Small businesses are not targeted because they are valuable. They are targeted because they are reachable, and most breaches involve a stolen password, an unpatched plugin or a convincing email rather than anything sophisticated. Four things prevent the large majority: enforced multi-factor authentication, current software, tested backups, and staff who know what a phishing message looks like.
These guides cover the fundamentals, the specific threats worth understanding, data privacy obligations, and how to judge whether your hosting and tools are actually secure.
If you read four things on this page, make it these.
Start here if security has never been anyone’s explicit job at your company.
The specific attacks that reach small businesses, and what each one looks like from the inside.
What you are obliged to do with customer data, and what is simply good practice.
How to judge whether the platform underneath your site is doing its share.
Collaboration and project tools hold as much sensitive material as email, and are secured less often.
LiberationTek includes backups, certificates and monitoring with hosting rather than selling them as add-ons, and runs the infrastructure in US data centers we control.
Multi-factor authentication, enforced rather than offered. The overwhelming majority of account compromises start with a password that was reused, guessed or phished, and a second factor stops nearly all of them.
Daily for a site that changes, and more often for a store taking orders. The frequency matters less than whether anyone has restored from a backup recently. An untested backup is a hope, not a control.
Yes, mostly by automated scanning rather than deliberate selection. Attacks look for known vulnerabilities across millions of sites, which means being small is no protection — only being current is.
Isolation between accounts, prompt patching of the server software, network-level filtering, automatic certificates, and backups that are kept separately from the server. Ask which of those are included rather than assuming any of them are.
Cover three things in half an hour: never approve a login prompt you did not trigger, verify any payment change by phone using a number you already had, and report mistakes immediately without fear of blame. That last one prevents more damage than the first two.
Tell us what you run and where it is hosted. We will tell you the two or three changes that would make the most difference, in order.
Don’t like managing? We offer managed services for hosting, ecommerce, web sites, and more.

Liberation’s global edge network provides enhanced performance & security.
Stay informed on the latest tech news, new products, promotions, & more!