Free Cybersecurity Checklists for Business Owners
Simple checklists you can use today to make your website and business safer. No technical background needed.
What should a basic cybersecurity checklist for business include?
A basic cybersecurity checklist for business should cover updated website software, strong passwords with two-factor login, removal of old accounts, tested off-site backups, HTTPS, uptime and security alerts, phishing awareness for staff, safe file sharing, device locks and a short plan for what to do if you are hacked.
Key takeaways
- Use the website checklist once a month; it takes under an hour.
- If hacked, stay calm, change passwords from a clean device and do not restore in a hurry.
- Password managers and two-factor login stop most account takeovers.
- Teach staff to confirm payment changes by phone using a known number.
- Remove access on an employee's last day, every time.
- These checklists are defensive only and safe to share with your team.
Website security checklist: is my website secure?
Your website is in good shape if software is updated, every admin has a strong password and two-factor login, backups are off-site and tested, HTTPS is on and someone gets alerts.
Monthly checks
- Website software, plugins and themes are up to date
- All admin users use strong, unique passwords and two-factor login
- Old admin accounts are removed
- Daily backups are stored off the server and tested
- SSL is active and the site loads only on HTTPS
- Someone checks the site and gets alerts if it goes down
Quarterly checks
- Review the list of admin users and remove anyone who no longer needs access
- Delete plugins, themes and apps you do not use
- Do a test restore of a backup to a safe place
- Check that your domain and SSL renew automatically and the card on file is valid
- Search Google for site:yourdomain.com and look for pages you did not create
Using WordPress? Our WordPress security services page explains the extra steps for plugins and themes. Want an expert to check this for you? Book a security audit.
What should you do first if your website is hacked?
Stay calm, change passwords from a clean device, write down what you saw, and get help. Do not delete files or restore an old backup until the entry point is found.
- Stay calm and do not delete files in a hurry
- Change hosting, admin and email passwords from a clean device
- Note what you saw and when, with screenshots
- Contact your host and a security team
- Do not restore an old backup until the entry point is found
We offer 24x7 emergency support for hacked sites. See malware removal.
Why not restore a backup straight away?
If you restore before closing the gap the attacker used, they can often get back in within hours or days. Also, hacks often start before anyone notices, so the latest backup may already contain hidden bad code. A careful clean-up checks both.
Password and login security tips
Use a password manager, long passphrases and two-factor login, and never reuse your email password. These four habits stop most account takeovers.
- Use a password manager instead of notes or WhatsApp
- Use long passphrases, not short complex words
- Never reuse your email password anywhere else
- Turn on two-factor login for email, banking, hosting and social media
| Habit | Weak | Strong |
|---|---|---|
| Password style | Short word with symbols, like Shop@123 | Long passphrase of four or more random words |
| Storage | Notes app, Excel sheet or WhatsApp | A password manager with a strong main password |
| Reuse | Same password on email and other sites | A unique password for every account |
| Second step | Password only | Two-factor login with an app or security key |
| Sharing | Sent by chat or email | Shared through the password manager with named people |
Two-factor login by an authenticator app is safer than SMS codes, because SMS can be redirected through SIM swap fraud. SMS is still much better than nothing.
Phishing checklist for staff: how to spot a fake email or message
Check the real sender address, be careful with urgent payment requests, confirm bank changes by phone and never log in through a link you did not expect.
- Check the sender's email address, not only the name
- Be careful with urgent requests for payment or bank detail changes
- Confirm payment changes by phone using a known number
- Do not open unexpected attachments or login links
- Report suspicious emails to your manager or IT contact
For help building safe habits across your team, see cybersecurity consulting.
Common fake messages in India
- A fake 'domain expiry' or 'GST notice' email with a login link
- A WhatsApp message from a new number claiming to be the owner, asking for an urgent payment
- A supplier email saying their bank account has changed
- A fake courier or KYC update message with a link
- A 'shared document' email that opens a fake Google or Microsoft login page
Employee joiner and leaver security checklist
Give new staff only the access they need, and remove all access on a leaver's last day. Most data leaks from ex-staff happen because no one removed their access.
When someone joins
- Create their own accounts; never share another person's login
- Turn on two-factor login on day one
- Give access by role, not 'everything for now'
- Explain the phishing and password rules in a short session
When someone leaves
- Suspend email, drive, CRM and other app accounts
- Remove them from WhatsApp groups and linked devices
- Change shared passwords they knew
- Collect company laptops and phones
- Move their files and email to a manager
For a full plan to protect customer and business files, see data security for small business.
Device, Wi-Fi and email domain security checklist
Keep every work device locked, encrypted and updated, protect the office Wi-Fi with a strong password, and set email security records so others cannot easily fake your domain.
Laptops and phones
- Screen lock with a PIN, password or fingerprint on every device
- Built-in disk encryption turned on
- Automatic updates on for the system and browser
- Apps installed only from official stores
- A way to find or wipe a lost phone
Office Wi-Fi and router
- Router admin password changed from the default
- Strong Wi-Fi password, changed when staff leave
- A separate guest network for visitors
- Router firmware kept updated
Email domain
- SPF record lists only the services that send your email
- DKIM signing is on in Google Workspace or Microsoft 365
- A DMARC record is set, starting with monitoring mode
These records make it harder for scammers to send fake emails that look like they come from your business. They also help your real emails, such as quotes and invoices, land in the inbox instead of spam. Your email or domain provider can add them, or we can set them up and check that nothing breaks.
Public Wi-Fi in cafes, airports and hotels is another weak point. Avoid logging in to banking or admin panels on open networks, or use your phone's mobile data instead.
Backup checklist: will your backups work on a bad day?
Your backups are ready if they run automatically, include files and databases, are stored off the server, include one copy that cannot be changed, and have been restored in a test.
- Website files and database are backed up daily
- At least one copy is stored away from your hosting account
- Backup logins use two-factor login and are not shared
- You get an alert if a backup fails
- A test restore was done in the last three months
- You know who restores the site and how long it takes
If any box is empty, see backup and disaster recovery for a simple way to fix it.
How to use these checklists in your business
Pick one owner for each checklist, set a date to review it, and fix the empty boxes in order of risk. Small, steady steps work better than a big one-time push.
- Print or share the checklists with your team
- Assign one person to each list
- Mark each item yes, no or not sure
- Fix the easy 'no' items first, such as two-factor login
- Ask for help with the 'not sure' items
- Repeat every month or every quarter
If many items are 'not sure', a professional security audit can check everything for you and give a ranked fix list. For a broader plan, see cybersecurity services.
Frequently Asked Questions
Can I share these cybersecurity checklists with my team?
Yes. Please share them with your staff, your web developer and anyone who helps run your business systems. They are written in simple language so non-technical people can follow them. You can print them, add them to your office handbook or use them in a short team meeting once a month.
Do you provide hacking tutorials or tools?
No. SI Cyber only shares defensive guidance that helps people protect their own websites, accounts and data. We do not publish attack methods, hacking tools or ways to get into other people's systems. If you think your own site or account has been attacked, contact us and we will help you secure it.
How often should a small business review its security checklist?
Review the website and backup checklists once a month and the full list every quarter. Also review it after any big change, such as a new website, new staff, a new software tool or a security incident. Regular short reviews catch problems early and keep good habits in place.
How can I check if my website is secure without technical skills?
Use the website checklist on this page. Check that your site loads on HTTPS, that only current staff have admin access, that software is updated and that backups are stored off the server. Search Google for your domain to look for strange pages. For a deeper check, a professional audit can review everything for you.
What is the most important security step for a small business?
Turning on two-factor login for email, hosting, website admin, banking and social media accounts is one of the most useful single steps. Many attacks start with a stolen password, and two-factor login blocks most of them. After that, focus on tested backups, software updates and removing old user accounts.
Is a free checklist enough to keep my business safe?
A checklist is a strong start and covers the most common risks. But it cannot find hidden problems, such as old malware, weak server settings or unsafe code. If your website brings leads or sales, or you hold customer data, have a professional check done at least once a year.
What should I do if I click a phishing link?
Do not panic. If you entered a password, change it at once from a safe device, and change it on any other account that used the same password. Turn on two-factor login. Tell your manager or IT contact so they can check for misuse. If you shared bank details, call your bank straight away.
Talk to our team today
Call or WhatsApp +91 85808 92163. We reply fast, Monday to Friday.