Blog post overview and metadata
Author, publish date, read time, and category
Securing the Accounts Your Business Runs On: 2FA, Access and Leavers
Reviewed by: ARS Developer | Updated: 30 Sep 2026 | UK Focus: Buyer-intent SEO, web delivery, and measurable conversion growth.
Quick Summary
Most small business breaches are not clever. They are a reused password, an admin account belonging to someone who left, or a domain nobody could prove they owned.
In This Guide
Why This Article Is Trustworthy
- Reviewed by the ARS Developer editorial team for UK business relevance.
- Structured around buyer-intent SEO, technical delivery, and measurable conversion outcomes.
- Connected to related service pages, pricing guidance, and supporting articles for stronger topic depth.
Quick Answer
The incidents that actually happen to small businesses are mundane: a password reused from a site that was breached, an administrator account still active for someone who left last year, or a hosting login shared by four people. Fixing those costs almost nothing and removes most of the risk.
Two-factor authentication, starting with the email account
Turn it on for email first. Email is the recovery route for everything else, so an attacker who controls it can reset the hosting, the domain, the bank and the payment provider regardless of how strong those passwords are.
Prefer an authenticator app or a hardware key over SMS. SMS is far better than nothing, but it is defeated by SIM swapping, which is a realistic threat for any business whose owner is easy to identify online — which is to say, any business with a website.
Named accounts, not shared logins
A single administrator login shared among the team cannot be audited, cannot be revoked for one person, and has to be changed for everyone whenever anybody leaves — so in practice it never is. Every system that supports individual accounts should have them.
Give each person the least access their job needs. A content editor does not need the ability to install plugins or add users, and the cost of that restraint is roughly nil compared with the cost of a compromised account that could do anything.
Offboarding is where the gaps accumulate
When someone leaves, the email account usually gets dealt with. What survives is everything else: the hosting panel, the CMS, the analytics property, the payment dashboard, the social accounts, the domain registrar, and any personal device still holding a session.
Keep a written list of every system and who has access, and work through it on the day someone leaves rather than from memory. The same list is what you will need if you ever have to answer how an incident happened.
Own your domain, and prove it
The domain is the one asset whose loss is close to unrecoverable, because everything — email, website, logins — depends on it. It should be registered to the business rather than to a developer or a former employee, with the registrar account under your control and its own two-factor authentication.
Enable the registrar's transfer lock, set the renewal to automatic, and make sure the contact address on the account is one somebody still reads. Domains are lost to an expiry notice sent to an address nobody has checked since the person who set it up moved on.
Frequently Asked Questions
Is SMS two-factor good enough?
It is much better than nothing and much weaker than an app or hardware key, because SIM swapping defeats it. Use it where nothing better is offered.
Do we need a password manager?
For any team sharing access to business systems, yes. It is the only practical way to have unique passwords per service and to revoke access cleanly when someone leaves.
What should we check first?
Two-factor on the email account that can reset everything else, then who still has access to your hosting and domain registrar.
Who should own the domain registration?
The business, in an account the business controls. A domain in a supplier's or employee's name is a dependency you cannot resolve quickly if the relationship ends.
Next Step
An access review across your hosting, domain, CMS and payment accounts takes an hour and usually finds something. Ask us to run one with you.
Next Step Resources
Move from research into action with the most relevant service, proof, pricing, and project planning pages for this topic.
Tags:
Leave a Comment
Ask a practical question, share a project insight, or add a useful note. Every comment is reviewed before it appears publicly.