Two Website Security Fixes Most Small Businesses Miss

Two small technical fixes, five minutes each, that most small business websites never get around to — not because they’re difficult, but because nobody ever mentions they’re needed.

1. A DMARC record for your domain

If your business sends email from its own domain, you need one. Without it, it’s far easier for someone else to send emails that appear to come from you — damaging trust and getting your real emails flagged as spam.

It’s a single DNS entry, about two minutes to add. Start with a monitoring-only policy rather than blocking everything straight away, so you can see what’s happening before anything gets rejected.

2. Two-factor authentication on the account that actually matters

If you log into your hosting or domain provider using “Sign in with Google” (or Microsoft, or similar), the account genuinely protecting you isn’t the one you’re looking at — it’s the account underneath it. Turning on two-factor there is the real fix, even if the platform you’re logged into doesn’t obviously mention it. We ran into exactly this ourselves this week trying to secure our own hosting account.

Neither of these takes long. Both are the kind of thing that only gets noticed after something’s gone wrong — which is exactly why it’s worth doing before that happens.

Not sure if yours are set up properly? That’s exactly the kind of thing we check as part of ongoing hosting and site support — or get in touch and we’ll have a look.