Protection guide by Mark Parfenov, published 10 November 2026
Most small business security problems aren’t clever hacks. They’re a lost password, an account in a former contractor’s name, a key pasted into code, or an email domain anyone can fake. These basics prevent most of them, and I set them up on every project.
Create your website, domain, ads, analytics, CRM, payments and hosting accounts in your company’s name, with your own admin access. Give contractors their own logins with only the access they need, and remove them when the work ends.
Use an authenticator app or security key, not just SMS, on email, domain, hosting, payments, ads and social accounts. These are the accounts attackers target first.
Give every account a unique, long password stored in a password manager, and share access through it rather than by email or chat.
API keys and passwords belong in your hosting provider’s environment settings, never in website code, chat messages or files that get published. Check that tools, including AI coding assistants, aren’t saving secrets into files that end up in your code repository.
Set up SPF, DKIM and DMARC on your domain, so others can’t easily send email pretending to be you. If the domain doesn’t send email at all, publish records that say so.
Lock your domain at the registrar, turn on auto-renew and keep the registrar account under two-factor sign-in. Losing a domain takes your website and email with it.
Make sure your website, CRM data and important documents are backed up automatically, and check once that you can actually restore them. Hosts such as Vercel keep previous versions you can roll back to.
Ask only for the personal data you need, protect forms against abuse, and keep a simple privacy page that says what you collect and why.
When AI assistants connect to your email, files or calendar, give them only the access each task needs, keep a person approving anything sent to customers, and review what they can reach from time to time.
Know who to call, how to reset access to your main accounts, and where your backups are. Write it down on one page.
What I’ve learned and use in practice, checked against current benchmarks and official checklists on 10 November 2026. Experience and benchmarks, not guarantees.
A hacked email account, a lost domain or a leaked key can stop sales overnight and damage trust with customers. These steps take a few hours to set up and protect everything else you build.
The first call is free. The diagnostic (€950, fixed) finds where your leads and deals are lost and gives you the fixes in priority order.