Most breaches of small and mid-sized businesses do not involve sophisticated attackers. They exploit unpatched software, exposed admin ports, weak passwords and missing backups. The good news: a disciplined checklist closes most of these gaps.
Access
- Disable direct root/administrator login
- Use SSH keys, not passwords
- Enforce two-factor authentication for admin panels
- Give each person their own account, with least privilege
- Review and remove unused accounts quarterly
Network
- Default-deny firewall; open only required ports
- Put admin interfaces behind a VPN or IP allow-list
- Never expose databases directly to the internet
- Use TLS everywhere with modern ciphers
- Add a web application firewall and rate limiting for public sites
System
- Apply security patches automatically or on a fixed schedule
- Remove unused services and software
- Enable brute-force protection (for example Fail2ban)
- Store secrets in a vault or secret manager, not in code
- Scan dependencies and containers for known vulnerabilities
Data and recovery
- Encrypt backups and keep a copy off-site
- Test restores regularly, not just backups
- Define recovery time and recovery point objectives
Visibility
- Centralise logs and alert on suspicious activity
- Monitor uptime, certificates and disk space
An untested backup is a hope, not a plan.
Want an expert review? See our server security services or request a health check.