Small businesses imagine hacking as something technical. In practice, most breaches start with a password that was reused, guessed or stolen from another site. The good news: the fix takes about two hours and costs almost nothing.
Mistake 1: reusing passwords
When any service you use is breached, your email and password combination ends up in a database that attackers test against banks, email providers and CMS logins. One old forum account can compromise your website.
Fix: a password manager. It generates a unique, long password for every site and remembers it, so you only memorise one master password.
Mistake 2: short passwords
Length matters more than complexity. A sixteen-character passphrase is far stronger and easier to remember than eight characters of symbols you will write on a sticky note.
Fix: use four or five unrelated words, or let your password manager generate twenty random characters.
Mistake 3: no two-factor authentication on admin accounts
With 2FA enabled, a stolen password is useless — the attacker also needs the six-digit code from your phone. This single change blocks the overwhelming majority of automated attacks.
Fix: enable 2FA on email first (it is the key to every other account), then on your CMS, hosting panel and domain registrar. Store the backup codes somewhere safe — losing your phone should not lock you out.
Mistake 4: sharing accounts
When three people share one login, you cannot tell who did what, and offboarding an employee means changing passwords everywhere. Shared credentials also spread through chat apps where they are never deleted.
Fix: individual accounts for everyone, with the minimum role they need. Most platforms offer free tiers with several users.
Mistake 5: never changing passwords after a breach
If a service announces a breach, assume the password is public. Attackers test stolen combinations within hours, not weeks.
Fix: check your email addresses against a breach-notification service, then change every affected password. A password manager flags reused and breached entries automatically.
The two-hour plan
- Install a password manager (30 minutes)
- Import existing passwords and run its health check (20 minutes)
- Fix the reused and weak ones it flags, starting with email and banking (40 minutes)
- Enable 2FA on email, CMS, hosting and registrar (30 minutes)
Ongoing habits
- Keep software updated — most attacks exploit known, patched vulnerabilities
- Remove accounts for people who have left
- Review who has admin access twice a year
- Keep offline backups so a compromise is an inconvenience, not a disaster
