Lock down the five accounts that can take your business offline

Five accounts can interrupt most of a small business’s online operation: primary email, the domain registrar, website host, Google Business Profile, and social accounts. Start with email, because the password resets for everything else land there; then the registrar, because email depends on the domain.

Canada’s Cyber Centre baseline controls and the US CISA Secure Our World guidance both emphasize strong authentication, phishing resistance, and current software. This checklist turns that advice into one afternoon of work.

1. Primary email

• Use a unique password generated by a password manager.
• Turn on a passkey, security key, or authenticator-based multi-factor authentication.
• Add a business-controlled recovery route.
• Store backup codes offline in a secure location.
• Review forwarding rules, app passwords, and signed-in devices.

If one person leaves, the business must still be able to reset the mailbox.

2. Domain registrar

• Confirm the registrant and account owner.
• Enable multi-factor authentication.
• Turn on auto-renew and expiry alerts.
• Keep the ordinary registrar transfer lock enabled.
• Protect the authorization code.
• Review DNS changes and account notifications.

CIRA explains that a .ca domain showing TransferProhibited is locked. Its separate paid Registry Lock is intended for higher-risk domains and is not necessary for every small brochure site.ICANN explains the registrar lock and authorization-code protections used for generic-domain transfers.

3. Hosting and source

Protect the Cloudflare, builder, or hosting login. Then protect the source repository and any deployment token. Add a second business owner rather than sharing the primary password.

Follow the business-data backup and restore workflow for website source, email, invoices, and customer records. Synchronization and version history do not automatically cover account loss. Inventory coverage, keep a suitably protected separate copy, and restore a sample. A backup that has never been restored is an assumption.

4. Google Business Profile

Use individual users with named access. Keep at least two trusted business owners, remove former employees and agencies, and reject unexpected requests for ownership. Never read a verification or multi-factor code to a caller.

5. Social accounts

Use the platform’s business manager where available. Give staff roles instead of the founder’s password. Secure the original profile that controls the business page, because page-level settings may not protect the underlying personal account.

Strongest practical authentication

Prefer a passkey or hardware security key, then an authenticator app. SMS is better than a password alone, but phone-number theft and coverage problems make it a weaker recovery foundation.

Do not reuse passwords. A password manager makes unique credentials practical. The master account needs its own strong recovery plan and backup code.

Quarterly recovery test

Every three months:

1. Confirm both owners can sign in.
2. Check recovery email and phone.
3. Review devices, sessions, and third-party app access.
4. Confirm backup-code location.
5. Remove departed people.
6. Verify the domain lock, expiry date, and billing method.
7. Record the test date in the ownership checklist.

The free route uses built-in security controls and a password manager you already trust. Pay for managed identity or security support when the team is large enough that onboarding, offboarding, audit evidence, or incident response can no longer be handled reliably by one owner.