How to Protect Your Website and More: Ten Rules for 2026

Protecting a business online in 2026 comes down to ten habits, not ten products. Use long unique passwords in a password manager, turn on two-factor authentication everywhere starting with your domain registrar, lock your domain, stop your email being spoofed, patch your website on a schedule, cut admin access to the minimum, verify every money request on a second channel, keep tested off-site backups, review AI-generated code, and make it normal for anyone to stop and ask. Almost every incident we clean up traces back to one of those ten being skipped.

None of it is clever. That is exactly why it works.

Why this is worth your attention now

In August 2026, OpenAI published an open letter calling for urgent action on cyber defence. More than 100 organisations signed it, including Google, Microsoft, Amazon Web Services, Cloudflare, GoDaddy and Visa.

The argument is that AI is about to make attacks far more widespread and far more sophisticated, and there is a limited window to get defences in order first.

The part that matters to you is the list of weaknesses they named. Longstanding bugs. Excessive permissions. Misconfigurations. Insecure and unpatched software. Weak authentication. Technical debt in old systems.

That is not a description of a hospital or a power station. That is a fair description of most business setups, including the website, the email accounts and the domain sitting behind them.

Here is why it changes the maths. AI makes the boring reconnaissance work cheap to automate. Finding vulnerable businesses used to take effort, which is why smaller organisations were often left alone. Small no longer means safe. It just means cheaper to attack.

The encouraging part is that almost every fix below is a switch in something you already pay for.

Your accounts

Rule 1: Long, unique passwords, kept in a password manager

Start here, because it is the one that stops the most.

Most businesses are still following password advice that has been formally withdrawn. Eight characters, one capital, one number, one symbol, changed every ninety days. That was the standard for twenty years. It is now the opposite of best practice.

The current guidance is NIST Special Publication 800-63B Revision 4, finalised in 2025. It says length beats complexity, and that forced rotation makes things worse rather than better.

What good looks like in 2026:

• Long, not complicated. At least fifteen characters where a password is the only thing protecting an account. Four or five unrelated words together is easier to remember and far harder to crack than a short mangled one.
• Different for every account. Reuse is what turns somebody else’s breach into your problem. This is the single biggest one.
• Change on evidence, not on a calendar. Ninety day rotation policies just produce Summer2025, then Autumn2025. Everyone knows it, including attackers. Revision 4 does not merely discourage forced rotation, it prohibits it.
• Check it has not already leaked. Have I Been Pwned will tell you free, in seconds, whether a password is already sitting in a breach database.
• Drop the security questions. Your mother’s maiden name and your first school are on social media. They are a way in, not a safety net.
• Use a password manager. Nobody remembers thirty unique fifteen character passwords, and pretending otherwise is exactly why people reuse them.
• Take passkeys where they are offered. They replace the password with something that cannot be phished, and support grows every month.

Rule 2: Two-factor authentication everywhere, starting with your registrar

A password is one lock. Two-factor is the second.

Turn it on for your domain registrar first, then email, then your website, then everything else. An app-based code or a hardware key beats an SMS code, because text messages can be intercepted and SIM cards can be swapped.

If you only get two things done this month, make it rules one and two.

Your domain and email

This is the section most businesses skip, and it protects the most valuable thing you own.

Rule 3: Lock the domain

Your domain is the crown jewel. Lose control of it and someone can redirect your website, read your email, and issue certificates in your name. Everything else you have built runs through it.

Four switches, all free:

• Two-factor authentication on the registrar account itself
• Domain transfer lock turned on
• Auto-renew turned on, so nobody can grab it during a lapse
• DNSSEC enabled where your registrar supports it

And no shared logins. Keep a short, named list of who can touch DNS.

Rule 4: Stop your email being spoofed

Spoofing an email address so it appears to come from a real person is not difficult. Our own clients have received emails pretending to be from me, and from Miles.

There are three records that live in your DNS and make that much harder. SPF says which servers are allowed to send email as you. DKIM signs your messages so they can be verified. DMARC tells receiving mail servers what to do when something fails those checks, and reports back to you.

Most small businesses have SPF half configured, DKIM missing, and DMARC either absent or set to do nothing. That is an open door. It is also an hour of work for whoever manages your DNS, and Google and Yahoo have been tightening requirements on bulk senders since 2024, so it affects whether your legitimate email lands too.

Your website

Rule 5: Update on a schedule, not when someone remembers

Core, plugins, themes, server software. Put a date in the diary and give it a named owner.

Unpatched software is the classic entry point and it is the reason most hacked sites get hacked. One of the sites we took on this year had been compromised for exactly that reason. Nobody had been updating it.

Rule 6: Delete what you do not use, and watch who owns what is left

Deactivated is not removed. A dormant plugin still sits on your server and still runs code when it is exploited.

Plugin ownership changes are now a genuine risk in their own right. In April 2026, WordPress.org permanently removed 31 plugins after a backdoor was found in every one. Nobody had been hacked. Somebody bought the plugin portfolio, inherited the right to push automatic updates to every site running them, and planted a backdoor disguised as a routine compatibility patch. It sat dormant for eight months before activating.

Every plugin is a supplier you are trusting. Keep the list short and pay attention when one changes hands.

Rule 7: Cut admin access to the minimum

Most people need Editor or Author, not Administrator. Go and look at your user list today. There will almost certainly be accounts belonging to people who left.

The same applies to Google Workspace and Microsoft 365. Two super-admins plus a break-glass account is plenty for most businesses. While you are in there, review which third-party apps have been granted access, because that is a quiet route for data to leave without anyone noticing.

Rule 8: Keep off-site backups, and actually test them

A backup you have never restored is a hope, not a backup.

Off-site matters. If your backup sits on the same hosting as the site, one compromise takes both. And if you are on Microsoft 365 or Google Workspace, neither provider backs your data up for you in any meaningful way. That is your job.

Try restoring something this quarter. Find out now, not on the day it matters.

Your money

Rule 9: Nothing involving money or credentials gets actioned on a single message

This is the one that costs businesses directly, and no firewall stops it.

Last week a client received an email from a company called WordPress International, telling them their hosting was unpaid and their site was about to be switched off. They paid it. There is no such organisation. The email just sounded official, had a deadline on it, and threatened something they cared about.

That is the simple version. Here is the version that is coming.

Cloning a voice used to need a studio and a specialist. It now needs a few minutes of audio and a subscription. Anyone who has spoken at an event, appeared on a podcast, or recorded a video for their own website has already supplied the raw material.

Picture it. A recorded message arrives from the managing director. They are about to board a plane. There is a deposit that needs sending for a project. They will call when they land.

Every trigger is in there. Authority, because it came from the top. Urgency, because the plane is leaving. A closed window, because you cannot ring back to check. And a completely plausible reason for a payment.

Most people would send that money. Not because they are careless, but because it looked and sounded exactly like the person it claimed to be from.

So the rule is a second channel. A voice is no longer proof of identity. Neither is an email address. If a message asks for money, a change of bank details, a password or access to something, verify it by a different route before acting. Ring the person on the number you already had for them, never one supplied in the message. If they are genuinely unreachable, that is a reason to wait, not a reason to hurry.

Two things that help alongside it. Write down who your actual suppliers are, hosting, domain, email, so your team has something to check an invoice against. And never click the link in a security warning email. Log into the dashboard yourself and look. Genuine problems will still be there when you get there.

Rule 10: Review AI-generated code before it goes live

The OpenAI letter names this specifically. If anyone on your team is pasting AI-written snippets into a website, a form or a script, that needs a review step before it ships. The convenience is real. So is the risk of shipping something nobody has actually read.

Your people, which is the rule above all the rules

If anything seems off, stop, pause and ask.

Nobody in your team should ever be in trouble for checking something twice. The day somebody feels awkward about querying an email from you is the day you have a problem no software fixes.

One habit worth passing round. When an email looks a bit off, paste it into an AI tool and ask whether it looks like a scam. It is good at spotting the patterns, the odd phrasing, the mismatched domains, the pressure language. It is not a definitive answer and should never be treated as clearance to pay anything, but it takes ten seconds and it catches things a busy person skims straight past.

Where to start if you only have an afternoon

1. Two-factor authentication on your domain registrar, then your email
2. Domain transfer lock and auto-renew on
3. Password manager rolled out, starting with anyone who has admin access anywhere
4. Cut the admin account list down
5. Tell your team, out loud, that checking twice is always the right call

That is one afternoon and it closes most of the gaps the OpenAI letter names.

The deeper work follows. Patching on a proper cycle, DMARC configured and monitored, tested off-site backups, a written plan for what happens when something does go wrong.

Key takeaway: the attacks aimed at businesses your size are patient rather than sophisticated, and ten unglamorous habits stop nearly all of them.

Next step: work through the ten rules with your team this week. If you are not sure whether your site is patched, your domain is locked or your email can be spoofed, get in touch and we will check it for you.