Who has the keys? Passwords, two-step sign-in and access to your business accounts

When a small business "gets hacked", the website is rarely the part that broke. What usually goes is one of the accounts around it: the email inbox, the Google listing, the Facebook page, the domain. A password gets guessed or reused. A former employee still has the login. Or the only person who could get in has left, and nobody else can.

None of this takes technical skill to prevent. It takes an afternoon and a list. This article is that list: which account to protect first, which kind of two-step sign-in to choose, how to give people access without giving them your password, and what to do when someone leaves.

• Your email is the master key. Every other account resets its password by emailing you, so protect that inbox first.
• Turn on two-step sign-in, starting with email. The US Cybersecurity and Infrastructure Security Agency (CISA) says it makes you "99% less likely to be hacked."
• A prompt or an app on your phone beats a text message, and both beat nothing.
• Use a password manager and a different password for every account. You do not need to change them every 90 days.
• Never share a login. Invite people instead, each with their own account and the smallest role that does the job.
• Keep a second way in: a recovery phone, backup codes, and a second trusted owner on the accounts that allow one.
• When someone leaves, remove them the same week.

Think about what happens when you click "forgot password" on your domain registrar, your payment processor, Facebook or your Google account. Every one of them sends a link to the same email address. Whoever can read that inbox can become you everywhere else.

So two checks come before anything else:

1. Is it an address you will always control? An address from your old internet provider stops working when you switch providers. An address on a domain you let lapse can be registered by somebody else, along with every reset email sent to it. An employee's personal address leaves when they do. The address on your business accounts should be one you own and will keep.
2. Is that inbox protected with two-step sign-in? If you only do one thing from this article, do this.

Two-step sign-in (also called two-factor or multi-factor authentication) means a password alone is not enough to get in. You also need something you have, usually your phone.

CISA's advice is one sentence: "The use of MFA on your accounts makes you 99% less likely to be hacked." The Federal Trade Commission's guide for small businesses says the same, and describes the second step as "a temporary code on a smartphone or a key that's inserted into a computer."

The kind you choose matters. Google measured this in a year-long study of hijacking attempts on Google accounts, published in 2019:

• A code sent by text message blocked 100% of automated bots, 96% of bulk phishing attacks and 76% of targeted attacks.
• A prompt on your phone ("Is this you trying to sign in?") blocked 100% of bots, 99% of bulk phishing and 90% of targeted attacks.

That gap gives the order of preference. Use a phone prompt or an authenticator app first, and a text message if that is all a service offers. Having nothing is the only wrong answer. Passkeys and physical security keys, where a service supports them, are stronger again, because there is no code for a fake sign-in page to collect.

Turn it on in this order: your email, then your domain registrar, your payment processor and bank, your Google account, then social media.

When you switch it on, most services offer backup codes. Print them, or save them in your password manager, and keep them somewhere other than your phone. Without them, a lost or broken phone can lock you out of your own account.

The rule that matters most is one password per account. When one company is breached, attackers try the same email and password everywhere else. The FTC's guidance for businesses is blunt: "Never reuse passwords and don't share them on the phone, in texts, or by email."

Nobody can remember fifty different strong passwords, so don't try. A password manager remembers them for you, fills them in, and makes up long random ones. The current US standard for sign-in systems, NIST's SP 800-63B (July 2025), goes as far as requiring that sign-in pages "SHALL allow the use of password managers and autofill functionality."

The same standard retires two habits that many businesses still follow:

• Changing passwords on a schedule. It says services "SHALL NOT require subscribers to change passwords periodically." Forced changes tend to produce one password with a new number on the end each time. Change a password when there is a reason: a breach, a lost device, someone leaving.
• Rules about mixing character types. It asks for length instead (at least 15 characters where a password is the only thing protecting an account) and says services "SHALL NOT impose other composition rules."

The FTC's sheet still asks for "at least 12 characters" with a mix of numbers, symbols and capitals. A password manager's 20 random characters satisfies both, so there is no need to choose between them.

To see whether your email address has turned up in a known breach, haveibeenpwned.com checks for free.

The receptionist who posts on Instagram, the bookkeeper who reads your Stripe account, the web person who sets up your domain: none of them needs your password. Almost every service a business uses has a way to add people with their own sign-in.

Google says it plainly for Business Profiles: "To access and manage Business Profiles without the need to share your password, each user needs their own Google Account." It then gives you two levels. Owners have "full control over the profile." Managers can do nearly everything, except that "they can't add or remove users or remove the profile."

That difference is the point. Give each person the smallest role that does the job, and you keep the two decisions that matter most: who else gets in, and whether the account can be deleted. The setup guides in this Library show where the invite button is for Stripe, Cloudflare, Resend and your Google Business Profile.

Separate sign-ins also give you two things a shared password never can: a record of who did what, and the ability to remove one person without changing the password for everyone else.

Every important account needs a way back in that does not depend on one phone or one person.

• Recovery details. Add a recovery phone number and a recovery email to your main email account, and check that both are current. In Google's study, a recovery phone number on its own blocked 99% of bulk phishing attacks, because it gives Google a way to check that it is really you.
• Backup codes, kept away from your phone.
• A second owner where losing the only owner would be a disaster, such as a Google Business Profile or a Facebook page. Choose someone you trust completely, like a business partner or a family member, not a contractor. A Business Profile has "only one primary owner", and Google transfers ownership only to another owner or manager already on the profile. If the only owner is gone, there is nobody to hand it to.

Staff leave, and so do web designers, marketing agencies and the nephew who set up the Facebook page. Their access often stays behind.

When anyone with access leaves, the same week:

1. Remove them from every account they were added to. On a Business Profile, Google emails the person to say they were removed. They lose their editing rights, and their past review replies and posts stay up.
2. Change any password they knew, if one was ever shared.
3. Check where their work email goes. A business mailbox that forwards to a personal address keeps sending your reset links out of the business.

Twice a year, open each account's team or users page and read the list. Anyone you don't recognise, or no longer need, comes off. One timing detail: a newly added owner on a Business Profile has to wait seven days before they can remove other users or transfer ownership. Add your second owner before you need one.

Your domain is the address of your website and of your email. Lose it and you lose both.

Three things protect it:

• The registrar lock, which stops the domain being moved to another company without your say-so. Cloudflare turns it on by default: "Your domains stay locked to help prevent unauthorized transfers until you choose to unlock them." Most registrars offer one. Check that yours is on.
• The email address on the registrar account, for all the reasons above.
• Two-step sign-in on the registrar account itself.

And if an email warns that your domain is about to expire, read this before you pay anything.

• Change your email password first, from a device you trust, then the others.
• Sign out every other session. Google, Microsoft and Facebook each have a page that lists where you are signed in, with a way to sign out everywhere else.
• Check your email's forwarding and filter settings for rules you didn't make. A rule that quietly forwards or deletes messages lets someone keep reading your mail after the password has changed.
• Turn on two-step sign-in if it was off.
• Tell your bank and your payment processor if a payment account was involved, and warn customers if your email was used to send them anything.

1. Write down every account the business has: email, domain, website, Google Business Profile, payments, bank, social media, booking software.
2. Next to each one, write the email address it uses. Fix any address you don't control.
3. Turn on two-step sign-in, email first. Save the backup codes.
4. Install a password manager, and replace any reused password, starting with email.
5. Open each account's users page and remove anyone who has left.
6. Add a second trusted owner wherever losing the only one would hurt.
7. Put a reminder in your calendar to read those users pages again in six months.

• I never ask for a password. Every account I need is shared with me by invitation, under my own sign-in, so you can remove me in a minute and nothing else changes. What you own when you hire a developer explains which accounts are yours and which one is mine.
• I ask for the smallest role that does the job, and each setup guide says which role and why.
• Your domain goes in your own Cloudflare account, where it is locked against transfer from the start.
• The admin sign-in on the sites I build locks out after repeated wrong guesses, so nobody can try passwords at speed.
• Forward me anything that looks odd, such as a sign-in alert or an invite you didn't expect. I would much rather check ten harmless ones than miss one that wasn't.