When a small business account gets broken into, it’s usually not a movie-style hack. It’s a reused password that leaked somewhere else, or a shared login that a former employee still knows. The good news: a few simple habits prevent most of it.
Use a password manager
A password manager remembers strong, unique passwords for every account so you don’t have to. You remember one strong master password; it handles the rest and fills them in for you. For a business, choose one that lets you share specific logins with team members securely, instead of passing passwords around by text or sticky note.
Turn on two-step login everywhere it’s offered
Two-step login (also called two-factor authentication) means a password alone isn’t enough; you also confirm with a code or a phone prompt. Turn it on first for:
- Email, since it can reset everything else
- Your domain and website hosting accounts
- Banking and payment accounts
- Google Business Profile and social media
- Your website’s admin login
Stop reusing passwords
If one site leaks your password and you’ve used it elsewhere, every one of those accounts is at risk. A password manager makes unique passwords painless.
Give people their own logins
Shared logins make it impossible to know who did what, and hard to remove access when someone leaves. Whenever a system allows it, give each person their own account with only the access they need.
Have a plan for when someone leaves
- Remove or disable their accounts the same day.
- Change any passwords they knew for shared accounts.
- Transfer ownership of files and email they managed.
- Check that recovery emails and phone numbers on key accounts aren’t theirs.
Watch out for fake login pages
Many break-ins start with an email that looks like it’s from a real service, asking you to log in. When in doubt, don’t click the link; go to the site directly by typing the address yourself.
Make it a quick team habit
A 30-minute team session on password managers and spotting fake emails goes a long way. People are much more careful once they’ve seen what these scams look like.
Questions I hear a lot
Are browser-saved passwords good enough?
They’re better than reusing passwords, but a dedicated password manager is better for sharing securely and working across devices.
How long should a password be?
Longer is stronger. A password manager can generate long, random ones automatically.
If you want a second set of eyes
If you’d like help setting up a password manager or walking your team through the basics, that’s a great training session, onsite around Summit County or remote. I can also help with tech setup.