week: open the user list for your most important tool. Remove unused accounts and reduce admin privileges where they are not needed.

4. Having a backup that has never been restored

An untested backup is a hope, not a recovery plan. It may contain site files but not the database. It may live in the same compromised account. Or the team may discover during an incident that nobody can restore it.

Identify what needs backing up: website, database, documents, email and operating data as relevant. Keep a copy separate from the primary system, set a retention period, and occasionally restore into a non-production environment. Record who can do it and a realistic recovery time. Cyber.gov.au lists backing up information as a core small-business action.

This week: ask the technical owner to show a recent backup and restore a file or a limited test environment.

5. Making an incident plan during the incident

Imagine a client reports a suspicious message from your address, a website shows content nobody published, or an employee loses access to an account. The first minutes will be uncertain. Without a named owner, logs and supplier contacts, a team can lose time or erase evidence it needs to understand what happened.

Write a one-page plan: who to call, which accounts to isolate, how to contact the team without business email, where backups are, and how to record initial observations. Turn on alerts for unusual logins and changes to important accounts. Run through one scenario, such as a compromised mailbox, to find gaps before a real incident. CISA's small-business resources include incident planning and logging.

This week: name one response owner, store emergency contacts outside the business email account, and rehearse what happens if the website is unavailable.

A realistic order of work

Begin with email and website administration: MFA, separate credentials and removal of stale access. Then update software and test a restore. Finally, agree on who acts when something goes wrong. The exact priorities depend on the data and systems your business relies on, but these steps reduce avoidable uncertainty.

When planning a new website or application, include permissions, updates, backups and incident handling in the brief rather than adding them after launch. Storytelling can help define these requirements while planning a business website or custom system. Tell us what you need to build.