9.3 Security Basics

2FA is the single most effective security measure. Enable it on:

• Your email account (Google/Microsoft) -- this is the master key to everything
• Your domain registrar (VentraIP, GoDaddy, etc.)
• Your hosting provider
• Cloudflare (or whoever manages your DNS)
• Google Business Profile, Google Ads, GA4, Search Console
• Meta Business Manager
• Your CMS (WordPress admin, etc.)
• Use an authenticator app (Authy or Google Authenticator), not SMS. SMS-based 2FA can be intercepted via SIM swapping.

If you're reusing passwords (most people are), fix this today:

• 1Password ($3/mo) or Bitwarden (free) -- both excellent
• Generate unique, random passwords for every account (20+ characters)
• Store all business logins in the password manager with labels and notes
• Share credentials with team members via the password manager, never via email or text
• Your master password should be a memorable passphrase: "correct-horse-battery-staple" not "P@ssw0rd123"

Most breaches exploit known vulnerabilities that have already been patched:

• WordPress: Enable auto-updates for core, themes, and plugins. Check weekly that nothing is broken.
• Plugins/extensions: Delete any you're not using. Each one is an attack surface.
• SSL certificate: Ensure it auto-renews (Cloudflare handles this if you're using them)
• PHP version: If on WordPress, ensure your host is running PHP 8.1+ (older versions have known vulnerabilities)

WordPress powers 43% of the web -- which makes it the biggest target:

• Change the default admin username from "admin" to something unique
• Install Wordfence (free) or Sucuri for firewall and malware scanning
• Limit login attempts (Wordfence does this automatically)
• Move the login URL from /wp-admin to a custom URL (reduces bot attacks)
• Disable XML-RPC if you don't use it (it's a common attack vector)

Know when something goes wrong before your customers do:

• Uptime monitoring: UptimeRobot (free, 50 monitors) -- alerts you if your site goes down
• SSL expiry monitoring: Check certificate expiry dates monthly (or use a tool that alerts you)
• Google Search Console: Check for "Security issues" in the left menu -- Google flags hacked sites here
• Email alerts: Set up alerts for new admin users, failed login attempts, and plugin changes