Free small-business cybersecurity learning center for websites, email, domains, and vendor trust.

Why it matters

Email compromise and domain spoofing can lead to invoice fraud, fake messages, and lost trust.

Who should review it

Businesses that send email from their own domain or rely on Microsoft 365 / Google Workspace.

What to check

• Check SPF, DKIM, and DMARC records
• Turn on MFA for mailbox/admin accounts
• Review forwarding rules and suspicious inbox filters
• Use a separate admin account where possible

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Weak or missing authentication can make spoofing, invoice fraud, and questionnaire follow-up harder to manage.

Who should review it

Businesses that send email from a company domain through Microsoft 365, Google Workspace, marketing tools, invoicing systems, or website forms.

What to check

• List every service that sends email for the domain
• Confirm SPF exists and does not include unknown senders
• Enable DKIM for each legitimate sender where available
• Publish DMARC in monitoring mode before enforcing stricter policy

When to ask for help

• You are not sure which services send email for the domain
• DMARC reports show failures you cannot explain

Why it matters

Weak or missing DMARC can make it easier for criminals to spoof a domain and send fake invoices, vendor messages, or staff impersonation emails.

Who should review it

Businesses using Microsoft 365, Google Workspace, or any service that sends email from the company domain.

What to check

• Confirm SPF exists and includes only legitimate senders
• Enable DKIM for Google Workspace, Microsoft 365, Resend, or other senders
• Publish DMARC and monitor results before moving to stricter enforcement
• Review reports before changing policies to reject
• Consider subdomains and third-party senders before tightening policy

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Website and domain gaps can create trust issues before a customer, patient, or client ever calls.

Who should review it

Businesses with websites, contact forms, booking pages, payment links, or client intake forms.

What to check

• Confirm HTTPS works on the public website
• Review DNS records and domain renewal ownership
• Check basic security headers and public form handling
• Remove unused plugins, pages, and old admin users

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Headers do not make a site invincible, but missing or weak headers are visible signals that a site may need safer browser-side defaults.

Who should review it

Businesses with public websites, booking pages, client portals, forms, or embedded third-party tools.

What to check

• Confirm HSTS only after HTTPS is stable
• Add CSP carefully and test forms, images, payments, and analytics before tightening
• Use X-Frame-Options or frame-ancestors to reduce unwanted framing
• Review Referrer-Policy and Permissions-Policy so pages share less browser context

When to ask for help

• A scanner reports missing headers and the web host, CDN, and developer disagree about ownership
• A CSP change could break scripts, forms, checkout, booking, or embedded widgets

Why it matters

Broken HTTPS, mixed content, or missing redirects can make a legitimate website look unsafe and can confuse customers or providers.

Who should review it

Any business with a public website, contact form, booking flow, payment link, or customer intake path.

What to check

• Confirm the main website loads over HTTPS
• Confirm HTTP redirects to HTTPS
• Check that the certificate matches the right domain
• Ask the host or web provider to fix certificate or redirect warnings

When to ask for help

• Browsers show certificate warnings or redirect loops
• Multiple providers disagree about who owns the fix

Why it matters

Unclear DNS ownership can delay security fixes, email changes, website launches, and vendor handoffs.

Who should review it

Businesses that inherited a domain, changed vendors, use multiple marketing/email tools, or are not sure where DNS is hosted.

What to check

• Identify the registrar and DNS host
• List major DNS records and what provider each one supports
• Remove stale verification records after confirming they are no longer needed
• Require MFA for accounts that can change DNS

When to ask for help

• Nobody knows who controls DNS or renewal settings
• A vendor asks for DNS changes and the business cannot verify impact

Why it matters

Domain ownership problems can interrupt website and email service, delay DNS changes, and make vendor handoff harder.

Who should review it

Businesses that inherited a domain, switched vendors, missed renewal notices, or are unsure who controls the registrar account.

What to check

• Identify the registrar and account owner
• Confirm renewal status and auto-renew settings
• Use registrar privacy where appropriate, while keeping internal ownership records clear
• Document DNSSEC status and registrar-lock options before changing providers

When to ask for help

• The domain is under an old vendor, employee, or unknown account
• Renewal, privacy, DNSSEC, or registrar-lock status is unclear

Why it matters

These signals do not prove anonymity, but they help users understand whether a network change appears to be visible to websites.

Who should review it

Owners and staff who use VPNs, remote work networks, shared Wi-Fi, hotspots, or browsers with WebRTC enabled.

What to check

• Check your public IP before and after enabling a VPN
• Run the IP, DNS & WebRTC Connection Check to review basic browser and WebRTC signals
• Use your VPN provider's own diagnostic page for resolver-specific validation
• Treat mDNS .local WebRTC results as privacy protection, not a failure

When to ask for help

• VPN behavior differs across browsers or devices and staff need plain-English guidance
• A business needs remote-access cleanup rather than a consumer anonymity test

Why it matters

Knowing what IP version and network are visible helps owners avoid confusing a normal provider change with a security issue.

Who should review it

Anyone troubleshooting VPNs, remote work, office networks, website allowlists, provider tickets, or suspicious sign-in alerts.

What to check

• Run the IP, DNS & WebRTC Connection Check
• Compare results on office Wi-Fi, mobile hotspot, and VPN
• Ask the ISP or IT provider whether the address is static, dynamic, or behind CGNAT when allowlisting matters
• Check IPv6 behavior separately because some VPNs handle IPv6 differently

When to ask for help

• A vendor asks for IP allowlisting and the business does not know whether the address changes
• IPv6 behaves differently from IPv4 when VPN, firewall, or remote access is enabled

Why it matters

A small number of overpowered accounts often control the website, email, DNS, payments, forms, and customer communication.

Who should review it

Businesses with website admins, domain/DNS admins, payment tools, cloud accounts, booking systems, former staff, or outside vendors.

What to check

• Require MFA for website, domain, DNS, email, payment, payroll, and cloud administrator accounts
• Remove old staff, contractor, and vendor accounts
• Document who owns each admin account and recovery path
• Avoid sending passwords, recovery codes, API keys, or secrets through forms or email

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Outdated website components and unmanaged integrations can create trust, maintenance, and security problems that are harder to fix during a vendor handoff.

Who should review it

Businesses using WordPress, website builders, booking widgets, form plugins, marketing scripts, payment links, or vendor-managed sites.

What to check

• List the CMS, plugins, themes, form tools, booking tools, payment links, and marketing integrations
• Remove unused plugins, abandoned integrations, demo content, and old admin users
• Confirm who updates the platform and who can restore the site
• Use a Snapshot to decide whether cleanup, redesign, takeover, or vendor handoff is the right next step

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Poor form handling can flood inboxes, expose sensitive requests, or train staff to ignore legitimate messages.

Who should review it

Businesses with public forms, booking widgets, quote forms, newsletters, lead magnets, or customer intake pages.

What to check

• Keep public forms short and avoid sensitive fields
• Use honeypots, rate limits, and neutral success responses for spam
• Do not ask for passwords, private keys, payment cards, or customer records
• Review where form notifications and stored submissions go

When to ask for help

• Form spam is flooding the inbox or hiding real requests
• A form asks for sensitive information it should not collect

Why it matters

A lost or compromised registrar account can interrupt website and email operations or make recovery difficult.

Who should review it

Owners, office managers, web vendors, and IT providers responsible for domain renewal or domain-level changes.

What to check

• Confirm the registrar name and billing owner
• Turn on MFA for registrar administrators
• Remove old vendor or staff access
• Document recovery email, phone, and renewal contact details

When to ask for help

• The domain is registered under an old vendor or employee account
• Renewal, recovery, or ownership details are unclear

Why it matters

Unsupported questionnaire answers can create business risk and follow-up work if evidence does not match reality.

Who should review it

Businesses that use software vendors, payment processors, booking tools, IT providers, marketing agencies, payroll platforms, or outsourced staff.

What to check

• Identify what the questionnaire is really asking
• Collect evidence for MFA, backups, access, policies, and vendors
• Avoid claiming controls that are not actually in place
• Use plain-English notes for owner or IT provider approval

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Owners need to understand what insurers commonly ask for before claiming controls or submitting unsupported answers.

Who should review it

Small businesses preparing for cyber insurance applications, renewals, broker questions, or insurer follow-up requests.

What to check

• Identify MFA coverage for business email, admin accounts, and key systems
• Confirm backups exist and know who can restore critical files
• Review SPF, DKIM, DMARC, and basic email-security evidence
• Collect vendor-ready notes for IT, web, DNS, email, and software vendors

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Owners need a short, defensible fix order before spending time or money on deeper security work.

Who should review it

Every small business with email, a website, online payments, client records, or cloud accounts.

What to check

• List the accounts, website, email provider, and files that matter most
• Turn on MFA for owner, email, banking, payroll, and admin accounts
• Confirm backups exist and at least one restore has been tested
• Use a Snapshot when you need a prioritized public-facing review

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

A redesign is the best time to clean up SSL/TLS, forms, admin access, domain/DNS ownership, and vendor handoff before old issues are rebuilt into the new site.

Who should review it

Businesses replacing a website, changing platforms, adding forms, or hiring a new web vendor.

What to check

• Confirm who controls the domain, DNS, website hosting, and forms
• Review HTTPS, redirects, and security headers before launch
• Document admin accounts and MFA
• Keep launch and owner handoff notes

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

When ownership is unclear, website, email, and security fixes take longer and can become risky during vendor transitions.

Who should review it

Owners who inherited a website, changed vendors, or are not sure where DNS and email settings live.

What to check

• Identify the domain registrar and DNS provider
• List the website host, email provider, and major senders
• Confirm admin accounts and MFA status
• Document renewal contacts and recovery paths

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

A clean handoff reduces lockout risk and makes the next provider conversation more concrete.

Who should review it

Businesses switching vendors, recovering from poor handoff, or cleaning up a messy existing setup.

What to check

• Collect provider names and account owners
• Confirm authorization before requesting or changing access
• Document domains, DNS zones, hosting, forms, email, and admin accounts
• Avoid sending passwords through email or forms

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

A compromised cloud account can expose client records, invoices, contracts, employee data, and internal files.

Who should review it

Businesses using Microsoft 365, Outlook, Gmail, Google Workspace, SharePoint, OneDrive, or Google Drive.

What to check

• Require MFA for all users
• Review admin users and shared mailboxes
• Disable unused accounts quickly
• Check external sharing settings

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Payment-change scams and fake login messages can move quickly if staff do not have a simple verification habit.

Who should review it

Owners, office managers, finance staff, receptionists, and anyone who handles email, invoices, texts, or calls.

What to check

• Verify payment and bank-change requests out of band
• Train staff to pause before opening links or attachments
• Report suspicious messages internally
• Use MFA so stolen passwords are less useful

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Recovery planning keeps a bad day from becoming a long business interruption.

Who should review it

Businesses that store documents, customer records, invoices, images, contracts, schedules, or operational files.

What to check

• Identify critical files, systems, and cloud accounts
• Use cloud backup, versioning, or another documented backup path
• Test restoring a file before there is an emergency
• Document who to call if systems go down

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Old accounts, shared passwords, weak passwords, and unnecessary admin access create easy entry points.

Who should review it

Any business with employees, contractors, vendors, shared accounts, or former staff.

What to check

• Use a password manager
• Avoid shared passwords where possible
• Remove access immediately when someone leaves
• Give admin access only when needed

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Owner account compromise can affect business email, banking, domain access, social media, and customer communication.

Who should review it

Owners, partners, office managers, and family members who control business accounts, payments, devices, or recovery emails.

What to check

• Secure the primary personal email account first
• Turn on MFA for identity, banking, phone, and cloud accounts
• Review recovery emails, phone numbers, and unknown devices
• Do not send passwords, recovery codes, SSNs, or bank details through forms

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Basic security hygiene can drift when domains, email tools, websites, vendors, and staff access change over time.

Who should review it

Small businesses that want scoped monthly website and public-facing security oversight without buying a full MSP, helpdesk, SOC, or MDR.

What to check

• Document the baseline after fixes are complete
• Review public domain, email, and website signals on a cadence
• Track follow-up items, ownership, and vendor-ready notes
• Use External Security Watch for scoped oversight, not 24/7 monitoring

When to ask for help

• You are not sure who owns the setting or provider account
• A client, vendor, insurer, or provider needs clearer evidence

Why it matters

Clear boundaries prevent delayed emergency action and keep routine cleanup separate from active incident handling.

Who should review it

Businesses seeing suspicious inbox rules, unknown admin users, payment-change messages, website defacement, or provider alerts.

What to check

• Preserve suspicious messages, timestamps, and provider alerts
• Change passwords and revoke sessions only through trusted provider guidance
• Contact the affected provider, bank, insurer, or legal adviser when appropriate
• Use cleanup or Snapshot only after immediate safety and ownership questions are stable

When to ask for help

• Money movement, customer data, or active account compromise may be involved
• You need emergency response beyond public-signal review or cleanup planning

Why it matters

Clean handoff notes reduce lockout risk, duplicated work, and unsupported changes to critical settings.

Who should review it

Businesses switching web vendors, IT providers, marketing agencies, website platforms, or email providers.

What to check

• List current providers and account owners
• Confirm authorization before access changes
• Share vendor-ready notes instead of passwords in email
• Document what changed, who changed it, and what still needs follow-up

When to ask for help

• A provider asks for broad admin access without explaining why
• You need a prioritized fix order before assigning work