Security for small business
Small Business Cybersecurity Checklist for 2026
By PixelPrivate Security Team · Published · Updated · 9 min read
Short answer: The highest-impact steps for a small business are: turn on multi-factor authentication on email and admin accounts, secure your domain and email authentication (SPF, DKIM, DMARC), keep your website and plugins updated behind HTTPS, back up data and test restores, and give staff a simple way to report suspicious messages.
Start with accounts, because attackers do
Most small-business incidents begin with a stolen or reused password, usually for email. Whoever controls your email can reset almost every other password.
- Turn on multi-factor authentication (MFA) for email first, then your domain registrar, DNS host, website host, accounting and payment tools.
- Use a password manager so each account has a unique password.
- Remove access for people who left, and review who has admin rights.
Protect your domain and email identity
Your domain name is the foundation of your website and email. Losing control of it, or letting others send email as you, directly harms customers.
- Enable registrar lock and MFA on the registrar account.
- Publish SPF, DKIM and a DMARC policy, and move DMARC toward enforcement.
- Remove DNS records for services you no longer use.
Keep your website healthy
- Serve everything over HTTPS and renew certificates automatically.
- Update your CMS, themes and plugins; remove ones you do not use.
- Add the basic security headers.
- Use an admin URL and account protected by MFA; limit login attempts.
Back up and be able to restore
A backup you have never restored is a hope, not a backup. Keep at least one copy that cannot be changed by whoever is logged into your main systems.
Prepare your people
- Teach staff to verify payment-detail changes by phone using a known number.
- Give them one obvious way to report a suspicious email.
- Keep a short incident contact list: IT provider, bank, insurer, registrar.
Know what you cannot see
Free tools like PixelPrivate’s security check review publicly visible configuration. They do not replace patching, endpoint protection or a professional assessment for regulated data.
Checklist
- ☐ MFA on email, registrar, DNS host, website host
- ☐ Password manager in use
- ☐ SPF, DKIM, DMARC published
- ☐ HTTPS everywhere, auto-renewing certificate
- ☐ CMS and plugins current
- ☐ Backups tested
- ☐ Staff know how to report phishing
- ☐ Incident contact list written down
Methodology
This checklist prioritizes controls by how often their absence appears in public incident guidance from CISA and NCSC and by how cheaply they can be applied without a security team. It is a starting baseline, not a compliance framework.