Protect your website, data and reputation.
A good online presence is not finished when your website goes live. It needs basic protection and regular maintenance.
You do not have to become a cybersecurity expert. You do need a few good habits, a simple process and someone who takes responsibility for maintaining the important parts of your online presence.
Your business may depend on a single email account, a website, customer records, photographs, online profiles and access to important services. If one of these is compromised, lost or neglected, the consequences can range from inconvenience to lost business and financial damage.
The aim is not to eliminate every possible risk. It is to reduce avoidable risks, protect the information you depend on and know what to do when something goes wrong.
1. Protect Your Main Email Account
Your main business email account may be the key to resetting passwords for your website, social media accounts, Google Business Profile, domain registration and other services.
If someone gains control of that account, they may be able to reset passwords elsewhere and lock you out of important business services.
Protect it carefully.
- Use a strong, unique password.
- Turn on two-step verification, also called multi-factor authentication, where available.
- Keep your recovery email address and telephone number current.
- Never give an unexpected caller your verification code.
- Avoid sharing passwords through WhatsApp, email or ordinary text messages.
- Review account access when an employee or contractor leaves the business.
Where possible, use individual accounts for staff members rather than sharing one login. This makes it easier to remove access when someone’s role changes.
What to do now
Check the security settings for your main business email account.
Make sure two-step verification is enabled where available and that your recovery details are correct. If you are unsure how to do this, use the official help information provided by your email service.
2. Stop Reusing Passwords
Using the same password for email, website administration, domain registration and other services creates an unnecessary risk.
If one service suffers a data breach and your password is exposed, criminals may try that same combination of email address and password on other services.
Use a different, strong password for each important account. A reputable password manager can help you create and store unique passwords without having to memorise every one.
Start with the accounts that could cause the greatest problems if someone gained access:
- Main business email.
- Website administration.
- Domain registration account.
- Hosting account.
- Google Business Profile and other important business profiles.
- Banking and payment services.
- Accounts that store customer information.
Do not send your password list to yourself by email or keep an unprotected document containing all your passwords on your computer. Use a secure method designed for managing passwords.
What to do now
Make a list of your important online accounts. Identify any that reuse passwords and replace them with unique ones, starting with your main email and other critical accounts.
If you suspect that an account has already been compromised, change its password from a trusted device, secure the recovery details, review active sessions and follow the service provider’s account-recovery guidance.
3. Watch for Scams
Small businesses can receive convincing messages from people claiming to represent Google, a bank, a domain company, a hosting provider, a delivery service or a government organisation.
Some messages threaten that your website will be suspended, your domain will expire or your account will be closed unless you pay immediately or sign in through a supplied link.
A message that creates panic and demands immediate action deserves extra caution.
Follow these basic rules:
- Do not click unexpected login links.
- Check the sender and website address carefully.
- Never give an unexpected caller your password or verification code.
- Do not allow an unknown person to take remote control of your computer.
- Be cautious about unexpected invoices, renewal notices and requests to change bank details.
- Contact the organisation through its official website or a telephone number you already trust if you are unsure.
A message can look professional and still be fraudulent. Even a familiar name or logo does not prove that the message is genuine.
Cape Portal Tool: Phishing Link & URL Safety Checker
Use the Phishing Link & URL Safety Checker when you are unsure about a website address or link. Find it in the Cape Portal Toolbox.
A checker can provide useful information about a link, but it cannot guarantee that every website is safe. New or disguised threats may not yet be identified.
If an unexpected message asks for a password, payment or verification code, do not proceed simply because a link checker reports no known problem. When in doubt, navigate to the organisation’s official website yourself rather than using the link in the message.
What to do now
The next time you receive an unexpected message about your website, domain, bank account or online advertising, pause before clicking anything.
Check who sent it and verify the request through a trusted contact method.
4. Keep the Website Updated
If you use WordPress or another website system, maintenance is part of running the website.
Updates can address security weaknesses, fix problems and improve compatibility. However, updating software without preparation can sometimes cause a conflict or disrupt a working website.
A sensible maintenance routine includes:
- Keeping the main website software, themes and plugins updated.
- Removing themes, plugins and other software you no longer need.
- Maintaining a current backup before significant changes.
- Checking that important functions still work after updates.
- Reviewing who has administrator access.
- Getting help when you encounter technical problems you do not understand.
Do not assume that a website is safe simply because it loads correctly. A site may appear normal while still having outdated software, a vulnerable plugin or an account with inappropriate access.
If you are not comfortable doing technical maintenance, use a trusted website professional. Agree who is responsible, how often maintenance takes place and how you will be informed about problems.
What to do now
Log in to your website administration area and check whether important updates are waiting.
Before making significant changes, confirm that you have a current backup and a way to restore the website if something goes wrong. Remove unused software where appropriate, and ask your website professional to investigate anything you cannot safely assess yourself.
Cape Portal Tool: Website Security & Health Checker
Use the Website Security & Health Checker to look for website, security, technical and SEO signals that may need attention.
Treat the result as a starting point for investigation, not a security certification. An external checker cannot see every weakness, and a clean result does not guarantee that a website has not been compromised.
If a result is unclear, record it and ask your web professional what it means before making changes.
5. Back Up What You Cannot Afford to Lose
A website backup is important, but it is not enough if your customer records, quotations, invoices and photographs exist only on one computer or telephone.
Think about the information you would struggle to replace if a device failed, was stolen or became infected with malware.
Important information may include:
- Website files and database.
- Business documents and financial records.
- Customer and job records.
- Important photographs and marketing assets.
- Website configuration and other essential technical information.
Keep suitable copies in a separate, secure location. Depending on your needs, this might include a reputable cloud backup service, an external drive or a combination of methods.
Consider the risks of ransomware and accidental deletion. A backup that is permanently connected and writable from an infected computer may also be affected by an attack. Protect backup access and keep an additional copy where appropriate.
Most importantly, a backup is only useful if you can restore the information when you need it.
What to do now
Identify the files and systems that would cause serious problems if they disappeared tomorrow.
Check that they are being backed up, that the backups are recent and that you know how to restore them. Where practical, test the restoration of selected files or arrange a restoration test with your website professional.
Do not wait until an emergency to discover that a backup is missing, incomplete or unusable.
6. Respect Customer Information
Customer information is an important business asset, but it also creates responsibilities.
You may hold names, telephone numbers, addresses, email messages, photographs, quotations, payment records or other personal information. Collect only what you need for a legitimate business purpose, limit access and protect the information against loss or unauthorised access.
South Africa’s Protection of Personal Information Act (POPIA) sets requirements for the lawful processing and protection of personal information. The specific steps required depend on how your business collects, uses, stores and shares that information.
The Information Regulator provides official information about POPIA, including its security-safeguard requirements. Start with the Information Regulator’s POPIA resources. If your business has more complex requirements, seek advice from a suitably qualified professional.
Practical habits include:
- Collecting only information you genuinely need.
- Restricting access to people who need it for their work.
- Using appropriate security for stored documents and devices.
- Taking care when sharing customer information with suppliers or service providers.
- Reviewing how long information needs to be retained.
- Having a process for dealing with a suspected data breach.
Do not assume that information is harmless simply because it is old. Equally, do not delete records that you are legally or contractually required to retain. Establish a sensible retention process that takes your obligations into account.
What to do now
Review the customer information your business stores. Ask:
- Do we still need this information?
- Who can access it?
- Where is it stored?
- Is it appropriately protected?
- Do we have a reason to keep it for this length of time?
- Do we know what to do if it is lost or accessed without permission?
Make improvements where necessary and check the process periodically.
Cape Portal Tool: Website Privacy & Tracker Inspector
Use the Website Privacy & Tracker Inspector to inspect tracking technologies running on your website.
The results can help you understand what your website is doing. However, detecting a tracker does not by itself determine whether your website complies with privacy law. That depends on the technology involved, how information is processed and the applicable legal requirements.
Use the results to identify questions that may need attention, and seek professional advice if you are unsure about your obligations.
7. Do a Monthly Digital Check-Up
You do not have to wait for a problem before checking your online presence.
Set aside about 30 minutes each month to review the basics. A regular routine helps you spot issues while they are still manageable.
Ask yourself:
- Can customers reach the website?
- Does the telephone number work?
- Does the WhatsApp button open the correct contact?
- Are opening hours and contact details accurate?
- Are important Google Business Profile details correct?
- Are there new customer reviews that need a response?
- Are website backups being created and checked?
- Are important software updates waiting?
- Are there unfamiliar users or administrators?
- Are domain, hosting and email renewals under control?
- Are important business emails being delivered successfully?
Cape Portal tools that can help
- Cape Portal Website Speed Checker — use it to check whether your website is fast, could be faster or is slow. Find it through the Cape Portal Toolbox.
- Website Security & Health Checker — check important website and security signals.
- Universal Domain Expiry & Renewal Tracker — help keep track of important domain renewal dates.
- Email & Deliverability Checker — inspect important email and domain-related signals, such as SPF, DKIM and DMARC records.
- IP & Domain Reputation Checker — check whether the available blacklist services report a listing for a domain or IP address.
- Phishing Link & URL Safety Checker — investigate suspicious website links before interacting with them.
These tools check different things. For example, an email authentication check does not prove that every email will reach its destination, and a clear reputation result does not guarantee that every email provider will trust your domain or IP address.
Use the result that matches the problem you are investigating, and follow up on warnings you do not understand.
What to do now
Put a recurring reminder in your calendar for your monthly digital check-up.
Use the same checklist each month and keep a brief note of anything that needs attention, who will deal with it and whether it has been resolved.
Chapter 4 Action Plan
Work through this checklist to protect and maintain your online presence.
My digital safety checklist
- I have secured my main business email account.
- Two-step verification is enabled where available.
- My email recovery details are current.
- I have stopped reusing passwords on important accounts.
- I use a secure method for managing unique passwords.
- I know who has access to my important business accounts.
- I review access when someone leaves the business.
- I know how to recognise suspicious messages and unexpected login requests.
- I have checked that my website software is being maintained.
- I have removed unused website software where appropriate.
- I have a current website backup.
- Important business documents and photographs are backed up.
- I know how to restore important information if something goes wrong.
- I have reviewed who can access customer information.
- I have considered whether I still need the personal information I keep.
- I know where to find reliable guidance about my privacy responsibilities.
- I have put a monthly digital check-up in my calendar.
- I am keeping domain, hosting and other important renewal dates under control.
- I know where to get professional help if I find a technical or security problem I cannot safely fix myself.
You do not have to complete everything in one day. Start with your main email account, unique passwords and backups. Then work through the remaining items at a manageable pace.
Use the Tools — Then Take Action
Cape Portal tools are designed to help you identify problems and make everyday online tasks easier. A tool result is not the end of the process.
Check it. Understand it. Fix what you can. Then check again.
If a security or website tool identifies something you do not understand, do not make random changes just to make the warning disappear. Find out what the result means or ask a trusted website professional for help.
If you check a suspicious link, do not ignore other warning signs simply because the tool does not identify a known threat.
If your website needs maintenance, make sure someone takes responsibility for addressing it.
If you create a backup, make sure you know how to restore it.
If you discover a problem involving customer information, follow an appropriate response process and seek professional advice where necessary.
You do not need perfect security or an expensive collection of software. You need good habits, a simple maintenance routine and someone responsible for the important parts of your digital presence.
The goal is to reduce avoidable risks, protect important information and keep your online presence working.
Your Four-Part Small Business Guide
You have now reached the end of the guide’s four main chapters:
Get Found → Turn Visitors Into Enquiries → Make Your Business Easier to Manage → Keep Your Business Safe
Your online presence is not a once-off project. It needs occasional attention as your services, customers, technology and business needs change.
You do not need to do everything at once. Choose one improvement, put it into practice and build from there.
The tools can help you check. The action you take is what makes the difference.